Dynamic management of deception systems
Disclosed herein are methods, systems, and processes for dynamically deploying deception computing systems based on network environment lifecycle. Lifecycle metadata associated with protected host computing devices in a network is retrieved and a configurable ratio of deception computing systems to the protected host computing devices is accessed. One or more deception computing systems are deployed in or discharged from the network based on the configurable ratio.
1. A computer-implemented method, comprising:
retrieving lifecycle metadata associated with a plurality of protected hosts in a network;
accessing a configurable ratio of a plurality of honeypots to the plurality of protected hosts;
deploying in or discharging from, the network, one or more honeypots of the plurality of honeypots based on the configurable ratio;
determining that the plurality of honeypots and the plurality of protected hosts do not share a Layer 2 (L2) network segment; and
modifying a network route in the network to direct attacker traffic to a network location of the plurality of honeypots.
2. The computer-implemented method of claim 1 , further comprising:
determining that a protected host of the plurality of protected hosts is no longer part of the network; and
performing a host replacement operation to replace the protected host with a honeypot that is an explicit personality clone of the protected host.
3. The computer-implemented method of claim 1 , further comprising:
deploying or discharging the one or more honeypots based on a schedule if the lifecycle metadata associated with the plurality of protected hosts cannot be retrieved or determined but can be estimated.
4. The computer-implemented method of claim 1 , wherein
the lifecycle metadata comprises Dynamic Host Configuration Protocol (DHCP) log data, data collected by an agent-based computing system, network infrastructure log data, or protected host data generated by direct monitoring.
5. The computer-implemented method of claim 1 , wherein
the deploying and the discharging is performed by a honeypot service, and
the deploying and the discharging comprises enabling and disabling, respectively, the honeypot service.
6. The computer-implemented method of claim 1 , wherein
the plurality of protected hosts comprise a plurality of computing devices,
the plurality of honeypots comprise a plurality of deception computing devices, and
each of the plurality of deception computing devices is a replica of a corresponding computing device of the plurality of computing devices.
7. A non-transitory computer readable storage medium comprising program instructions executable to:
retrieve lifecycle metadata associated with a plurality of protected hosts in a network;
access a configurable ratio of a plurality of honeypots to the plurality of protected hosts;
deploy in or discharging from, the network, one or more honeypots of the plurality of honeypots based on the configurable ratio;
determine that the plurality of honeypots and the plurality of protected hosts do not share a Layer 2 (L2) network segment; and
modify a network route in the network to direct attacker traffic to a network location of the plurality of honeypots.
8. The non-transitory computer readable storage medium of claim 7 , further comprising:
determining that a protected host of the plurality of protected hosts is no longer part of the network; and
performing a host replacement operation to replace the protected host with a honeypot that is an explicit personality clone of the protected host.
9. The non-transitory computer readable storage medium of claim 7 , further comprising:
deploying or discharging the one or more honeypots based on a schedule if the lifecycle metadata associated with the plurality of protected hosts cannot be retrieved or determined but can be estimated.
10. The non-transitory computer readable storage medium of claim 7 , wherein
the lifecycle metadata comprises Dynamic Host Configuration Protocol (DHCP) log data, data collected by an agent-based computing system, network infrastructure log data, or protected host data generated by direct monitoring.
11. The non-transitory computer readable storage medium of claim 7 , wherein
the deploying and the discharging is performed by a honeypot service, and
the deploying and the discharging comprises enabling and disabling, respectively, the honeypot service.
12. The non-transitory computer readable storage medium of claim 7 , wherein
the plurality of protected hosts comprise a plurality of computing devices,
the plurality of honeypots comprise a plurality of deception computing devices, and
each of the plurality of deception computing devices is a replica of a corresponding computing device of the plurality of computing devices.
13. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
retrieve lifecycle metadata associated with a plurality of protected hosts in a network;
access a configurable ratio of a plurality of honeypots to the plurality of protected hosts;
deploy in or discharging from, the network, one or more honeypots of the plurality of honeypots based on the configurable ratio;
determine that the plurality of honeypots and the plurality of protected hosts do not share a Layer 2 (L2) network segment; and
modify a network route in the network to direct attacker traffic to a network location of the plurality of honeypots.
14. The system of claim 13 , further comprising:
determining that a protected host of the plurality of protected hosts is no longer part of the network; and
performing a host replacement operation to replace the protected host with a honeypot that is an explicit personality clone of the protected host.
15. The system of claim 13 , further comprising:
deploying or discharging the one or more honeypots based on a schedule if the lifecycle metadata associated with the plurality of protected hosts cannot be retrieved or determined but can be estimated.
16. The system of claim 13 , wherein
the lifecycle metadata comprises Dynamic Host Configuration Protocol (DHCP) log data, data collected by an agent-based computing system, network infrastructure log data, or protected host data generated by direct monitoring.
17. The system of claim 13 , wherein
the deploying and the discharging is performed by a honeypot service,
the deploying and the discharging comprises enabling and disabling, respectively, the honeypot service,
the plurality of protected hosts comprise a plurality of computing devices,
the plurality of honeypots comprise a plurality of deception computing devices, and
each of the plurality of deception computing devices is a replica of a corresponding computing device of the plurality of computing devices.