SYSTEM AND METHOD FOR VOIP HONEYPOT FOR CONVERGED VOIP SERVICES

• US 20120167208A1
• Filed: 12/27/2010
• Published: 06/28/2012
• Est. Priority Date: 12/27/2010
• Status: Active Grant

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Buford, John F., Krishnaswamy, Venkatesh
• Granted Patent: US 8,752,174 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 65/1053 IP private branch exchange [PBX] functionality entities or arrangements circuit switched PBXs H04M3/00
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54
• CPC Class Codes: H04M 3/5183 Call or contact centers with computer-telephony arrangements
• CPC Class Codes: H04M 3/53308 Message originator indirectly connected to the message centre, e.g. after detection of busy or absent state of a called party
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42

Abstract

Disclosed herein are systems, methods, and computer-readable storage media for a honeypot addressing cyber threats enabled by convergence of data and communication services in an enterprise network. Suspicious incoming VoIP calls from the Internet to the enterprise network are intercepted and directed to a VoIP honeypot that acts as a network decoy and responds automatically during call sessions for the suspicious incoming VOIP calls while tracing the suspicious incoming VOIP calls. Suspicious outgoing VoIP calls from the enterprise network to the Internet are also intercepted and directed to the VoIP honeypot. Moreover, an unsolicited VoIP call is redirected to the VoIP honeypot when the unsolicited VoIP call has been received by a user agent in the enterprise network and a human user of the user agent confirms that the unsolicited VoIP call was unsolicited.

Claims

1. A method of addressing cyber threats enabled by convergence of data and communications services in an enterprise network, the method comprising a data processor executing computer instructions stored on a non-transitory computer readable storage medium to perform the steps of:

(a) intercepting suspicious incoming VoIP calls from the Internet to the enterprise network, and directing the suspicious incoming VOIP calls to a VoIP honeypot that acts as a network decoy and responds automatically during call sessions for the suspicious incoming VOIP calls while tracing the suspicious incoming VOIP calls; and

(b) intercepting suspicious outgoing VoIP calls from the enterprise network to the Internet, and directing the suspicious outgoing VOIP calls to the VoIP honeypot that acts as a network decoy that responds automatically during call sessions for the suspicious outgoing VOIP calls while tracing the suspicious outgoing VOIP calls.

2. The method as claimed in claim 1, which further includes directing an unsolicited VoIP call to the VoIP honeypot when the unsolicited VoIP call has been received by a user agent in the enterprise network and a human user of the user agent confirms that the unsolicited VoIP call was unsolicited.

3. The method as claimed in claim 1, which further includes a non-VoIP honeypot in the enterprise network responding to suspicious clients issuing VoIP packets by sending the VoIP packets to the VoIP honeypot.

4. The method as claimed in claim 1, which further includes the VoIP honeypot responding to references to non-VoIP resources via Uniform Resource Locators by sending requests for access to the non-VoIP resources to a non-VoIP honeypot in the enterprise network.

5. The method as claimed in claim 1, which further includes detecting a suspicious instant message (IM), and in response to detecting the suspicious instant message (IM), directing the suspicious instant message (IM) to an instant message honeypot that impersonates a human recipient of the instant message (IM) by composing and returning an instant message (IM) response to the instant message (IM).

6. The method as claimed in claim 1, which further includes detecting that an outgoing VoIP call has been triggered by a user clicking on unsolicited electronic mail, and in response to detecting that the outgoing VoIP call has been triggered by a user clicking on unsolicited electronic mail, redirecting the outgoing VoIP call to the VoIP honeypot.

7. The method as claimed in claim 1, which further includes the VoIP honeypot responding during a connected session of a suspicious VoIP call by composing and returning a voice response that impersonates a human recipient.

8. The method as claimed in claim 1, which includes the VoIP honeypot establishing occupancy schedules for virtual users of respective virtual user agents and directing VoIP calls addressed to the virtual user agents to voice mail boxes when the occupancy schedules indicate that the virtual user of the virtual user agents are absent when the VoIP calls addressed to the virtual user agents are received.

9. The method as claimed in claim 1, which further includes the VoIP honeypot identifying suspicious calls as originating from a common source and compiling statistics of the suspicious calls from the common source to identify suspicious calls from an unknown source that are likely to have originated from the common source.

10. A system for addressing cyber threats enabled by convergence of data and communications services in an enterprise network, the system comprising:

a network computer including a data processor and a non-transitory computer-readable storage medium storing computer instructions that, when executed by the data processor, perform the steps of;

(a) intercepting suspicious incoming VoIP calls from the Internet to the enterprise network, and directing the suspicious incoming VOIP calls to a VoIP honeypot that acts as a network decoy and responds automatically during call sessions for the suspicious incoming VOIP calls while tracing the suspicious incoming VOIP calls; and

(b) intercepting suspicious outgoing VoIP calls from the enterprise network to the Internet, and directing the suspicious outgoing VOIP calls to the VoIP honeypot that acts as a network decoy that responds automatically during call sessions for the suspicious outgoing VOIP calls while tracing the suspicious outgoing VOIP calls.

11. The system as claimed in claim 10, wherein the computer instructions, when executed by the data processor, further direct an unsolicited VoIP call to the VoIP honeypot when the unsolicited VoIP call has been received by a user agent in the enterprise network and a human user of the user agent confirms that the unsolicited VoIP call was unsolicited.

12. The system as claimed in claim 10, which further includes a non-VoIP honeypot in the enterprise network responding to suspicious clients issuing VoIP packets by sending the VoIP packets to the VoIP honeypot.

13. The system as claimed in claim 10 which further includes a non-VOIP honeypot in the enterprise network, the VoIP honeypot responding to references to non-VoIP resources via Uniform Resource Locators by sending requests for access to the non-VoIP resources to the non-VoIP honeypot.

14. The system as claimed in claim 10 wherein the computer instructions, when executed by the data processor, further perform the steps of detecting a suspicious instant message (IM), and in response to detecting the suspicious instant message (IM), directing the suspicious instant message (IM) to an instant message honeypot that impersonates a human recipient of the instant message (IM) by composing and returning an instant message (IM) response to the instant message (IM).

15. The system as claimed in claim 10, wherein the computer instructions, when executed by the data processor, further perform the step of detecting that an outgoing VoIP call has been triggered by a user clicking on unsolicited electronic mail, and in response to detecting that the outgoing VoIP call has been triggered by a user clicking on unsolicited electronic mail, redirecting the outgoing VoIP call to the VoIP honeypot.

16. The system as claimed in claim 10, wherein the VoIP honeypot includes a voice and number response unit for responding during a connected session of a suspicious VoIP call by composing and returning a voice response that impersonates a human recipient.

17. The system as claimed in claim 10, wherein the VoIP honeypot includes occupancy schedules for virtual users of respective virtual user agents and for directing VoIP calls addressed to the virtual user agents to voice mail boxes when the occupancy schedules indicate that the virtual user of the virtual user agents are absent when the VoIP calls addressed to the virtual user agents are received.

18. The system as claimed in claim 10, wherein the VoIP honeypot include an attacker identifier that identifies suspicious calls as originating from a common source and compiles statistics of the suspicious calls from the common source to identify suspicious calls from an unknown source that are likely to have originated from the common source.

19. A non-transitory computer-readable storage medium storing computer instructions that, when executed by a data processor, perform a method of addressing cyber threats enabled by convergence of data and communications services in an enterprise network by the steps of:

(a) intercepting suspicious incoming VoIP calls from the Internet to the enterprise network, and directing the suspicious incoming VOIP calls to a VoIP honeypot that acts as a network decoy and responds automatically during call sessions for the suspicious incoming VOIP calls while tracing the suspicious incoming VOIP calls; and

(b) intercepting suspicious outgoing VoIP calls from the enterprise network to the Internet, and directing the suspicious outgoing VOIP calls to the VoIP honeypot that acts as a network decoy that responds automatically during call sessions for the suspicious outgoing VOIP calls while tracing the suspicious outgoing VOIP calls.

20. The non-transitory computer-readable storage medium as claimed in claim 19, wherein the computer instructions, when executed by the data processor, further perform the step of directing an unsolicited VoIP call to the VoIP honeypot when the unsolicited VoIP call has been received by a user agent in the enterprise network and a human user of the user agent confirms that the unsolicited VoIP call was unsolicited.