Honeypot network services
In general, in one aspect, a system for providing honeypot network services may monitor network activity, and detect network activity indicative of network service discovery by a first device, for example, port scanning. The system may present a temporarily available network service to the first device in response to detecting the activity indicative of port scanning, for example, by redirecting traffic at an unassigned network address to a honeypot network service. The system may monitor communication between the first device and the presented honeypot network service to determine whether the monitored communication is indicative of a threat, and determine that the first device is compromised based on the monitored communication between the first device and the presented honeypot network service. The system may initiate measures to protect the network from the compromised first device.
1. A non-transitory computer-readable medium comprising instructions executable by a processor for detecting a compromised device on a network, the instructions when executed causing the processor to perform steps comprising:
detecting network requests from a first device within an enterprise network to other network devices connected wirelessly to a wireless access point of the enterprise network;
detecting traffic from the first device to an unassigned network address in a same portion of the network as the other network devices connected wirelessly to the wireless access point of the enterprise network;
in response to detecting the network requests from the first device to other network devices connected wirelessly to the wireless access point and detecting the traffic from the first device to the unassigned network address in the same portion of the network as the other network devices connected wirelessly to the wireless access point, presenting a honeypot network service to the first device within the enterprise network by redirecting the traffic directed to the unassigned network address to the honeypot network service, the honeypot network service configured as a wireless device;
monitoring communication between the first device and the honeypot network service;
convicting the first device as compromised based on the monitored communication; and
based on the conviction of the first device as compromised, initiating measures to remediate the first device.
2. The non-transitory computer-readable medium of claim 1 , wherein the measures initiated comprise isolating communication from the first device from the network.
3. The non-transitory computer-readable medium of claim 1 , wherein the measures initiated comprise notifying a threat detection facility.
4. The non-transitory computer-readable medium of claim 1 , wherein the measures initiated comprise allowing the first device with wireless access only to a threat management system of the enterprise network.
5. The non-transitory computer-readable medium of claim 1 , wherein the measures initiated comprise generating an alert about compromise of the first device.
6. A method for detecting a malicious device on a network, the method comprising:
detecting network requests from a first device within an enterprise network to other network devices connected wirelessly to a wireless access point of the enterprise network;
detecting traffic from the first device to an unassigned network address within the enterprise network;
in response to detecting the network requests from the first device to other network devices connected wirelessly to the wireless access point and detecting the traffic from the first device to the unassigned network address, presenting a honeypot network service to the first device within the enterprise network by redirecting the traffic directed to the unassigned network address to the honeypot network service, the honeypot network service configured as a wireless device;
monitoring communication between the first device and the honeypot network service; and
determining that the first device is malicious based on the monitored communication.
7. The method of claim 6 , wherein the honeypot network service is not accessible to the first device prior to the presenting.
8. The method of claim 7 , wherein any communication between the first device and the honeypot network service after presentation of the honeypot network service is indicative of compromise.
9. The method of claim 6 , wherein the wireless access point is a WiFi access point.
10. The method of claim 6 , wherein the honeypot network service is presented to the first device for a predetermined period of time.
11. The method of claim 6 , wherein the honeypot network service is presented until cleared by an administrator.
12. The method of claim 6 , wherein the honeypot network service is presented only to the first device.
13. The method of claim 6 , wherein the honeypot network service is not password protected.
14. A system for detecting a compromised device, the system comprising:
a processor; and
a memory comprising instructions executable by the processor, the instructions when executed causing the processor to perform steps, comprising
detect network requests from a first device within an enterprise network to other network devices connected to a wireless access point of the enterprise network,
detect traffic from the first device to an unassigned network address within the enterprise network,
in response to detecting the network requests from the first device to other network devices connected wirelessly to the wireless access point and detecting the traffic from the first device to the unassigned network address, presenting a honeypot network service to the first device within the enterprise network by redirecting the traffic directed to the unassigned network address to the honeypot network service, the honeypot network service configured as a wireless device,
monitoring communication between the first device and the honeypot network service, and
determining that the first device is compromised based on the monitored communication.
15. The system of claim 14 , wherein the instructions cause the processor to initiate measures to remediate the first device by causing the processor to prevent communication from the first device to the enterprise network.
16. The system of claim 14 , wherein the instructions cause the processor to initiate measures to remediate the first device by notifying a threat detection facility that the first device is compromised.
17. The system of claim 14 , wherein the instructions cause the processor to initiate measures to remediate the first device by identifying a process on the first device that generated the network requests.
18. The system of claim 17 , wherein the instructions cause the processor to initiate measures to remediate the first device by terminating the process on the first device that generated the network requests.
19. The system of claim 17 , wherein the instructions cause the processor to initiate measures to remediate the first device by isolating the process on the first device that generated the network requests.