Detecting malicious actors
Methods and systems for detecting a malicious actor on a network. In some embodiments the system may gather data regarding one or more authentic hostnames on a network, and generate a pseudo hostname based on the gathered data. The system may then issue a network discovery request for the pseudo hostname. Based on a response to the network discovery request, the system may execute one or more remedial actions.
1. A method for detecting a malicious actor on a network, the method comprising:
receiving data regarding at least one authentic hostname on the network;
generating a pseudo hostname based on the data regarding the at least one authentic hostname, wherein the generated pseudo hostname does not exist on the network as there are no devices on the network with the generated pseudo hostname;
issuing a network discovery request for the pseudo hostname to encourage a malicious actor to respond;
receiving a response to the network discovery request, wherein the received response is determined to be from a malicious actor as the issued network discovery request is for the pseudo hostname that does not exist on the network; and
executing at least one remedial action based on the received response.
2. The method of claim 1 wherein the data regarding the at least one authentic hostname on the network includes network traffic involving at least one legitimate system on the network.
3. The method of claim 1 further comprising detecting at least one pattern associated with the at least one authentic hostname on the network.
4. The method of claim 3 wherein generating the pseudo hostname includes generating the pseudo hostname in accord with the at least one detected pattern.
5. The method of claim 3 wherein the detected pattern includes at least one of a Unicode character, a word, an alphanumeric token, and an alphanumeric sequence.
6. The method of claim 1 wherein generating the pseudo hostname includes generating the pseudo hostname based on the at least one authentic hostname.
7. The method of claim 1 wherein generating the pseudo hostname includes executing a distance measuring algorithm on the pseudo hostname with respect to the at least one authentic hostname on the network to ensure the generated pseudo hostname is within a predetermined distance from the at least one authentic hostname.
8. The method of claim 1 wherein the network discovery request is selected from the group consisting of: a NetBIOS request, an ARP discovery request, a DNS discovery request, a DHCP discovery request, a Bonjour discovery request, and a UPnP discovery request.
9. The method of claim 1 wherein generating the pseudo hostname includes:
receiving at least one authentic hostname, and
mutating at least one portion of the at least one authentic hostname.
10. The method of claim 1 wherein the generated pseudo hostname is based on a template.
11. A system for detecting a malicious actor on a network, the system comprising:
an interface for receiving data regarding at least one authentic hostname on the network;
a memory; and
a processor executing instructions stored on the memory to:
generate a pseudo hostname based on the data regarding the at least one authentic hostname, wherein the generated pseudo hostname does not exist on the network as there are no devices on the network with the generated pseudo hostname,
issue a network discovery request for the pseudo hostname to encourage a malicious actor to respond,
receive a response to the network discovery request, wherein the received response is determined to be from a malicious actor as the issued network discovery request is for the pseudo hostname that does not exist on the network, and
execute at least one remedial action based on the received response.
12. The system of claim 11 wherein the data regarding the at least one authentic hostname on the network includes network traffic involving at least one legitimate system on the network.
13. The system of claim 11 wherein the processor is further configured to detect at least one pattern associated with the at least one authentic hostname on the network.
14. The system of claim 13 wherein the processor generates the pseudo hostname in accord with the at least one detected pattern.
15. The system of claim 13 wherein the detected pattern includes at least one of a Unicode character, a word, an alphanumeric token, and an alphanumeric sequence.
16. The system of claim 11 wherein the pseudo hostname is generated based on the at least one authentic hostname.
17. The system of claim 11 wherein the processor generates the pseudo hostname by executing a distance measuring algorithm on the pseudo hostname with respect to the at least one authentic hostname to ensure the generated pseudo hostname is within a predetermined distance from the at least one authentic hostname.
18. The system of claim 11 wherein the network discovery request is selected from the group consisting of: a NetBIOS request, an ARP discovery request, a DNS discovery request, a DHCP discovery request, a Bonjour discovery request, and a UPnP discovery request.
19. The system of claim 11 wherein the processor is configured to generate the pseudo hostname by:
receiving at least one authentic hostname, and
mutating at least one portion of the at least one authentic hostname.
20. The system of claim 11 wherein the generated pseudo hostname is based on a template.