Method and apparatus for providing mobile honeypots

• US 20050210534A1
• Filed: 03/15/2005
• Published: 09/22/2005
• Est. Priority Date: 03/16/2004
• Status: Active Grant

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Krishnamurthy, Balachander
• Granted Patent: US 8,156,556 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method and apparatus for detecting an originator of traffic of interest is provided. One or more honeypots are established. Mobility is then provided to the one or more honepots. In one embodiment, mobility is provided by communicating information associated with one or more dark prefixes. In another embodiment, mobility is provided by varying information related to the one or more dark prefixes.

Claims

1. A method of detecting an originator of traffic of interest, comprising:

establishing one or more honeypots; and

providing mobility to said one or more honeypots.

2. The method of claim 1, wherein establishing one or more honeypots comprising:

establishing one or more dark prefixes associated with one or more destinations;

advertising said one or more dark prefixes; and

collecting data associated with traffic received by said one or more destinations.

3. The method of claim 1, wherein the one or more destinations send default replies to the originator of the traffic of interest.

4. The method of claim 2, wherein said mobility is provided by communicating information associated with said one or more dark prefixes.

5. The method of claim 4, wherein the information is dynamically shared with a network of friendly autonomous systems.

6. The method of claim 5, wherein the friendly autonomous systems take remedial action based on said information.

7. The method of claim 2, wherein a classification of said originator of said traffic of interest is determined in accordance with a threshold.

8. The method of claim 2, wherein said mobility is provided by varying information related to the one or more dark prefixes.

9. The method of claim 8, wherein a length of the one or more prefixes is varied.

10. The method of claim 8, wherein a duration of said one or more advertised prefixes is varied.

11. The method of claim 8, wherein a threshold for said received traffic is varied.

12. The method of claim 2, wherein the mobile honeypots operate in at least one of a cooperative mode and a non-cooperative mode.

13. The method of claim 12, wherein in said non-cooperative mode an autonomous system does not inform other autonomous systems that the prefix is dark.

14. The method of claim 13, wherein information about the traffic of interest is shared subsequently with other autonomous systems.

15. The method of claim 12, wherein in said cooperative mode an optional field is used along with said advertised dark prefix, so that other autonomous systems are aware of the advertised dark prefix.

16. The method of claim 15, wherein, in response to said optional field, the other autonomous systems drop the traffic of interest but communicate information about said originator of said traffic of interest.

17. The method of claim 15, wherein, in response to said optional field, the other systems identify the traffic of interest, record information about the originator of said traffic of interest, and allow the traffic of interest to pass.

18. The method of claim 12, wherein autonomous systems in the cooperative mode maintain additional checks for traffic exceeding a threshold.

19. A computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform the steps of a method of detecting an originator of traffic of interest, comprising:

establishing one or more honeypots; and

providing mobility to said one or more honeypots.

20. An apparatus for detecting an originator of traffic of interest, comprising:

means for establishing one or more honeypots; and

means for providing mobility to said one or more honeypots.