Integrating a honey network with a target network to counter ip and peer-checking evasion techniques

Patent metadata

Field	Value
Publication number	US-2018332005-A1
Application number	US-201816030637-A
Country	US
Kind code	A1
Filing date	Jul 9, 2018
Priority date	Sep 30, 2014
Publication date	Nov 15, 2018
Grant date	—

Abstract

Techniques for integrating a honey network with a target network environment (e.g., an enterprise network) to counter IP and peer-checking evasion techniques are disclosed. In some embodiments, a system for integrating a honey network with a target network environment includes a device profile data store that includes a plurality of attributes of each of a plurality of devices in the target network environment; a virtual clone manager executed on a processor that instantiates a virtual clone of one or more devices in the target network environment based on one or more attributes for a target device in the device profile data store; and a honey network policy that is configured to route an external network communication from the virtual clone for the target device in the honey network to an external device through the target network environment.

First claim

What is claimed is:

1 . A system, comprising:
a processor coupled to a memory, wherein the processor is configured to:
receive a malware sample at a cloud security service for detonation on a virtual clone for a target device in a honey network, wherein the malware sample is based at least in part on a suspicious network communication destined for the target device in a target network environment that was detected at a firewall device in the target network environment;
detonate the malware sample executed on the virtual clone for the target device in the honey network, wherein the virtual clone is executed in an instrumented virtual machine (VM) environment; and
route an external network communication that was initiated from the malware sample executed on the virtual clone for the target device in the honey network to an external device through the target network environment based on a honey network policy for proxying the external communication through the firewall device in the target network environment to the external device based on a honey network routing table that provides a mapping between a first IP address of the virtual clone and a second IP address of the target device to counter IP and peer-checking evasion techniques, wherein the external device is external to the target network environment and is external to the honey network.

2 . The system recited in claim 1 , wherein the virtual clone is a customized VM image that is executed in the instrumented VM environment.

3 . The system recited in claim 1 , wherein a honey network configuration is synchronized to emulate a plurality of devices in the target network environment.

4 . The system recited in claim 1 , wherein the processor is further configured to:
monitor one or more activities of the virtual clone for the target device in the honey network, wherein the one or more activities are logged in a honey network log.

5 . The system recited in claim 1 , wherein the processor is further configured to:
generate a device profile data store that includes a plurality of attributes of each of a plurality of devices in the target network environment; and instantiate another virtual clone in the honey network of one or more devices in the target network environment based on the honey network policy and based on one or more attributes for another target device in the device profile data store using a virtual clone manager, wherein the honey network is hosted by the cloud security service.

6 . The system recited in claim 1 , wherein the processor is further configured to:
select a VM image from a VM image library using a virtual machine (VM) image selector; and configure a VM image to synchronize attributes of the VM image with attributes of the target device in the target network environment using a virtual machine (VM) image configurer, wherein the VM image is customized based on one or more of a plurality of attributes associated with the target device.

7 . The system recited in claim 1 , wherein the processor is further configured to:
instantiate a customized VM image in an instrumented VM environment using a virtual machine (VM) instance launcher, wherein the instantiated customized VM image corresponds to the virtual clone of the target device in the target network environment.

8 . The system recited in claim 1 , wherein the processor is further configured to:
select a VM image from a virtual machine (VM) image library that includes one or more VM images using a virtual clone manager, wherein the VM image library is customized based on one or more attributes for the target device in a device profile data store, and wherein the customized VM image is executed in the instrumented VM environment.

9 . The system recited in claim 1 , wherein the processor is further configured to:
manage a plurality of virtual clones executed in the instrumented VM environment using a virtual machine (VM) instance manager, wherein the plurality of virtual clones executed in the instrumented VM environment corresponds to the honey network.

10 . The system recited in claim 1 , wherein the honey network routing table is updated if at least one of the virtual clones is removed from the honey network, if a new virtual clone is added in the honey network, and/or to update an availability field value for at least one of the virtual clones.

11 . The system recited in claim 1 , wherein the external communication from the malware sample is routed through the firewall device in the target network environment so that the external communication from the malware sample to the external device is from an external IP address assigned to an Internet-facing interface of the firewall device in the target network environment to appear to the external device to be associated with the target network environment as opposed to another IP address associated with the cloud security service facilitating the honey network, wherein the honey network routing table includes IP-based routing rules for integration of the target network environment with the honey network to indicate whether or not a communication from a compromised device to the target device should be redirected to the virtual clone in the honey network if the virtual clone that was previously instantiated is available.

12 . The system recited in claim 1 , wherein the honey network policy is configured to include a plurality of specified IP addresses and/or specified Classless Inter-Domain Routing (CIDR) ranges for allowed communications from the virtual clone in the honey network to the target device in the target network environment, and wherein if another virtual clone in the honey network does not exist for another target device, then the external communication is routed from the virtual clone in the honey network to the another device in the target network environment such that peer checks by an attacker cannot be used to determine that the malware sample was detonated on the virtual clone in the honey network.

13 . A method, comprising:
receiving a malware sample at a cloud security service for detonation on a virtual clone for a target device in a honey network, wherein the malware sample is based at least in part on a suspicious network communication destined for the target device in a target network environment that was detected at a firewall device in the target network environment; detonating the malware sample executed on the virtual clone for the target device in the honey network, wherein the virtual clone is executed in an instrumented virtual machine (VM) environment; and routing an external network communication that was initiated from the malware sample executed on the virtual clone for the target device in the honey network to an external device through the target network environment based on a honey network policy for proxying the external communication through the firewall device in the target network environment to the external device based on a honey network routing table that provides a mapping between a first IP address of the virtual clone and a second IP address of the target device to counter IP and peer-checking evasion techniques, wherein the external device is external to the target network environment and is external to the honey network.

14 . The method of claim 13 , wherein the virtual clone is a customized VM image that is executed in the instrumented VM environment.

15 . The method of claim 13 , wherein a honey network configuration is synchronized to emulate a plurality of devices in the target network environment.

16 . The method of claim 13 , furth

Assignees

• Palo Alto Networks Inc

Inventors

• Ettema Taylor
• Xie Huagang

Classifications

• G06F8/63

  Image based installation; Cloning; Build to order · CPC title

• G06F8/60

  Software deployment · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title