Network attack tainting and tracking

1. A method, comprising:

monitoring, by a network device, data packets destined for a target for a malicious request; and

responsive to detecting the malicious request;

creating by the network device a payload;

formatting the payload to correspond to a protocol of the request;

digitally signing the payload;

injecting the digitally signed payload into a response message; and

transmitting the response message to a source of the request as a response to the request.

2. The method of claim 1 , further comprising encrypting the digitally signed payload.

3. The method of claim 1 , wherein creating the payload includes forming the payload to include a detection rule triggered by the malicious request.

4. The method of claim 1 , wherein creating the payload includes forming the payload to include an Internet Protocol (IP) address of the source of the malicious request.

5. The method of claim 1 , wherein injecting the digitally signed payload into the response message includes injecting the digitally signed payload into a cookie.

6. The method of claim 1 , wherein creating the payload includes forming the payload to include an IP address of a target of the malicious request.

7. A system, comprising:

a processor and a memory; and

an intrusion prevention system executable by the processor to:

monitor data packets received from a network for a malicious request; and

responsive to detecting the malicious request:

create a payload;

format the payload to correspond to an expected protocol of the request;

digitally sign the payload;

inject the digitally signed payload into a response message; and

transmit the response message to a source of the request as a response to the request.

8. The system of claim 7 , wherein the intrusion prevention system is executable to encrypt the digitally signed payload.

9. The system of claim 7 , wherein the intrusion prevention system is executable to create the payload to include a detection rule triggered by the malicious request.

10. The system of claim 7 , wherein the intrusion prevention system is executable to create the payload to include an Internet Protocol (IP) address of the source of the malicious request.

11. The system of claim 7 , wherein the intrusion prevention system is executable to inject the digitally signed payload into a cookie.

12. The system of claim 7 , wherein the intrusion prevention system is executable to create the payload to include an IP address of a target of the malicious request.

13. A computer program product for network attack tainting and tracking, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

monitor data packets received from a network by a network device for a malicious request, the data packets destined for a target; and

responsive to detecting the malicious request:

create by the network device a payload;

format the payload to correspond to an expected protocol of the request;

digitally sign the payload;

inject the encrypted digitally signed payload into a response message; and

transmit the response message to a source of the request as a response to the request.

14. The computer program product of claim 13 , wherein the program instructions are executable by the processor to encrypt the digitally signed payload.

15. The computer program product of claim 13 , wherein the program instructions are executable by the processor to create the payload to include a detection rule triggered by the malicious request.

16. The computer program product of claim 15 , wherein the program instructions are executable by the processor to create the payload to include an Internet Protocol (IP) address of the source of the malicious request and a target of the malicious request.

17. The computer program product of claim 13 , wherein the program instructions are executable by the processor to inject the digitally signed payload into a cookie.