Method and system for morphing honeypot with computer security incident correlation

• US 7,412,723 B2
• Filed: 12/31/2002
• Issued: 08/12/2008
• Est. Priority Date: 12/31/2002
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Blake, Kenneth W., Converse, Vikki Kim, Edmark, Ronald O'Neal, Garrison, John Michael
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): DOAN, TRANG T
• Application Number:
  US10/334,421
• Publication Number:
  US 20040128543A1
• Time in Patent Office: 2,051 Days
• Field of Search: 726 23- 25, 709/220, 709/224, 709/249
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method, system, apparatus, or computer program product is presented for morphing a honeypot system on a dynamic and configurable basis. The morphing honeypot emulates a variety of services while falsely presenting information about potential vulnerabilities within the system that supports the honeypot. The morphing honeypot has the ability to dynamically change its personality or displayed characteristics using a variety of algorithms and a database of known operating system and service vulnerabilities. The morphing honeypot'"'"'s personality can be changed on a timed or scheduled basis, on the basis of activity that is generated by the presented honeypot personality, or on some other basis. The morphing honeypot can also be integrated with intrusion detection systems and other types of computer security incident recognition systems to correlate its personality with detected nefarious activities.

Claims

1. A method for operating a server, the method comprising:

emulating a service on a server;

in response to receiving a request at the emulated service, sending a response that comprises information indicating a set of vulnerable characteristics at the server;

obtaining, from a source external to the server, an event notification message concerning an event external to the server, wherein the source is one of;

a network intrusion detection system, an operating system-based intrusion detection system, an application-based intrusion detection system, and a risk management system; and

in response to obtaining the event notification message, and as the service is emulated on the server, automatically reconfiguring the set of vulnerable characteristics according to a vulnerability alteration rule when an operational condition associated with the emulated service, as specified in a rule, is detected.

2. The method of claim 1 further comprising:

configuring a database of vulnerable characteristics.

3. The method of claim 2 further comprising:

selecting the set of vulnerable characteristics from the database of vulnerable characteristics in accordance with a type of operating system, a type of emulatable service, or a type of vulnerable characteristic.

4. The method of claim 3 further comprising:

extracting one or more notification values from the event notification message, each notification value indicating an operating system associated with the event, a type of service associated with the event, a type of vulnerable characteristic associated with the event, or some other characteristic associated with the event; and

deriving the set of vulnerable characteristics from the database of vulnerable characteristics in accordance the one or more extracted values.

5. The method of claim 1 further comprising:

configuring a database of filtering rules;

retrieving a filtering rule from the database of filtering rules;

examining the event notification message in accordance with the filtering rule; and

triggering the automatic reconfiguration of the set of vulnerable characteristics in response to a determination that the event notification message passes the filtering rule.

6. The method of claim 5 further comprising:

retrieving the vulnerability alteration rule that is associated with the filtering rule; and

deriving the reconfigured set of vulnerable characteristics from a database of vulnerable characteristics in accordance with the vulnerability alteration rule.

7. The method of claim 6 further comprising:

specifying a parameter for a type of operating system in the vulnerability alteration rule to be used in deriving the reconfigured set of vulnerable characteristics.

8. The method of claim 6 further comprising:

specifying a parameter for a type of service in the vulnerability alteration rule to be used in deriving the reconfigured set of vulnerable characteristics.

9. The method of claim 1 further comprising:

logging the event notification message; and

temporally varying the set of vulnerable characteristics based on information in multiple logged event notification messages over a configurable period of time.

10. The method of claim 1 further comprising:

subscribing to receive event notification messages with an event sensor external to the server.

11. The method of claim 1 further comprising:

retrieving an event notification message from a computer security incident information center.