Identifying potential intruders on a server

• US 20030065948A1
• Filed: 10/02/2001
• Published: 04/03/2003
• Est. Priority Date: 10/02/2001
• Status: Active Grant

• Current Assignee: X Corp. (f/k/a Twitter, Inc.) (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Wilkes, William Francis
• Granted Patent: US 7,032,244 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

An intruder on a server is identified by providing files having attractive names in a subdirectory of the server. An agent is provided within one or more of the files. The agent is launched on an intruder'"'"'s processor after the file containing the agent is downloaded. The agent locates various files and data on the intruder'"'"'s processor and sends copies of the files and data to the server thus allowing a network administrator at the server to identify the intruder.

Claims

1. A method of identifying an intruder on a server, comprising the steps of:

providing one or more lightly protected subdirectories on said server, each of said subdirectories having files with attractive names simulating content of interest to an intruder having a processor;

providing an agent within one or more of said files, adapted to be launched on said processor when said intruder downloads from said server, a file having said agent; and

receiving from said processor via a non-erasable transfer initiated by said agent, encrypted data of address book entries, custom word processing templates, e-mail files, letterheads, closure files, or signature files.

2. The method of claim 1, wherein said attractive names are lists of user ids.

3. The method of claim 1, wherein said attractive names are weakly encrypted passwords.

4. The method of claim 1, wherein said attractive names comprise names that appear to relate to very advanced technology.

5. The method of claim 1, wherein said agent attaches itself to an operating system on said processor.

6. The method of claim 1, wherein said agent launches on startup of said processor.

7. The method of claim 1, wherein said agent launches on said processor at timed intervals.

8. The method of claim 1, further comprising monitoring network connections of said processor by said agent and receiving log entries from said processor when said processor connects to said server.

9. The method of claim 1, further comprising monitoring network connections of said processor by said agent and receiving keystroke histories of said intruder from said processor when said processor connects to said server.

10. A computer system for identifying an intruder on a server, comprising:

a server;

means for providing one or more lightly protected subdirectories on said server, each of said subdirectories having files with attractive names simulating content of interest to an intruder having a processor;

an agent within one or more of said files, adapted to be launched on said processor when said intruder downloads from said server, a file having said agent; and

means for receiving from said processor via a non-erasable transfer initiated by said agent, encrypted data of address book entries, custom word processing templates, e-mail files, letterheads, closure files, or signature files.

11. The system of claim 10, wherein said attractive names are lists of user ids.

12. The system of claim 10, wherein said attractive names are weakly encrypted passwords.

13. The system of claim 10, wherein said attractive names comprise names that appear to relate to very advanced technology.

14. The system of claim 10, wherein said agent is adapted to attach itself to an operating system on said processor.

15. The system of claim 10, wherein said agent is adapted to launch on startup of said processor.

16. The system of claim 10, wherein said agent is adapted to launch on said processor at timed intervals.

17. The system of claim 10, further comprising means for monitoring network connections of said processor by said agent and means for receiving log entries from said processor when said processor connects to said server.

18. The system of claim 10, further comprising means for monitoring network connections of said processor by said agent and means for receiving keystroke histories of said intruder from said processor when said processor connects to said server.

19. A computer program product for instructing a processor to identify an intruder on a server, said computer program product comprising:

a computer readable medium;

first program instruction means for providing one or more lightly protected subdirectories on said server, each of said subdirectories having files with attractive names simulating content of interest to an intruder having a processor;

second program instruction means for providing an agent within one or more of said files, adapted to be launched on said processor when said intruder downloads from said server, a file having said agent; and

third program instruction means for receiving from said processor via a non-erasable transfer initiated by said agent, encrypted data of address book entries, custom word processing templates, e-mail files, letterheads, closure files, or signature files; and

wherein all said program instruction means are recorded on said medium.

20. The computer program product of claim 19, further comprising fourth program instruction means for monitoring network connections of said processor by said agent and receiving keystroke histories of said intruder from said processor when said processor connects to said server.