DYNAMIC SERVICE HANDLING USING A HONEYPOT

• US 20150121529A1
• Filed: 12/30/2014
• Published: 04/30/2015
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Quinlan, Daniel J., Ibatullin, Oskar, Burns, Bryan, Tavakoli, Oliver, Cameron, Robert W.
• Granted Patent: US 9,485,276 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A network device comprises one or more processors coupled to a memory, and a dynamic services module configured for execution by the one or more processors to receive, from a client device, a service request specifying a service. The dynamic service module is further configured for execution by the one or more processors to, in response to obtaining a negative indication for the service, send a representation of the service request to a honeypot to cause the honeypot to offer the service to the client device.

Claims

1. A method comprising:

receiving, by a network device from a client device, a service request specifying a service; and

by the network device and in response to obtaining a negative indication for the service, sending a representation of the service request to a honeypot to cause the honeypot to offer the service to the client device.

2. The method of claim 1,

wherein the service request specifies an address that is not associated with the network device, and

wherein obtaining a negative indication for the service comprises receiving, by the network device, a negative service response for the service from a server associated with the address.

3. The method of claim 2,

wherein the service request comprises a Transmission Control Protocol SYN RST packet, and

wherein the negative service response comprises a Transmission Control Protocol SYN RST packet.

4. The method of claim 1,

wherein the service request specifies an address that is not associated with the network device, and

wherein the negative indication for the service comprises an expiry of a timer for the service response without the network device having received a positive indication for the service from a server associated with the address.

5. The method of claim 1, further comprising:

receiving, by the network device prior to the receiving the service request, a probe from the client device,

wherein sending a representation of the service request to a honeypot to dynamically offer the service to the client device further comprises sending, by the network device and in response to determining the network device previously received the probe from the client device, the representation of the service request to the honeypot to dynamically offer the service to the client device.

6. The method of claim 5, wherein the probe specifies a destination address that is not associated with the network device, the method further comprising:

by the network device and in response to receiving the probe from the client device, generating a probe response indicating that the destination address is associated with a server; and

sending, by the network device, the probe response to the client device.

7. The method of claim 5,

wherein the probe comprises an Internet Control Message Protocol echo request, and

wherein the probe response comprises an Internet Control Message Protocol echo response.

8. The method of claim 5,

wherein the probe specifies a destination address that is not associated with the network device, and

wherein the destination address is not associated with a server of a network that includes the network device.

9. The method of claim 1,

wherein the service request includes a layer 3 destination address, and

wherein the layer 3 destination address is not associated with a server of a network that includes the network device.

10. The method of claim 1, further comprising:

generating, by the network device in response to obtaining a negative indication for the service, a positive indication for the service; and

sending, by the network device to the client device, the positive indication for the service.

11. The method of claim 1, further comprising:

proxying, by the network device, a service session for the service between the honeypot and the client device to offer the service to the client device.

12. The method of claim 1,

wherein the service request comprises a first service request, and

wherein the negative indication for the service comprises a negative indication for the first service request, the method further comprising:

receiving, by the network device, a second service request specifying the service; and

by the network device and in response to obtaining the negative indication for the first service request, sending a representation of the second service request to the honeypot to cause the honeypot to offer the service to the client device without obtaining a negative indication for the second service request.

13. The method of claim 1,

wherein the network device comprises a security appliance, and

wherein the service request includes a destination address for a server located within a network protected by the security appliance.

14. The method of claim 1,

wherein the network device comprises a security appliance, and

wherein the client device is located within a network protected by the security appliance.

15. The method of claim 1, wherein the negative indication for the service comprises an indication the client device is a known attacker.

16. A non-transitory computer-readable storage medium comprising instructions stored thereon that, when executed, configure one or more processors to:

receive, by a network device from a client device, a service request specifying a service; and

by the network device and in response to obtaining a negative indication for the service, send a representation of the service request to a honeypot to cause the honeypot to offer the service to the client device.

17. A network device comprising:

one or more processors coupled to a memory;

a dynamic services module configured for execution by the one or more processors to;

receive, from a client device, a service request specifying a service; and

in response to obtaining a negative indication for the service, send a representation of the service request to a honeypot to cause the honeypot to offer the service to the client device.

18. The network device of claim 17,

wherein the service request includes a layer 3 address, and

wherein to obtain a negative indication for the service the dynamic service module is further configured for execution by the one or more processors to receive a negative service response for the service from a server associated with the layer 3 address.

19. The network device of claim 18,

wherein the service request comprises a Transmission Control Protocol SYN RST packet, and

wherein the negative service response comprises a Transmission Control Protocol SYN RST packet.

20. The network device of claim 17,

wherein the service request includes a layer 3 address, and

wherein the negative indication for the service comprises an expiry of a timer for the service response without the network device having received a positive indication for the service from a server associated with the layer 3 address.

21. The network device of claim 17,

wherein the dynamic services module is further configured for execution by the one or more processors to receive, prior to the receiving the service request, a probe from the client device, and

wherein to send a representation of the service request to a honeypot to dynamically offer the service to the client device, the dynamic services module is further configured for execution by the one or more processors to send, in response to determining the dynamic services module previously received the probe from the client device, the representation of the to the honeypot to dynamically offer the service to the client device.

22. The network device of claim 21,

wherein the probe includes a layer 3 destination address that is not associated with the network device,

wherein the dynamic services module is further configured for execution by the one or more processors to, in response to receiving the probe from the client device, generate a probe response indicating that the layer 3 destination address is associated with a server, and

wherein the dynamic services module is further configured for execution by the one or more processors to send the probe response to the client device.

23. The network device of claim 21,

wherein the probe comprises an Internet Control Message Protocol echo request, and

wherein the probe response comprises an Internet Control Message Protocol echo response.

24. The network device of claim 21,

wherein the probe includes a layer 3 destination address that is not associated with the network device, and

wherein the layer 3 destination address is not associated with a server of a network that includes the network device.

25. The network device of claim 17,

wherein the service request includes a layer 3 destination address, and

wherein the layer 3 destination address is not associated with a server of a network that includes the network device.

26. The network device of claim 17,

wherein the dynamic services module is further configured for execution by the one or more processors to generate, in response to obtaining a negative indication for the service, a positive indication for the service, and

wherein the dynamic services module is further configured for execution by the one or more processors to send, to the client device, the positive indication for the service.

27. The network device of claim 17, wherein the dynamic services module is further configured for execution by the one or more processors to proxy a service session for the service between the honeypot and the client device to offer the service to the client device.

28. The network device of claim 17,

wherein the service request comprises a first service request, and

wherein the negative indication for the service comprises a negative indication for the first service request,

wherein the dynamic services module is further configured for execution by the one or more processors to receive a second service request specifying the service, and

wherein the dynamic services module is further configured for execution by the one or more processors to, in response to obtaining the negative indication for the first service request, send a representation of the second service request to the honeypot to cause the honeypot to offer the service to the client device without obtaining a negative indication for the second service request.

29. The network device of claim 17,

wherein the network device comprises a security appliance, and

wherein the service request includes a layer 3 destination address for a server located within a network protected by the security appliance.

30. The network device of claim 17,

wherein the network device comprises a security appliance, and

wherein the client device is located within a network protected by the security appliance.

31. The network device of claim 17, wherein the negative indication for the service comprises an indication the client device is a known attacker.