System, method, and computer program product for identifying unwanted activity utilizing a honeypot device accessible via VLAN trunking
View Patent ↗A system, method, and computer program product are provided for identifying unwanted activity utilizing a honeypot accessible via virtual local area network (VLAN) trunking. In use, a honeypot device is allowed to be accessed via VLAN trunking. Furthermore, unwanted data is identified, utilizing the honeypot device.
1. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:
identifying, by a network device, unwanted activity associated with an access request from a source device, the network device in communication with the source device via a virtual local area network (VLAN) of a local area network (LAN), wherein the unwanted activity is associated with one or more packets from the source device including a time to live (TTL) value indicating that the unwanted activity is only capable of being directly communicated from the source device to a single destination device within the LAN;
identifying the source device associated with the unwanted activity; and
isolating the source device from the LAN in response to the source device being associated with the unwanted activity.
2. The computer program product of claim 1 , wherein the one or more packets include a time to live (TTL) value of one.
3. The computer program product of claim 1 , wherein isolating the source from the LAN includes preventing communication with the source device via the LAN.
4. The computer program product of claim 3 , wherein preventing communication with the source device via the LAN includes dropping frames communicated to or from the source device.
5. The computer program product of claim 1 , wherein the network device is configured to emulate a network entity vulnerable to the unwanted activity.
6. The computer program product of claim 5 , wherein the network entity includes at least one of a resource, a service, a system, and a database.
7. The computer program product of claim 1 , further comprising:
applying a tag to one or more frames communicated from the source device over the VLAN.
8. The computer program product of claim 7 , wherein the tag identifies the source device.
9. The computer program product of claim 1 , wherein the network device comprises a honeypot device.
10. The computer program product of claim 1 , wherein the network device is a server.
11. The computer program product of claim 1 , wherein the network device is unprotected by a security system with respect to activity within the local area network.
12. The computer program product of claim 1 , wherein the network device is configured via virtual local area network trunking to be accessible by a plurality of other devices located across multiple virtual local area networks.
13. The computer program product of claim 12 , wherein the multiple virtual local area networks are included in the local area network on which the network device is located.
14. The computer program product of claim 12 , wherein the virtual local area network trunking is facilitated utilizing at least one virtual local area network capable switch.
15. The computer program product of claim 1 , wherein the unwanted activity includes at least one of malware, a virus, a worm, spam, or spyware.
16. The computer program product of claim 1 , wherein identifying the unwanted activity by the network device includes identifying a type of access associated by the network device as unwanted activity.
17. The computer program product of claim 1 , wherein identifying the unwanted activity by the network device includes comparing activity associated with the network device with known unwanted activity.
18. The computer program product of claim 1 , further comprising:
removing the source device from isolation from the LAN in response to a determination that a component of the source device responsible for the unwanted activity has been removed.
19. A method comprising:
identifying, by a network device, unwanted activity associated with an access request from a source device, the network device in communication with the source device via a virtual local area network (VLAN) of a local area network (LAN), wherein the unwanted activity is associated with one or more packets from the source device including a time to live (TTL) value indicating that the unwanted activity is only capable of being directly communicated from the source device to a single destination device within the LAN;
identifying the source device associated with the unwanted activity; and
isolating the source device from the LAN in response to the source device being associated with the unwanted activity.
20. A system, comprising:
a processor; and
a memory coupled to the processor, wherein the system is configured for:
identifying, by a network device, unwanted activity associated with an access request from a source device, the network device in communication with the source device via a virtual local area network (VLAN) of a local area network (LAN), wherein the unwanted activity is associated with one or more packets from the source device including a time to live (TTL) value indicating that the unwanted activity is only capable of being directly communicated from the source device to a single destination device within the LAN;
identifying the source device associated with the unwanted activity; and
isolating the source device from the LAN in response to the source device being associated with the unwanted activity.