Method and system for morphing honeypot
View Patent ↗A method, system, apparatus, or computer program product is presented for morphing a honeypot system on a dynamic and configurable basis. The morphing honeypot emulates a variety of services while falsely presenting information about potential vulnerabilities within the system that supports the honeypot. The morphing honeypot has the ability to dynamically change its personality or displayed characteristics using a variety of algorithms and a database of known operating system and service vulnerabilities. The morphing honeypot's personality can be changed on a timed or scheduled basis, on the basis of activity that is generated by the presented honeypot personality, or on some other basis.
1. A method for operating a server, the method comprising:
emulating a service on a server;
in response to receiving a request at the emulated service, sending a response that comprises information indicating a set of vulnerable characteristics at the server; and
as the service is emulated on the server, automatically reconfiguring the set of vulnerable characteristics according to a vulnerability alteration rule when an operational condition of the emulated service, as specified in a monitoring rule, is detected.
2. The method of claim 1 further comprising:
temporally varying the set of vulnerable characteristics.
3. The method of claim 1 further comprising:
configuring a database of vulnerable characteristics.
4. The method of claim 3 further comprising:
selecting the set of vulnerable characteristics from the database of vulnerable characteristics in accordance with a type of operating system, a type of emulatable service, or a type of vulnerable characteristic.
5. The method of claim 3 further comprising:
allowing a user to specify parameter values; and
deriving the set of vulnerable characteristics from the database of vulnerable characteristics in accordance with user-specified parameters.
6. The method of claim 5 further comprising:
specifying a time-related parameter for varying the set of vulnerable characteristics.
7. The method of claim 3 further comprising:
logging activity by the emulated service; and
deriving the set of vulnerable characteristics from the database of vulnerable characteristics in accordance with logged activity by the emulated service.
8. The method of claim 7 further comprising:
triggering an automatic alteration of the set of vulnerable characteristics in response to logged activity by the emulated service being below a configurable threshold value.
9. The method of claim 1 further comprising:
configuring a database of monitoring rules; and
retrieving the monitoring rule from the database of monitoring rules.
10. The method of claim 9 further comprising:
retrieving the vulnerability alteration rule that is associated with the monitoring rule; and
deriving the reconfigured set of vulnerable characteristics from a database of vulnerable characteristics in accordance with the vulnerability alteration rule.
11. The method of claim 10 further comprising:
specifying a parameter for a type of operating system in the vulnerability alteration rule to be used in deriving the reconfigured set of vulnerable characteristics.
12. The method of claim 10 further comprising:
specifying a parameter for a type of service in the vulnerability alteration rule to be used in deriving the reconfigured set of vulnerable characteristics.