Detecting malicious activity by using endemic network hosts as decoys

• US 10,404,747 B1
• Filed: 07/24/2018
• Issued: 09/03/2019
• Est. Priority Date: 07/24/2018
• Status: Active Grant

• Current Assignee: illusive networks LTD.
• Original Assignee: illusive networks LTD.
• Inventors: Sela, Tom, Baz, Magal
• Primary Examiner(s): Pham, Luu T
• Assistant Examiner(s): Malinowski, Walter J
• Application Number:
  US16/044,477
• Time in Patent Office: 406 Days
• Field of Search: 726 23
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A system for detecting malicious activity in networks, including a deception manager having administrative credentials for a network, planting deceptions within network hosts, and distributing a decoy agent to each endemic decoy host (EDH), each deception including information regarding decoy communication ports of an EDH, each EDH having a group of ports, referred to as decoy ports, for connection by an attacker from a network host that the attacker has breached, wherein each decoy agent is programmed to alert the deception management server, and to proxy communication with the attacker to a trap server, in response to the decoy agent identifying the attacker attempting a connection to the decoy agent'"'"'s EDH via one of the decoy ports, and a forensic collector that collects, from the breached network host, forensics of the attacker'"'"'s activity, when the decoy agent acts as a proxy between the attacker and the trap server.

Claims

1. A system for detecting malicious activity in an organization network that includes network hosts, endemic decoy hosts (EDHs) and trap servers, wherein an EDH is an actual resource in the network used to host a decoy agent, comprising:

a deception management server having administrative credentials for the organization network, configured to (1) store deceptions within network hosts, each deception providing information that includes at least one decoy communication port of an EDH, (2) distribute a decoy agent to each EDH, wherein each decoy agent comprises active running hardware or software, and each decoy agent is configured to release a decoy port when software on the decoy agent'"'"'s EDH attempts to bind a port that is currently being used as a decoy port, and (3) generate a deception scheme setting forth (i) which deceptions to store in which network hosts, (ii) for each decoy agent, which ports of the decoy agent'"'"'s EDH to activate as decoy ports, and (iii) which trap server the decoy agent proxies communication to in response to the decoy agent identifying an attempt to communicate with the decoy agent'"'"'s EDH via one of the decoy ports, wherein a deception stored in a web browser of a network host points to a deceptive web server, and wherein the trap server, to which the decoy agent proxies communication with an attacker who follows the deception, is a web server hosting a deceptive website;

at least one network host configured to store deceptions received from said deception management server;

at least one EDH, each EDH having a first group of ports for communication applications, and a second group of ports, referred to as decoy ports, for connection by an attacker from a network host that the attacker has breached, using a deception stored in the breached network host, wherein each decoy agent is programmed to alert said deception management server, and to proxy communication with the attacker to a trap server, in response to the decoy agent identifying the attacker attempting a connection to the decoy agent'"'"'s EDH via one of the decoy ports, each EDH having a dual function as an active resource in the network and as a decoy host simultaneously;

at least one trap server, to which a decoy agent proxies communication with the attacker, each trap server running services that interact with the attacker; and

a forensic collector configured to collect, from the breached network host, forensics of the attacker'"'"'s activity vis-à

-vis the breached network host, when said decoy agent acts as a proxy between the attacker and a trap server and the trap server interacts with the attacker, the forensics comprising the processes run and the tools used by the attacker.

2. The system of claim 1, wherein said deception management server is configured to update the deception scheme in the network so as to reflect the released decoy port on the decoy agent'"'"'s EDH.

3. The system of claim 1 wherein each decoy agent is implemented in software, and runs as a process on the operating system of the decoy agent'"'"'s EDH.

4. The system of claim 1 wherein each decoy agent uses an inline component of the decoy agent'"'"'s EDH that is able to monitor and divert incoming and outgoing communication.

5. A method for detecting malicious activity in an organization network that includes network hosts, endemic decoy hosts (EDHs) and trap servers, wherein an EDH is an actual resource in the network used to host a decoy agent, comprising:

storing, by a deception management server, deceptions within network hosts, each deception providing information that includes at least one decoy communication port of an EDH;

distributing, by the deception management server, decoy agents to EDHs, wherein each EDH has a first group of ports for communication applications, and a second group of ports, referred to as decoy ports, for connection by an attacker who has breached a network host using a deception stored in the breached network host, and wherein the decoy agents comprise active hardware or software components that run on the EDHs, listen to decoy ports, send alerts to the deception management server, and proxy communication to trap servers, each EDH having a dual function as an active resource in the network and as a decoy host simultaneously;

generating, by the deception management server, a deception scheme setting forth (i) which deceptions to store in which network hosts, (ii) for each decoy agent, which ports of the decoy agent'"'"'s EDH to activate as decoy ports, and (iii) which trap server the decoy agent proxies communication to, when an attempt to communicate with the decoy agent'"'"'s EDH via one of the decoy ports is identified, wherein a deception stored in a network host'"'"'s web browser points to a deceptive web server, and wherein the trap server to which the decoy agent proxies communication with an attacker who follows the deception, is a web server hosting a deceptive website;

releasing, by each decoy agent, a decoy port when software on the decoy agent'"'"'s EDH attempts to bind a port that is currently being used as a decoy port;

proxying, by each decoy agent, communication with the attacker through a trap server, in response to the decoy agent identifying an attempt by the attacker to connect to the EDH by one of the decoy ports, wherein the trap server runs services that interact with the attacker;

triggering, by the trap server, an alert to the deception management server when a decoy agent proxies communication between the attacker and the trap server; and

collecting, from the breached network host, forensics of the attacker'"'"'s activity vis-à

-vis the breached network host, when the decoy agent acts as a proxy between the attacker and the trap server and the trap server interacts with the attacker, the forensics comprising the processes run and the tools used by the attacker.

6. The method of claim 5, wherein said deception management server updates the deception scheme in the network so as to reflect the released decoy port on the decoy agent'"'"'s EDH.

7. The method of claim 5, wherein each decoy agent is configured to run in two modes;

namely, a block mode and a proxy mode, wherein in block mode the decoy agent triggers an alert in response to the decoy agent identifying an attempt to communicate with the decoy agent'"'"'s EDH via a decoy port, and wherein in proxy mode the decoy agent triggers an alert and also proxies communication to a trap server, in response to the decoy agent identifying an attempt to communicate with the decoy agent'"'"'s EDH through a decoy port.

8. The method of claim 5 further comprising:

learning, by each decoy agent, which ports are being used by the decoy agent'"'"'s EDH; and

transmitting a list of the ports being used to the deception management server.

9. The method of claim 5 further comprising causing, by the deception management server, an EDH to uninstall a decoy agent that was previously installed in the EDH.

10. The method of claim 5, further comprising causing, by the deception management server, a network host to remove a deception that was previously stored in the network host.