Method and apparatus for providing mobile honeypots

• US 8,156,556 B2
• Filed: 03/15/2005
• Issued: 04/10/2012
• Est. Priority Date: 03/16/2004
• Status: Active Grant

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property II LP (AT&T, Inc.)
• Inventors: Krishnamurthy, Balachander
• Primary Examiner(s): Moorthy, Aravind
• Assistant Examiner(s): PAN, JOSEPH T
• Application Number:
  US11/081,261
• Publication Number:
  US 20050210534A1
• Time in Patent Office: 2,583 Days
• Field of Search: 713/1, 713/2, 713/188, 713/194, 380/200, 380/201, 380/255, 380/277, 726/2, 726/23, 726/25, 726/11, 726/22, 709223-225
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method and apparatus for detecting an originator of traffic of interest is provided. One or more honeypots are established. Mobility is then provided to the one or more honeypots. In one embodiment, mobility is provided by communicating information associated with one or more dark prefixes. In another embodiment, mobility is provided by varying information related to the one or more dark prefixes.

Claims

1. A method of detecting an originator of traffic of interest, comprising:

establishing a honeypot in a first autonomous system controlled by a first network administrator, wherein the establishing the honeypot comprises;

establishing in the first autonomous system a dark prefix associated with a destination;

advertising the dark prefix; and

collecting data associated with the traffic of interest received by the destination; and

communicating to a network of friendly autonomous systems information that the dark prefix is associated with the honeypot, wherein the information is dynamically shared with the network of friendly autonomous systems, wherein the network of friendly autonomous systems comprises a second autonomous system that is controlled by a second network administrator that is different from the first network administrator.

2. The method of claim 1, wherein the destination sends default replies to an originator of the traffic of interest.

3. The method of claim 1, wherein the friendly autonomous systems take remedial action based on the information.

4. The method of claim 1, wherein a classification of the originator of the traffic of interest is determined in accordance with a threshold for the traffic of interest.

5. The method of claim 1, wherein the data associated with the traffic of interest is shared subsequently with other autonomous systems.

6. The method of claim 1, wherein an optional field is used along with the advertising the dark prefix, so that the network of friendly autonomous systems is aware that the dark prefix is associated with the honeypot.

7. The method of claim 6, wherein, in response to the optional field, the network of friendly autonomous systems drops the traffic of interest but communicates information about an originator of the traffic of interest.

8. The method of claim 6, wherein, in response to the optional field, the network of friendly autonomous systems identifies the traffic of interest, records information about an originator of the traffic of interest, and allows the traffic of interest to pass.

9. The method of claim 1, wherein the network of friendly autonomous systems maintains additional checks for traffic exceeding a threshold.

12. The method of claim 1, wherein the information further comprises a change in the dark prefix.

13. The method of claim 12, wherein the change in the dark prefix comprises a length of the dark prefix being varied.

14. The method of claim 12, wherein the change in the dark prefix comprises a duration of the dark prefix being varied.

15. The method of claim 12, wherein the change in the dark prefix comprises a threshold for the traffic of interest received by the destination being varied.

10. A non-transitory computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform a method of detecting an originator of traffic of interest, comprising:

establishing a honeypot in a first autonomous system controlled by a first network administrator, wherein the establishing the honeypot comprises;

establishing in the first autonomous system a dark prefix associated with a destination;

advertising the dark prefix; and

collecting data associated with the traffic of interest received by the destination; and

communicate to a network of friendly autonomous systems information that the dark prefix is associated with the honeypot, wherein the information is dynamically shared with the network of friendly autonomous systems, wherein the network of friendly autonomous systems comprises a second autonomous system that is controlled by a second network administrator that is different from the first network administrator.

11. An apparatus for detecting an originator of traffic of interest, comprising:

a processor configured to;

establish a honeypot in a first autonomous system controlled by a first network administrator by;

establishing in the first autonomous system a dark prefix associated with a destination;

advertising the dark prefix; and

collecting data associated with the traffic of interest received by the destination; and

communicating to a network of friendly autonomous systems that the dark prefix is associated with the honeypot, wherein the information is dynamically shared with the network of friendly autonomous systems, wherein the network of friendly autonomous systems comprises a second autonomous system that is controlled by a second network administrator that is different from the first network administrator.