Countering service enumeration through optimistic response

Patent metadata

Field	Value
Publication number	US-9350748-B1
Application number	US-201314108222-A
Country	US
Kind code	B1
Filing date	Dec 16, 2013
Priority date	Dec 16, 2013
Publication date	May 24, 2016
Grant date	May 24, 2016

Abstract

Techniques for improving computer system security by detecting and responding to attacks on computer systems are described herein. A computer system monitors communications requests from external systems and, as a result of detecting one or more attacks on the computer system, the computer system responds to the attacks by modifying the behavior of the computer system. The behavior of the computer system is modified so that responses to communications requests to ports on the computer system are altered, presenting the attacker with an altered representation of the computer system and thereby delaying or frustrating the attack and the attacker.

First claim

What is claimed is:

1. A computer-implemented method for enhancing security, comprising:
under the control of one or more computer systems configured with executable instructions,
monitoring connection attempts to a server computer system;
detecting, as part of said monitoring, an in-progress port scan of the server computer system by an attacker computer system; and
as a result of detecting the in-progress port scan, modifying the server computer system to:
accept connection attempts at least from the attacker computer system on both a first set of ports open until detecting the in-progress port scan and a second set of ports closed for an amount of time until detecting the in-progress port scan;
provide attack responses to the attacker computer system from at least a first subset of the first set of ports and at least a second subset of the second set of ports, the attack responses from the first subset of the first set of ports configured to be different than responses that would have been provided to the attacker computer system had the in-progress port scan been undetected, the attack responses including at least one response misidentifying a service behind a particular in-use port of the first set of ports and falsely indicating existence of a particular service behind a particular port of the second set of ports; and
wherein misidentifying the service is accomplished by providing, to an attacker, a service response on the particular in-use port, the service response corresponds to a different known service than the service on the particular in-use port.

2. The computer-implemented method of claim 1 , wherein detecting the in-progress port scan is accomplished by in part determining that the attacker computer system has exceeded a threshold number of connection attempts to ports that are not in-use.

3. The computer-implemented method of claim 1 , wherein the attack responses comprise at least one response delayed to the attacker computer system as a result of the in-progress port scan being detected.

4. The computer-implemented method of claim 1 , wherein the attack responses comprise at least one response configured to cause the attacker computer system to expend computing resources to process the response.

5. The computer-implemented method of claim 1 , wherein the attack responses comprise at least one false credential that allows access to a restricted account on the server computer system.

6. The computer-implemented method of claim 1 , further comprising maintaining a table that is shared between a plurality of host computer systems and that includes one or more identifying characteristics of the attacker computer system.

7. A system, comprising one or more processors and memory storing instructions that, when executed by the one or more processors cause the system to implement one or more services and, as part of implementing the one or more services:
monitoring connection attempts to a server computer system;
detect an in-progress port scan over a set of communication channels of the system by an attacker computer system;
as a result of detecting the in-progress port scan, modify the system to accept connection attempts at least from at least the attacker computer system; on both a first set of ports open until detecting the in-progress port scan and a second set of ports closed for an amount of time until detecting the in-progress port scan;
provide attack responses to the attacker computer system from at least a first subset of the first set of ports and at least a second subset of the second set of ports, the attack responses from the first subset of the first set of ports configured to be different than responses that would have been provided to the attacker computer system had the in-progress port scan been undetected, the attack responses including at least one response misidentifying a service behind a particular in-use port of the first set of ports and falsely indicating existence of a particular service behind a particular port of the second set of ports; and
wherein misidentifying the service is accomplished by providing, to an attacker, a service response on the particular in-use port, the service response corresponds to a different known service than the service on the particular in-use port.

8. The system of claim 7 , wherein the set of communication channels comprise ports associated with a same Internet protocol address of the system.

9. The system of claim 7 , wherein the communications configured for use during the attack on the system include at least some communications configured to delay detection, by the attacker computer system, of a service accessible via a communication channel that is one of a subset of communications channels that were open before detecting the in-progress port scan of the set of communications channels.

10. The system of claim 7 , wherein the system is further configured to, after detection of the in-progress port scan, dynamically generate at least some of the communications based at least in part on one or more observed behaviors of the attacker.

11. The system of claim 7 , wherein at least one of the communications falsely indicates existence of a service accessible via a communication channel that is one of a subset of communications channels that were closed before detecting the in-progress port scan of the set of communications channels.

12. The system of claim 7 , wherein the one or more services configured to modify the system to alter a set of communication channels for at least the attacker computer system are further configured to:
open, for at least the attacker computer system, a subset of a subset of communications channels that were closed before detecting the in-progress port scan of the set of communications channels; and
close, for at least the attacker computer system, a subset of a subset of communications channels that were open before detecting the in-progress port scan of the set of communications channels.

13. A non-transitory computer-readable storage medium having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
monitor connection attempts to a server computer system;
detect, as part of monitoring the connection attempts, an in-progress port scan of the server computer system by an attacker computer system;
inhibit an attacker computer system that is able to communicate with the computer system using a set of open communication channels by causing the computer system to at least:
alter the set of open communication channels that the attacker computer system is able to accept connection attempts at least from the attacker computer system on both a first set of ports open until detecting the in-progress port scan and a second set of ports closed for an amount of time until detecting the in-progress port scan;
communicate, over at least a subset of the altered set of communication channels, with the attacker computer to provide attack responses to the attacker computer system from at least a first subset of the first set of ports and at least a second subset of the second set of ports, the attack responses from the first subset of the first set of ports configured to be different than responses that would have been provided to the attacker computer system had the in-progress port scan been undetected,
misidentify, within the attack responses, a service behind a particular in-use port of the first set of ports and falsely indicating existence of a particular service behind a particular port of the second set of ports; and
wherein misidentifying the service

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Stathakopoulos George Nikolaos

Classifications

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title