Network intrusion counter-intelligence

Patent metadata

Field	Value
Publication number	US-11233821-B2
Application number	US-201815862363-A
Country	US
Kind code	B2
Filing date	Jan 4, 2018
Priority date	Jan 4, 2018
Publication date	Jan 25, 2022
Grant date	Jan 25, 2022

Abstract

Systems, methods, and computer-readable media for gathering network intrusion counter-intelligence. A system can maintain a decoy network environment at one or more machines. The system can identify a malicious user accessing network services through the network environment. Further, the system can receive network service access requests from the user at one or more machines in the network environment and subsequently direct the network service access requests from the malicious user to the decoy network environment based on an identification of the malicious user. The network services access requests can be satisfied with network service access responses generated in the decoy network environment. Subsequently, the system can maintain malicious user analytics based on the network service access requests of the malicious user that are directed to the decoy network environment.

First claim

What is claimed is:

1. A method comprising:
identifying a malicious user accessing network services through a network environment associated with an enterprise based on one or more locations in the network environment targeted by the malicious user and a signature of a previously identified malicious user different from the malicious user, wherein the signature of the previously identified malicious user includes one or more patterns of network service access requests of the previously identified malicious user in attacking either the network environment or a decoy network environment and the signature is refined over time based, at least in part, on specific network service access requests made by the previously identified malicious user to specific network exploits provided to the previously identified malicious user, and wherein the signature of the previously identified malicious user includes one or more patterns of network service responses provided to the previously identified malicious user as part of identifying the previously identified malicious user;
maintaining the decoy network environment at one or more decoy machines, wherein the decoy network environment is self-contained and implemented separate from the enterprise;
receiving network service access requests from the malicious user at one or more machines at one or more receipt locations in the network environment associated with the enterprise;
directing the network service access requests received from the malicious user to one or more locations in the decoy network environment emulating the one or more receipt locations in the network environment associated with the enterprise in response to identifying the malicious user based on the signature of the malicious user; and
maintaining malicious user analytics based on the network service access requests of the malicious user directed to the decoy network environment.

2. The method of claim 1 , wherein the malicious user is identified from network traffic data gathered for nodes in the network environment from sensors implemented at the nodes in the network environment.

3. The method of claim 1 , wherein the malicious user is identified based on the malicious user specifically accessing a closed port in accessing the network services through the network environment.

4. The method of claim 1 , wherein the malicious user is identified based on the malicious user specifically accessing a same port on multiple machines in the network environment.

5. The method of claim 1 , further comprising:
forwarding the network service access requests received at the network environment to the decoy network environment through network tunneling based on identifying the malicious user; and
sending, through tunneling, the network service access responses to satisfy the network service access requests back to the one or machines in the network environment that received the network service access requests in order to satisfy the network service access requests received at the one or machines in the network environment.

6. The method of claim 1 , further comprising:
identifying one or more malicious users based on the malicious user analytics; and
directing additional network service access requests received at the one or more machines in the network environment from the one or malicious uses to the decoy network environment based on identification of the one or more malicious uses through the malicious user analytics.

7. The method of claim 6 , further comprising updating the malicious user analytics based on the additional network service access requests received from the one or more malicious users at the one or more machines in the network environment.

8. The method of claim 1 , further comprising:
identifying the signature of the malicious user as part of maintaining the malicious user analytics; and
controlling access of the malicious user to the network services based on the signature of the malicious user.

9. The method of claim 1 , wherein the signature of the malicious user includes a user identification of the malicious user.

10. The method of claim 1 , further comprising:
maintaining the malicious user analytics based on other network service access requests of other malicious users received in one or more decoy network environments including the decoy network environment;
generating the network service access responses based on the malicious user analytics maintained based on the other network service access requests of the other malicious users; and
providing the network service access responses to the malicious user from the decoy network environment.

11. The method of claim 1 , further comprising:
maintaining the malicious user analytics based on other network service access requests of other malicious users received in one or more decoy network environments including the decoy network environment; and
identifying the malicious user by comparing the network service access requests with the malicious user analytics maintained based on the other network service access requests of the other malicious users.

12. The method of claim 1 , further comprising:
generating the network service access responses in the decoy network environment to emulate exploits of the one or more machines in the network environment at the one or more decoy machines in the decoy network environment; and
providing the network service access responses from the decoy network environment to the malicious user to elicit further network service access responses from the malicious user in response to the network service access requests.

13. The method of claim 1 , further comprising providing an alert to a network administrator of the network environment in response to identifying the malicious user.

14. The method of claim 1 , further comprising quarantining one or more machines in the network environment that the malicious user utilizing in accessing the network services in response to identifying the malicious user.

15. A system comprising:
one or more processors; and
at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying a malicious user accessing network services through a network environment associated with an enterprise using network traffic data gathered for nodes in the network environment from sensors implemented at the nodes in the network environment based on one or more locations in the network environment targeted by the malicious user and a signature of a previously identified malicious user different from the malicious user, wherein the signature of the previously identified malicious user includes one or more patterns of network service access requests of the previously identified malicious user in attacking either the network environment or a decoy network environment and the signature is refined over time based, at least in part, on specific network service access requests made by the previously identified malicious user to specific network exploits provided to the previously identified malicious user, and wherein the signature of the previously identified malicious user includes one or more patterns of network service responses provided to the previously identified malicious user as part of identifying the previously identified malicious user;
maintaining the decoy network environment at one or more decoy machines, wherein the decoy network environment is self-contained and implemented separate from the enterprise;
receiving network service access

Assignees

• Cisco Tech Inc

Inventors

• Yadav Navindra
• Chang Shih-Chun
• Gandham Shashi
• Guo Xiaofei
• Nguyen Hoang Viet
• Liu Xin
• Ngo Thanh Trung
• Tran Duan
• Bui Xuan Loc

Classifications

• H04L63/102

  Entity profiles · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1491 Primary

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title