Behavior management of deception system fleets
Disclosed herein are methods, systems, and processes for managing and controlling the collective behavior of deception computing system fleets. A malicious attack initiated by a malicious attacker received by a honeypot that is part of a network along with other honeypots is detected. Information associated with the malicious attack is received from the honeypot. Based on the received information, a subset of honeypots other than the honeypot are configured to entice the attacker to engage with the subset of honeypots or avoid the subset of honeypots.
1. A computer-implemented method, comprising:
detecting a malicious attack received by a honeypot, wherein
the malicious attack is initiated by an attacker,
the honeypot is one of a plurality of honeypots, and
the plurality of honeypots are a part of a network;
receiving information associated with the malicious attack from the honeypot; and
based on the received information,
configuring a first subset of honeypots of the plurality of honeypots other than the honeypot to entice the attacker to continue engagement with the first subset of honeypots, and
configuring a second subset of honeypots of the plurality of honeypots other than the honeypot to deter the attacker from engaging with the second subset of honeypots.
2. The computer-implemented method of claim 1 , further comprising:
accessing a fleet state table; and
based on the received information, modifying the fleet state table.
3. The computer-implemented method of claim 1 , further comprising:
performing a scaled flocking operation.
4. The computer-implemented method of claim 2 , wherein
configuring the first subset of honeypots comprises provisioning the first subset of honeypots to match the behavior of the honeypot.
5. The computer-implemented method of claim 1 , further comprising:
configuring the first subset of honeypots to be vulnerable to the malicious attack directed at the honeypot.
6. The computer-implemented method of claim 1 , wherein
configuring the second subset of honeypots comprises provisioning the second subset of honeypots to differ from the behavior of the honeypot.
7. The computer-implemented method of claim 1 , further comprising:
configuring the subset of honeypots based on a plurality of criteria comprising at least an attacker location, a vulnerability age, or an unknown vulnerability.
8. A non-transitory computer readable storage medium comprising program instructions executable to:
detect a malicious attack received by a honeypot, wherein
the malicious attack is initiated by an attacker,
the honeypot is one of a plurality of honeypots, and
the plurality of honeypots are a part of a network;
receive information associated with the malicious attack from the honeypot; and
based on the received information,
configure a first subset of honeypots of the plurality of honeypots other than the honeypot to entice the attacker to continue engagement with the first subset of honeypots, and
configure a second subset of honeypots of the plurality of honeypots other than the honeypot to deter the attacker from engaging with the second subset of honeypots.
9. The non-transitory computer readable storage medium of claim 8 , wherein
configuring the first subset of honeypots comprises provisioning the first subset of honeypots to match the behavior of the honeypot, and
configuring the second subset of honeypots comprises provisioning the second subset of honeypots to differ from the behavior of the honeypot.
10. The non-transitory computer readable storage medium of claim 8 , further comprising:
accessing a fleet state table; and
based on the received information, modifying the fleet state table.
11. The non-transitory computer readable storage medium of claim 8 , further comprising:
performing a scaled flocking operation.
12. The non-transitory computer readable storage medium of claim 9 , further comprising:
configuring the first subset of honeypots to be vulnerable to the malicious attack directed at the honeypot.
13. The non-transitory computer readable storage medium of claim 8 , further comprising:
configuring the subset of honeypots based on a plurality of criteria comprising at least an attacker location, a vulnerability age, or an unknown vulnerability.
14. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
detect a malicious attack received by a honeypot, wherein
the malicious attack is initiated by an attacker,
the honeypot is one of a plurality of honeypots, and
the plurality of honeypots are a part of a network;
receive information associated with the malicious attack from the honeypot; and
based on the received information,
configure a first subset of honeypots of the plurality of honeypots other than the honeypot to entice the attacker to continue engagement with the first subset of honeypots, and
configure a second subset of honeypots of the plurality of honeypots other than the honeypot to deter the attacker from engaging with the second subset of honeypots.
15. The system of claim 14 , further comprising:
configuring the first subset of honeypots comprises provisioning the first subset of honeypots to match the behavior of the honeypot, and
configuring the second subset of honeypots comprises provisioning the second subset of honeypots to differ from the behavior of the honeypot.
16. The system of claim 14 , further comprising:
accessing a fleet state table; and
based on the received information, modifying the fleet state table.
17. The system of claim 14 , further comprising:
performing a scaled flocking operation.
18. The system of claim 15 , further comprising:
configuring the first subset of honeypots to be vulnerable to the malicious attack directed at the honeypot.
19. The system of claim 14 , further comprising:
configuring the subset of honeypots based on a plurality of criteria comprising at least an attacker location, a vulnerability age, or an unknown vulnerability.