Customized information networks for deception and attack mitigation

1. A computer-implemented method, comprising:

generating, by one or more processors, for a first network host on the computing network, a first virtual network topology view, wherein the first virtual network topology view of the first network host differs from a physical network topology of the computing network, wherein a network node perceives the computing network as comprising a network topology of the first virtual network topology view, the generating comprises:

modifying, by the one or more processors, naming and addressing services of network components communicatively coupled to the first network host, wherein the modified network components comprise network resources viewable by the first network host in the first virtual network topology view, wherein the modifying maintains communications connections between the network resources;

transforming, by one or more processors, network flows between the network resources viewable by the first network host in the first virtual network topology view, to be consistent with the first virtual network topology view;

deleting, by the one or more processors, one or more network resources of the network resources viewable by the first network host in the first virtual network topology view, from the first virtual network topology view, wherein the deleted one or more network resources are excluded from the first virtual network topology view;

based on the deleting, automatically filtering, by the one or more processors, traffic from the deleted one or more resources, wherein the filtered traffic is not visible to the first network host and to an observer within the first virtual network topology view; and

based on the deleting, responding, by the one or more processors, to queries received via the first network host, wherein the queries utilize identifiers of the deleted one or more resources, with an error.

2. The computer-implemented method of claim 1 , further comprising:

managing, by the one or more processors, communications between the network resources viewable by the first network host in the first virtual network topology view.

3. The computer-implemented method of claim 2 , further comprising:

managing, by the one or more processors, communications between any one of the network resources viewable by the first network host in the first virtual network topology view and an external client.

4. The computer-implemented method of claim 1 , wherein modifying the addressing services comprises:

utilizing, by the one or more processors, a Dynamic Host Configuration Protocol (DHCP) service and randomized topology templates to provide Internet Protocol (IP) addresses for the network resources.

5. The computer-implemented method of claim 1 , wherein modifying the addressing services comprises:

utilizing, by the one or more processors, a domain name system (DNS) service to provide IP addresses for the network resources.

6. The computer-implemented method of claim 5 , further comprising:

utilizing, by the one or more processors, an address resolution protocol (ARP) service to translates the IP addresses to MAC addresses consistent with the first virtual network topology view.

7. The computer-implemented method of claim 1 , further comprising:

obtaining, by the one or more processors, a notification of a network reconfiguration event; and

generating, by one or more processors, for the first network host on the computing network, a new first virtual network topology view.

8. The computer-implemented method of claim 7 , wherein the reconfiguration event is selected from the group consisting of: a change in system configuration parameters, elapsed time, user input, and an actual attack on a resource of the computing network and a reported attack on a resource of the computing network.

9. The computer-implemented method of claim 1 , further comprising:

generating, by one or more processors, for a second network host on the computing network, a second virtual network topology view, wherein the second virtual network topology view of the second network host differs from the physical network topology of the computing network and the first virtual network topology view of the first host, wherein a second network node perceives the computing network as comprising a network topology of the second virtual network topology view, the generating comprises:

modifying, by the one or more processors, naming and addressing services of network components communicatively coupled to the second network host, wherein the modified network components comprise network resources viewable by the second network host in the second virtual network topology view, wherein the modifying maintains communications connections between the network resources viewable by the second network host; and

transforming, by one or more processors, network flows between the network resources viewable by the second network host in the second virtual network topology view, to be consistent with the second virtual network topology view.

10. The computer-implemented method of claim 9 , where the second virtual network topology view differs from the first virtual network topology view and the second network host is a network resource of the network resources viewable by the first network host in the first virtual network topology view.

11. The computer-implemented method of claim 10 , further comprising:

obtaining, by the one or more processors, a notification of a network reconfiguration event;

generating, by one or more processors, for the first network host on the computing network, a new first virtual network topology view; and

maintaining, by the one or more processors, the second virtual network topology view.

12. The computer-implemented method of claim 1 , the generating the first virtual network topology view, further comprising:

generating, by the one or more processors, one or more synthetic network elements, wherein the synthetic network elements are not in the physical network topology; and

including, by the one or more processors, the one or more synthetic network elements in the first virtual network topology view.

13. The computer-implemented method of claim 12 , wherein the network resources viewable by the first network host in the first virtual network topology view are synthetic network elements.

14. The computer-implemented method of claim 1 ,

wherein the filtering comprises utilizing consistent fine-grained filters.

15. The computer-implemented method of claim 14 , wherein a portion of the one or more synthetic network elements comprises honeypots.

16. The computer-implemented method of claim 1 , wherein the transforming comprises:

directing, by one or more processors, one or more Software Defined Networking (SDN) elements of the computing network, communicatively coupled to the first network host, to transform the network flows between the network resources viewable by the first network host in the first virtual network topology view, to be consistent with the first virtual network topology view.

17. A computer program product comprising:

a non-transitory computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method comprising:

generating, by the one or more processors, for a first network host on the computing network, a first virtual network topology view, wherein the first virtual network topology view of the first network host differs from a physical network topology of the computing network, wherein a network node perceives the computing network as comprising a network topology of the first virtual network topology view, the generating comprises:

modifying, by the one or more processors, naming and addressing services of network components communicatively coupled to the first network host, wherein the modified network components comprise network resources viewable by the first network host in the first virtual network topology view, wherein the modifying maintains communications connections between the network resources;

transforming, by one or more processors, network flows between the network resources viewable by the first network host in the first virtual network topology view, to be consistent with the first virtual network topology view;

deleting, by the one or more processors, one or more network resources of the network resources viewable by the first network host in the first virtual network topology view, from the first virtual network topology view, wherein the deleted one or more network resources are excluded from the first virtual network topology view;

based on the deleting, automatically filtering, by the one or more processors, traffic from the deleted one or more resources, wherein the filtered traffic is not visible to the first network host and to an observer within the first virtual network topology view; and

based on the deleting, responding, by the one or more processors, to queries received via the first network host, wherein the queries utilize identifiers of the deleted one or more resources, with an error.

18. The computer program product 17 , the method further comprising:

obtaining, by the one or more processors, a notification of a network reconfiguration event; and

generating, by one or more processors, for the first network host on the computing network, a new first virtual network topology view.

19. The computer program product claim 18 , further comprising:

generating, by one or more processors, for a second network host on the computing network, a second virtual network topology view, wherein the second virtual network topology view of the second network host differs from the physical network topology of the computing network and the first virtual network topology view of the first host, wherein a second network node perceives the computing network as comprising a network topology of the second virtual network topology view, the generating comprises:

modifying, by the one or more processors, naming and addressing services of network components communicatively coupled to the second network host, wherein the modified network components comprise network resources viewable by the second network host in the second virtual network topology view, wherein the modifying maintains communications connections between the network resources viewable by the second network host; and

transforming, by one or more processors, network flows between the network resources viewable by the second network host in the second virtual network topology view, to be consistent with the second virtual network topology view;

obtaining, by the one or more processors, a notification of a network reconfiguration event;

generating, by one or more processors, for the first network host on the computing network, a new first virtual network topology view; and

maintaining, by the one or more processors, the second virtual network topology view.

20. A system comprising:

a memory;

one or more processors in communication with the memory; and

program instructions executable by the one or more processors via the memory to perform a method, the method comprising:

generating, by the one or more processors, for a first network host on the computing network, a first virtual network topology view, wherein the first virtual network topology view of the first network host differs from a physical network topology of the computing network, wherein a network node perceives the computing network as comprising a network topology of the first virtual network topology view, the generating comprises:

modifying, by the one or more processors, naming and addressing services of network components communicatively coupled to the first network host, wherein the modified network components comprise network resources viewable by the first network host in the first virtual network topology view, wherein the modifying maintains communications connections between the network resources;

transforming, by one or more processors, network flows between the network resources viewable by the first network host in the first virtual network topology view, to be consistent with the first virtual network topology view;

deleting, by the one or more processors, one or more network resources of the network resources viewable by the first network host in the first virtual network topology view, from the first virtual network topology view, wherein the deleted one or more network resources are excluded from the first virtual network topology view;

based on the deleting, automatically filtering, by the one or more processors, traffic from the deleted one or more resources, wherein the filtered traffic is not visible to the first network host and to an observer within the first virtual network topology view; and

based on the deleting, responding, by the one or more processors, to queries received via the first network host, wherein the queries utilize identifiers of the deleted one or more resources, with an error.