System and method for monitoring network traffic
Described is a method of assigning a network address to a trap, the network address being a dark address of a virtual private network. The network traffic destined for the network address is monitored and a classification of the network traffic is determined. After the classification, a predetermined response is executed based on the classification of the traffic.
1. A method, comprising:
by a network server, monitoring network traffic received within a target virtual private network comprising a plurality of network addresses including a dark network address assigned to a trap;
by the network server, determining that traffic directed to the dark network address is unauthorized network traffic, based on a traffic level of the traffic directed to the dark network address;
by the network server, gathering data regarding the unauthorized network traffic including information on the exploitation of vulnerabilities of the target virtual private network; and
by the network server, identifying a weakness of the virtual private network based on the information.
2. The method according to claim 1 , further comprising:
eliminating the weakness of the virtual private network.
3. The method according to claim 1 , further comprising:
after gathering the data, terminating a connection over which the unauthorized network traffic is received.
4. The method according to claim 1 , wherein the trap is a honeypot.
5. The method according to claim 4 , wherein the honeypot includes at least one of an application, an object, a document, a page, a file, a portion of computer code, a computational resource, a communication-type resource, a server and a network of servers.
6. The method according to claim 1 , wherein the dark address is an unassigned network address from the plurality of network addresses.
7. A system, comprising:
a server coupled to a computer network, the server comprising a processor and non-transitory computer readable media containing instructions that, when executed by the processor, causes the processor to perform operations comprising:
monitoring network traffic received within a target virtual private network comprising a plurality of network addresses including a dark network address assigned to a trap;
determining that traffic directed to the dark network address is unauthorized network traffic, based on a traffic level of the traffic directed to the dark network address;
gathering data regarding the unauthorized network traffic including information on the exploitation of vulnerabilities of the target virtual private network; and
identifying a weakness of the virtual private network based on the information.
8. The system according to claim 7 , further comprising:
eliminating the weakness of the virtual private network.
9. The system according to claim 7 , further comprising:
after gathering the data, terminating a connection over which the unauthorized network traffic is received.
10. The system according to claim 7 , wherein the trap is a honeypot.
11. The system according to claim 10 , wherein the honeypot includes at least one of an application, an object, a document, a page, a file, a portion of computer code, a computational resource, a communication-type resource, a server and a network of servers.
12. The system according to claim 7 , wherein the dark address is an unassigned network address from the plurality of network addresses.
13. The system according to claim 7 , wherein the computer network is a virtual private network.
14. A non-transitory computer-readable medium having stored thereon computer readable instructions for monitoring network traffic, wherein execution of the computer readable instructions by a processor causes the processor to perform operations comprising:
monitoring network traffic received within a target virtual private network comprising a plurality of network addresses including a dark network address assigned to a trap;
determining that traffic directed to the dark network address is unauthorized network traffic, based on a traffic level of the traffic directed to the dark network address;
gathering data regarding the unauthorized network traffic including information on the exploitation of vulnerabilities of the target virtual private network; and
identifying a weakness of the virtual private network based on the information.
15. The non-transitory computer-readable medium according to claim 14 , further comprising:
eliminating the weakness of the virtual private network.
16. The non-transitory computer-readable medium according to claim 14 , further comprising:
after gathering the data, terminating a connection over which the unauthorized network traffic is received.
17. The non-transitory computer-readable medium according to claim 14 , wherein the trap is a honeypot.
18. The non-transitory computer-readable medium according to claim 17 , wherein the honeypot includes at least one of an application, an object, a document, a page, a file, a portion of computer code, a computational resource, a communication-type resource, a server and a network of servers.
19. The non-transitory computer-readable medium according to claim 14 , wherein the dark address is an unassigned network address from the plurality of network addresses.
20. The non-transitory computer-readable medium according to claim 14 , wherein the computer network is a virtual private network.