Automated generation and deployment of honey tokens in provisioned resources on a remote computer resource platform
Methods, systems, and media are shown for creating and deploying honey tokens for intrusion detection in a remote computing resource system. Resource modules provisioned for a tenant are identified for intrusion detection. For each identified resource modules, a provisioned resource having a corresponding access credential is allocated and the access credential is deployed in the identified resource module. A data entry is created in a token mapping store that identifies the access credential and the resource module. Access logs are scanned to detect access attempts. For each access attempt, the token mapping store is searched for a data entry with an access credential that matches the access credential of the access attempt. If found, an alert is generated that includes the identified resource module of the matching data entry.
1. A computer-implemented method for intrusion detection in a remote computing resource system, the method comprising:
providing a user interface (UI) by way of the remote computing resource system, the UI identifying a plurality of tenant resource modules provisioned in the remote computing resource system for a tenant of the remote computing resource system to provide resources for the tenant, wherein the tenant resource modules provisioned for the tenant of the remote computing resource system comprise one or more of a key vault, a virtual machine, an application service, an application programming interface, or a domain directory;
receiving a selection by way of the UI of one or more of the plurality of tenant resource modules to be configured for intrusion detection;
responsive to receiving the selection by way of the UI, for the tenant resource modules selected in the UI,
allocating provisioned resources having corresponding access credentials,
deploying the corresponding access credentials in respective tenant resource modules, and
creating one or more data entries in a token mapping store, the data entries providing a mapping between the tenant, the corresponding access credentials and the identified tenant resource modules in which the corresponding access credentials were deployed;
scanning one or more access logs for the remote computing resource system to detect one or more resource access attempts, each access attempt including an access credential for the access attempt; and
for each resource access attempt,
searching the token mapping store for a matching data entry where the access credential of the data entry matches the access credential for the access attempt, and
if the matching data entry is found, generating an alert that identifies the identified resource module of the matching data entry.
2. The computer-implemented method of claim 1 , wherein the provisioned resources comprise at least one of an unused resource allocated for the tenant.
3. The computer-implemented method of claim 1 , wherein the unused resource allocated for the tenant comprises a container with restricted access permissions.
4. The computer-implemented method of claim 1 , wherein the UI further comprises a UI control which, when selected, will cause threat intelligence data to be generated and sent to one or more entities.
5. The computer-implemented method of claim 1 , wherein the UI further comprises selectable fields identifying the plurality of tenant resource modules provisioned in the remote computing resource system for the tenant of the remote computing resource system.
6. An intrusion detection system for detecting intrusion in a remote computing resource system, the system comprising:
one or more processors; and
one or more memory devices in communication with the one or more processors, the memory devices having computer-readable instructions stored thereupon that, when executed by the processors, cause the processors to perform operations comprising:
providing a user interface (UI) by way of the remote computing resource system, the UI identifying a plurality of tenant resource modules provisioned in the remote computing resource system for a tenant of the remote computing resource system to provide resources for the tenant, wherein the tenant resource modules provisioned for the tenant of the remote computing resource system comprise one or more of a key vault, a virtual machine, an application service, an application programming interface, or a domain directory;
receiving a selection by way of the UI of one or more of the plurality of resource modules to be configured for intrusion detection;
responsive to receiving the selection by way of the UI, for the tenant resource modules selected in the UI,
allocating provisioned resources having corresponding access credentials,
deploying the corresponding access credentials in respective tenant resource modules, and
creating one or more data entries in a token mapping store, the data entries providing a mapping between the tenant, the corresponding access credentials, and the identified tenant resource modules in which the corresponding access credentials were deployed;
scanning one or more access logs for the remote computing resource system to detect one or more resource access attempts, each access attempt including an access credential for the access attempt; and
for each resource access attempt:
searching the token mapping store for a matching data entry where the access credential of the data entry matches the access credential for the access attempt, and
if the matching data entry is found, generating an alert that identifies the identified resource module of the matching data entry.
7. The system of claim 6 , wherein allocating at least one of the provisioned resources comprises generating a storage account and the corresponding access credential comprises a key to the storage account.
8. The system of claim 6 , wherein at least one of the provisioned resources comprises an unused resource allocated for the tenant.
9. The system of claim 8 , wherein the unused resource allocated for the tenant comprises one of a container with restricted access permissions and a fictitious user account in a domain corresponding to the tenant.
10. The system of claim 6 , wherein at least one of the corresponding access credentials for the provisioned resources comprises one of a connection string, an access key, a certificate, a service key, a management key, a storage key, or an access token.
11. The system of claim 6 , wherein the UI further comprises a UI control which, when selected, will cause threat intelligence data to be generated and sent to one or more entities.
12. One or more computer storage media having computer executable instructions stored thereon which, when executed by one or more processors, cause the processors to perform operations for creating and deploying honey tokens for intrusion detection in a remote computing resource system, the operations comprising:
providing a user interface (UI) by way of the remote computing resource system, the UI identifying a plurality of tenant resource modules provisioned in the remote computing resource system for a tenant of the remote computing resource system to provide resources for the tenant, wherein the tenant resource modules provisioned for the tenant of the remote computing resource system comprise one or more of a key vault, a virtual machine, an application service, an application programming interface, or a domain directory;
receiving a selection by way of the UI of one or more of the plurality of resource modules to be configured for intrusion detection;
responsive to receiving the selection by way of the UI, for the one or more tenant resource modules selected in the UI,
allocating provisioned resources having corresponding access credentials,
deploying the corresponding access credentials in respective tenant resource modules, and
creating one or more data entries in a token mapping store, the data entries providing a mapping between the tenant, the corresponding access credentials, and the identified resource modules in which the corresponding access credentials were deployed;
scanning one or more access logs for the remote computing resource system to detect one or more resource access attempts, each access attempt including an access credential for the access attempt; and
for each resource access attempt,
searching the token mapping store for a matching data entry where the access credential of the data entry matches the access credential for the access attempt, and
if the matching data entry is found, generating an alert that identifies the identified resource module of the matching data entry.
13. The one or more computer storage media of claim 12 , wherein allocating at least one of the provisioned resources comprises generating a storage account and the corresponding access credential comprises a key to the storage account.
14. The one or more computer storage media of claim 12 , wherein at least one of the provisioned resources comprises an unused resource allocated for the tenant.
15. The one or more computer storage media of claim 14 , wherein the unused resource allocated for the tenant comprises one of a container with restricted access permissions or a fictitious user account in a domain corresponding to the tenant.
16. The one or more computer storage media of claim 12 , wherein at least one of the corresponding access credentials for the provisioned resources comprises one of a connection string, an access key, a certificate, a service key, a management key, a storage key, or an access token.
17. The one or more computer storage media of claim 12 , wherein the UI further comprises a UI control which, when selected, will cause threat intelligence data to be generated and sent to one or more entities.