DYNAMIC SERVICE HANDLING USING A HONEYPOT

• US 20170048274A1
• Filed: 10/28/2016
• Published: 02/16/2017
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Quinlan, Daniel J., Ibatullin, Oskar, Burns, Bryan, Tavakoli, Oliver, Cameron, Robert W.
• Granted Patent: US 9,838,427 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A network device comprises one or more processors coupled to a memory, and a dynamic services module configured for execution by the one or more processors to receive, from a client device, a service request specifying a service. The dynamic service module is further configured for execution by the one or more processors to, in response to obtaining a negative indication for the service, send a representation of the service request to a honeypot to cause the honeypot to offer the service to the client device.

Claims

1. A system comprising:

a computing device configured to execute a honeypot; and

a network device configured to;

receive, from a client device, a service request to receive a service indicated in the service request from a server associated with an address indicated in the service request;

in response to obtaining a negative indication for the service that indicates the server does not offer the service, send a representation of the service request to the computing device, wherein the negative indication for the service comprises an expiry of a timer for the service response without the network device having received a positive indication for the service from the server,

wherein the computing device is further configured to, in response to receiving the service request, execute the honeypot to provide the service to the client device.

2. The system of claim 1,

wherein the address indicated in the service request comprises a layer 3 destination address, and

wherein no server of a network that includes the network device is associated with a layer 3 address that is the layer 3 destination address.

3. The system of claim 1, wherein the network device is further configured to:

generate, in response to obtaining a negative indication for the service that indicates the server does not offer the service, a positive indication for the service; and

send, to the client device, the positive indication for the service.

4. The system of claim 1, wherein the network device is further configured to proxy a service session for the service between the computing device and the client device to offer the service to the client device.

5. The system of claim 1,

wherein the service request comprises a first service request, and

wherein the negative indication for the service comprises a negative indication for the first service request, wherein the network device is further configured to:

receive a second service request specifying the service; and

send, in response to obtaining the negative indication for the first service request and without obtaining a negative indication for the second service request, a representation of the second service request to the computing device,

wherein the computing device is further configured to, in response to receiving the second service request, execute the honeypot to provide the second service to the client device.

6. The system of claim 1,

wherein the network device comprises a security appliance, and

wherein the address comprises a layer 3 destination address for the server associated with the address, wherein the server is located within a network protected by the security appliance.

7. The system of claim 1,

wherein the network device comprises a security appliance, and

wherein the client device is located within a network protected by the security appliance.

8. The system of claim 1,

wherein the network device comprises a security appliance, and

security appliance configured to protect a network, and

wherein the computing device comprises a remote honeypot server that is not logically located within the network protected by the security appliance.

9. The system of claim 1, wherein the representation of the service request causes the honeypot to dynamically offer the service to imitate the service to the client device as if the service were provided by the server associated with the address indicated in the service request.

10. A method comprising:

receiving, by a network device from a client device, a service request to receive a service indicated in the service request from a server associated with an address indicated in the service request;

by the network device and in response to receiving a negative service response for the service from the server associated with the address indicated in the service request, sending a representation of the service request to a computing device, wherein the negative indication for the service comprises an expiry of a timer for the service response without the network device having received a positive indication for the service from the server; and

providing, by a honeypot executed by the computing device and in response to receiving the representation of the service request, the service to the client device.

11. The method of claim 10,

wherein the service request comprises a Transmission Control Protocol SYN packet, and

wherein the negative service response comprises a Transmission Control Protocol SYN RST packet.

12. The method of claim 10,

wherein the address comprises a layer 3 destination address,

wherein no server of a network that includes the network device is associated with a layer 3 address that is the layer 3 destination address.

13. The method of claim 10, further comprising:

generating, by the network device in response to receiving the negative service response, a positive indication for the service; and

sending, by the network device to the client device, the positive indication for the service.

14. The method of claim 10, further comprising:

proxying, by the network device, a service session for the service between the honeypot and the client device to offer the service to the client device.

15. The method of claim 10,

wherein the service request comprises a first service request, and

wherein the negative service response for the service comprises a negative service response for the first service request, the method further comprising:

receiving, by the network device, a second service request specifying the service; and

send, in response to obtaining the negative indication for the first service request and without obtaining a negative indication for the second service request, a representation of the second service request to the computing device,

wherein the computing device is further configured to, in response to receiving the second service request, execute the honeypot to provide the second service to the client device.

16. The method of claim 10,

wherein the network device comprises a security appliance, and

wherein the address comprises a layer 3 destination address for the server associated with the address, wherein the server is located within a network protected by the security appliance.

17. A system comprising:

a computing device configured to execute a honeypot;

a network device configured to;

receive a probe from a client device;

receive, from the client device and after receiving the probe, a service request to receive a service indicated in the service request from a server associated with an address indicated in the service request

send, in response to obtaining a negative indication for the service that indicates the server does not offer the service and determining the network device previously received the probe from the client device, a representation of the service request to the computing device,

wherein the computing device is further configured to, in response to receiving the service request, execute the honeypot to provide the service to the client device.

18. The system of claim 17, wherein the probe specifies a destination address that is not associated with the network device, and wherein the network device is further configured to:

generate, in response to receiving the probe from the client device, a probe response indicating that the destination address is associated with the server; and

send the probe response to the client device.

19. The system of claim 17,

wherein the probe comprises an Internet Control Message Protocol echo request, and

wherein the probe response comprises an Internet Control Message Protocol echo response.

20. The system of claim 17,

wherein the probe specifies a destination address that is not associated with the network device, and

wherein the destination address is not associated with any server of a network that includes the network device.