Synchronizing a honey network configuration to reflect a target network environment

• US 9,495,188 B1
• Filed: 09/30/2014
• Issued: 11/15/2016
• Est. Priority Date: 09/30/2014
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Ettema, Taylor, Xie, Huagang
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): Wang, Ben C
• Application Number:
  US14/503,125
• Time in Patent Office: 777 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 8/20 Software design
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

Techniques for synchronizing a honey network configuration to reflect a target network environment are disclosed. In some embodiments, a system for synchronizing a honey network configuration to reflect a target network environment includes a device profile data store that includes a plurality of attributes of each of a plurality of devices in the target network environment; a virtual machine (VM) image library that includes one or more VM images; and a virtual clone manager executed on a processor that instantiates a virtual clone of one or more devices in the target enterprise network using a VM image selected from the VM image library that is customized based on one or more attributes for a target device in the device profile data store.

Claims

1. A method of synchronizing a honey network configuration to reflect a target network environment, comprising:

storing a plurality of attributes of each of a plurality of devices in the target network environment in a device profile data store; and

instantiating a virtual clone of one or more of the plurality of devices in the target network environment using a virtual machine (VM) image selected from a VM image library that is customized based on one or more attributes for a target device in the device profile data store, wherein the VM image that is selected from the VM image library is customized by loading and booting a base image of an instance of the VM image and then dynamically patching the base image of the instance of the VM image selected from the VM image library based one or more attributes for the target device in the device profile store including a last reboot time for the target device,

wherein the VM image library stores one or more VM images, and

wherein the virtual clone is executed on a VM server.

2. The method of claim 1, wherein the virtual clone is executed in an instrumented VM environment on the VM server.

3. The method of claim 1, wherein the virtual clone is a customized VM image that is executed in an instrumented VM environment.

4. The method of claim 1, wherein the honey network configuration is synchronized to emulate the plurality of devices in the target network environment.

5. The method of claim 1, wherein the virtual clone is a customized VM image, further comprising:

detonating a malware sample in the virtual clone, wherein the customized VM image is executed in an instrumented VM environment.

6. The method of claim 1, further comprising:

extracting a plurality of attributes associated with the target device from the device profile data store.

7. The method of claim 1, further comprising:

selecting the VM image from the VM image library.

8. The method of claim 1, wherein the virtual clone is a customized VM image, further comprising:

instantiating the customized VM image in an instrumented VM environment, wherein the instantiated customized VM images corresponds to the virtual clone of the target device in the target network environment.

9. The method of claim 1, further comprising:

managing a plurality of virtual clones executed in an instrumented VM environment, wherein the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network configuration.

10. The method of claim 1, wherein the virtual clone is a customized VM image, further comprising:

detonating a malware sample in the virtual clone, wherein the customized VM image is executed in an instrumented VM environment, and wherein the malware sample was destined to be sent to the target device.

11. The method of claim 1, wherein the VM image that is selected from the VM image library is customized by loading and booting the base image of the instance of the VM image and then dynamically patching the base image of the instance of the VM image selected from the VM image library based on one or more of the following attributes for the target device in the device profile store:

a logged in user name for the target device, a configured domain controller for the target device, a DNS for the target device, an IP address for the target device, a browser proxy setting for the target device, a local time zone for the target device, an installed OS/application language pack for the target device, and/or a network session log for the target device.

12. A system for synchronizing a honey network configuration to reflect a target network environment, comprising:

a device profile data store in a memory that includes a plurality of attributes of each of a plurality of devices in the target network environment;

a virtual machine (VM) image library that includes one or more VM images; and

a virtual clone manager executed on a hardware processor of the system that instantiates a virtual clone of one or more of the plurality of devices in the target network environment using a VM image selected from the VM image library that is customized based on one or more attributes for a target device in the device profile data store, wherein the VM image that is selected from the VM image library is customized by loading and booting a base image of an instance of the VM image and then dynamically patching the base image of the instance of the VM image selected from the VM image library based on one or more attributes for the target device in the device profile store including a last reboot time for the target device.

13. The system recited in claim 12, wherein the virtual clone is executed in an instrumented VM environment on a VM server.

14. The system recited in claim 12, wherein the virtual clone is a customized VM image that is executed in an instrumented VM environment.

15. The system recited in claim 12, wherein the honey network configuration is synchronized to emulate the plurality of devices in the target network environment.

16. The system recited in claim 12, further comprising:

a device profile data analyzer that extracts a plurality of attributes associated with the target device from the device profile data store.

17. The system recited in claim 12, further comprising:

a VM image selector that selects the VM image from the VM image library.

18. The system recited in claim 12, wherein the virtual clone is a customized VM image, further comprising:

a VM instance launcher that instantiates the customized VM image in an instrumented VM environment, wherein the instantiated customized VM images corresponds to the virtual clone of the target device in the target network environment.

19. The system recited in claim 12, wherein the virtual clone is a customized VM image, further comprising:

an intelligent malware detonator that detonates a malware sample in the virtual clone, wherein the customized VM image is executed in an instrumented VM environment.

20. The system recited in claim 12, further comprising:

a VM instance manager that manages a plurality of virtual clones executed in an instrumented VM environment, wherein the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network configuration.

21. The system recited in claim 12, wherein the virtual clone is a customized VM image, further comprising:

an intelligent malware detonator that detonates a malware sample in the virtual clone, wherein the customized VM image is executed in an instrumented VM environment, and wherein the malware sample was destined to be sent to the target device.

22. The system recited in claim 12, wherein the VM image that is selected from the VM image library is customized by loading and booting the base image of the instance of the VM image and then dynamically patching the base image of the instance of the VM image selected from the VM image library based on one or more of the following attributes for the target device in the device profile store:

a logged in user name for the target device, a configured domain controller for the target device, a DNS for the target device, an IP address for the target device, a browser proxy setting for the target device, a local time zone for the target device, an installed OS/application language pack for the target device, and/or a network session log for the target device.

23. A computer program product for synchronizing a honey network configuration to reflect a target network environment, the computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for:

storing a plurality of attributes of each of a plurality of devices in the target network environment in a device profile data store; and

instantiating a virtual clone of one or more of the plurality of devices in the target network environment using a virtual machine (VM) image selected from a VM image library that is customized based on one or more attributes for a target device in the device profile data store, wherein the VM image that is selected from the VM image library is customized by loading and booting a base image of an instance of the VM image and then dynamically patching the base image of the instance of the VM image selected from the VM image library based on one or more attributes for the target device in the device profile store including a last reboot time for the target device,

wherein the VM image library stores one or more VM images, and

wherein the virtual clone is executed on a VM server.

24. The computer program product recited in claim 23, wherein the virtual clone is executed in an instrumented VM environment on the VM server.

25. The computer program product recited in claim 23, wherein the virtual clone is a customized VM image that is executed in an instrumented VM environment.

26. The computer program product recited in claim 23, wherein the honey network configuration is synchronized to emulate the plurality of devices in the target network environment.

27. The computer program product recited in claim 23, wherein the virtual clone is a customized VM image, further comprising computer instructions for:

detonating a malware sample in the virtual clone, wherein the customized VM image is executed in an instrumented VM environment.