Multi-factor deception management and detection for malicious actions in a computer network
First Claim
1. A network surveillance method to detect attackers, comprising:
- planting one or more honeytokens in one or more resources in a network of computers in which users access the resources in the network based on credentials, wherein a honeytoken is an object in memory or storage of a first resource that may be used by an attacker to access a second resource using decoy credentials, comprising;
planting a first honeytoken in a first resource, R1, used to access a second resource, R2, using first decoy credentials; and
planting a second honeytoken in R1, used to access a third resource, R3, using second decoy credentials; and
alerting that an attacker is intruding the network only in response to both (i) an attempt to access R2 using the first decoy credentials, and (ii) a subsequent attempt to access R3 using the second decoy credentials.
0 Assignments
0 Petitions
Accused Products
Abstract
A network surveillance method to detect attackers, including planting one or more honeytokens in one or more resources in a network of computers in which users access the resources in the network based on credentials, wherein a honeytoken is an object in memory or storage of a first resource that may be used by an attacker to access a second resource using decoy credentials, including planting a first honeytoken in a first resource, R1, used to access a second resource, R2, using first decoy credentials, and planting a second honeytoken in R1, used to access a third resource, R3, using second decoy credentials, and alerting that an attacker is intruding the network only in response to both (i) an attempt to access R2 using the first decoy credentials, and (ii) a subsequent attempt to access R3 using the second decoy credentials.
135 Citations
3 Claims
-
1. A network surveillance method to detect attackers, comprising:
-
planting one or more honeytokens in one or more resources in a network of computers in which users access the resources in the network based on credentials, wherein a honeytoken is an object in memory or storage of a first resource that may be used by an attacker to access a second resource using decoy credentials, comprising; planting a first honeytoken in a first resource, R1, used to access a second resource, R2, using first decoy credentials; and planting a second honeytoken in R1, used to access a third resource, R3, using second decoy credentials; and alerting that an attacker is intruding the network only in response to both (i) an attempt to access R2 using the first decoy credentials, and (ii) a subsequent attempt to access R3 using the second decoy credentials. - View Dependent Claims (2, 3)
-
Specification