System and method for monitoring network traffic
Described is a method of assigning a network address to a trap, the network address being a dark address of a virtual private network. The network traffic destined for the network address is monitored and a classification of the network traffic is determined. After the classification, a predetermined response is executed based on the classification of the traffic.
1. A method, comprising:
by a network server, monitoring network traffic received within a target virtual private network comprising a plurality of network addresses including a dark network address assigned to a trap;
by the network server, gathering data regarding the network traffic including determining a level of the network traffic destined for the dark network address; and
by the network server, comparing the level of traffic to a predetermined threshold level to determine whether the network traffic is unauthorized.
2. The method according to claim 1 , wherein the trap is a honeypot.
3. The method according to claim 2 , wherein the honeypot includes at least one of an application, an object, a document, a page, a file, a portion of computer code, a computational resource, a communication-type resource, a server and a network of servers.
4. The method according to claim 1 , wherein the dark address is an unassigned network address from the plurality of network addresses.
5. The method according to claim 1 , further comprising:
identifying a weakness of the virtual private network; and
eliminating the weakness.
6. The method according to claim 1 , further comprising:
sharing the data with at least one further virtual private network.
7. A system, comprising:
a server coupled to a computer network, the server comprising a processor and non-transitory computer readable media containing instructions that, when executed by the processor, causes the processor to:
monitor network traffic received within a target virtual private network comprising a plurality of network addresses of the computer network including a network address assigned to a trap in a reserved address space of the computer network;
gather data regarding the network traffic including a level of the network traffic destined for the network address assigned to the trap; and
compare the level of traffic to a predetermined threshold level to determine whether the network traffic is unauthorized.
8. The system according to claim 7 , wherein the trap is a honeypot.
9. The system according to claim 8 , wherein the honeypot includes at least one of an application, an object, a document, a page, a file, a portion of computer code, a computational resource, a communication-type resource, a server and a network of servers.
10. The system according to claim 7 , wherein the address space includes a dark address space and the trap is installed in the dark address space.
11. The system according to claim 10 , wherein the dark address space includes at least one unassigned network address within the address space.
12. The system according to claim 7 , wherein the server shares the data with at least one virtual private network.
13. The system according to claim 7 , wherein the computer network is a virtual private network.
14. The system according to claim 7 , wherein the computer readable media further causes the processor to:
terminate a connection associated with the network traffic upon determining that the network traffic is unauthorized.
15. A non-transitory computer-readable storage medium storing a set of instructions, the set of instructions capable of being executed by a processor, the set of instructions performing the steps of:
monitoring network traffic received within a target virtual private network comprising a plurality of network addresses including a dark network address assigned to a trap network;
gathering data regarding the network traffic including determining a level of the network traffic destined for the dark network address; and
comparing the level of traffic to a predetermined threshold level to determine whether the network traffic is unauthorized.
16. The non-transitory computer-readable storage medium according to claim 15 , wherein the trap is a honeypot.
17. The non-transitory computer-readable storage medium according to claim 16 , wherein the honeypot includes at least one of an application, an object, a document, a page, a file, a portion of computer code, a computational resource, a communication type resource, a server and a network of servers.
18. The non-transitory computer-readable storage medium according to claim 15 , wherein the dark address is an unassigned network address from the plurality of network addresses.
19. The non-transitory computer-readable storage medium according to claim 15 , wherein the instructions further perform the steps of:
identifying a weakness of the virtual private network; and
eliminating the weakness.
20. The non-transitory computer-readable storage medium according to claim 15 , wherein the instructions further perform the step of:
sharing the data with at least one further virtual private network.