Virtualized network honeypots

• US 10,645,118 B2
• Filed: 03/05/2018
• Issued: 05/05/2020
• Est. Priority Date: 12/04/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brown, Jr., Dennis Naylor, Mosthaf, Volker Helmut
• Primary Examiner(s): Zhao, Don G
• Application Number:
  US15/911,720
• Publication Number:
  US 20180198822A1
• Time in Patent Office: 792 Days
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Disclosed are various embodiments for virtualized network honeypots. Network traffic is received from a connecting device. It is determined whether the network traffic is authorized or unauthorized. The network traffic is selectively routed to a requested network service or to a honeypot server based at least in part on whether the network traffic is authorized or unauthorized.

Claims

1. A method, comprising:

receiving, via at least one of one or more computing devices, network traffic from a connecting device;

determining, via at least one of the one or more computing devices, whether the network traffic is authorized; and

selectively routing, via at least one of the one or more computing devices, the network traffic to a requested network service or to a honeypot server based at least in part on whether the network traffic is authorized, wherein the network traffic is selectively routed by one of the one or more computing devices that also executes the requested network service, and the honeypot server is executed on a different computing device than the requested network service.

2. The method of claim 1, wherein the network traffic specifies a network address and a port corresponding to the requested network service.

3. The method of claim 1, further comprising sending, via at least one of the one or more computing devices, a notification to an administrator in response to selectively routing the network traffic to the honeypot server.

4. The method of claim 1, further comprising dynamically launching, via at least one of the one or more computing devices, a machine instance corresponding to the honeypot server in an elastic computing environment based at least in part on the network traffic.

5. The method of claim 4, further comprising dynamically terminating, via at least one of the one or more computing devices, the machine instance corresponding to the honeypot server.

6. The method of claim 1, wherein the honeypot server is configured to masquerade as the requested network service to the connecting device.

7. The method of claim 1, wherein determining, via at least one of the one or more computing devices, whether the network traffic is authorized further comprises determining, via at least one of the one or more computing devices, whether a network address of the connecting device is on a whitelist, wherein the network traffic is authorized when the network address is on the whitelist.

8. The method of claim 1, wherein determining, via at least one of the one or more computing devices, whether the network traffic is authorized further comprises determining, via at least one of the one or more computing devices, whether a network address of the connecting device is not on a blacklist, wherein the network traffic is authorized when the network address is not on the blacklist.

9. The method of claim 8, further comprising updating, via at least one of the one or more computing devices, the blacklist by an intrusion detection system.

10. A system, comprising:

a computing device;

a network service executable in the computing device; and

a connection routing service executable in the computing device, wherein when executed the connection routing service causes the computing device to at least;

receive network traffic from a connecting device, the network traffic specifying the network service as a destination;

determine whether the network traffic is authorized; and

selectively route the network traffic to the network service or to a honeypot server based at least in part on whether the network traffic is authorized, wherein the honeypot server is executed on a different computing device than the network service.

11. The system of claim 10, wherein when executed the connection routing service further causes the computing device to at least send a notification to an administrator in response to selectively routing the network traffic to the honeypot server.

12. The system of claim 10, wherein when executed the connection routing service further causes the computing device to at least dynamically launch a machine instance corresponding to the honeypot server in an elastic computing environment based at least in part on the network traffic.

13. The system of claim 10, wherein the honeypot server is configured to mimic an expected function of the network service.

14. The system of claim 10, wherein whether the network traffic is routed to the network service or to the honeypot server is indistinguishable to the connecting device.

15. The system of claim 10, wherein the connecting device corresponds to a workstation of a user, and the network traffic is determined to be unauthorized in response to determining that the user is on vacation.

16. The system of claim 10, wherein the network traffic is determined to be authorized based at least in part on at least one of:

a time of day or a volume of connection requests received from the connecting device.

17. The system of claim 10, wherein the network traffic is determined to be authorized based at least in part on whether a transport layer security (TLS) client certificate is presented by the connecting device.

18. A non-transitory computer-readable medium embodying a program executable in at least one computing device, wherein when executed the program causes the at least one computing device to at least:

receive first network traffic from a first connecting device, the first network traffic specifying a network service as a destination;

determine that the first network traffic is authorized;

route the first network traffic to the network service, the network service being executed in a same computing device as the program;

receive second network traffic from a second connecting device, the second network traffic specifying the network service as the destination;

determine that the second network traffic is unauthorized; and

route the second network traffic to a honeypot server instead of the network service, the honeypot server being configured to masquerade as the network service to the second connecting device, wherein the honeypot server is executed on a different computing device than the network service.

19. The non-transitory computer-readable medium of claim 18, wherein when executed the program further causes the at least one computing device to at least dynamically launch a machine instance corresponding to the honeypot server in an elastic computing environment based at least in part on the second network traffic.

20. The non-transitory computer-readable medium of claim 18, wherein when executed the program further causes the at least one computing device to at least:

receive third network traffic from the first connecting device, the third network traffic specifying the network service as the destination;

determine that the third network traffic is unauthorized; and

route the third network traffic to the honeypot server instead of the network service, the honeypot server being configured to masquerade as the network service to the first connecting device.