Reactive and pre-emptive security system for the protection of computer networks and systems
The invention provides mechanisms for enhancing the security and protection of a computer-based system or network. It relates, in part, to the use of a decoy (which may be termed “honeypot” or “honeynet”) for collecting attacker-related data, and/or diverting malicious behaviour away from legitimate resources. In one embodiment, the invention provides a method comprising the steps of receiving, processing and logging network traffic data of a plurality of users, where the network traffic is received from a plurality of participating users; determining an attacker profile from the network traffic data; determining a honeypot or honeynet configuration based on the attacker profile; and upon receipt of a valid information request from a user of the plurality of users, providing the determined attacker profile and configuration to the user. Additionally or alternatively, it may provide a computer-implemented method comprising the steps of receiving, processing and logging network traffic data; based on processed network traffic data: determining that network traffic originates from an attacker, determining a risk classification; and determining a decoy configuration based on the risk classification; upon receipt of a valid information request from a user, providing the determined risk classification and decoy configuration to the user.
1. A computer-implemented security method comprising:
receiving, processing, and logging network traffic data received from a plurality of users;
determining an attacker profile from the network traffic data, wherein the attacker profile includes attack prevention information an attacker identity;
determining an attacker classification based on sophistication of the attacker with the attacker identity;
determining a configuration of a honeypot or honeynet using the network traffic data, the attacker profile, and the attacker classification; and
using a computer-based storage resource to store the attacker profile and the honeypot or honeynet configuration,
wherein the attacker profile and the honeypot or honeynet configuration are made available upon request to any of the plurality of users that are registered.
2. The method of claim 1 , further comprising using the computer-based storage resource to store:
the network traffic data; and/or
data relating to the users.
3. The method according to claim 1 , further comprising:
directing network traffic to the honeypot or honeynet generated in accordance with, or using, the determined configuration.
4. The method according to claim 1 , wherein the plurality of users comprises users who are designated as authorised users.
5. The method according to claim 1 , further comprising:
receiving a request from a user; and
determining whether the request is from an authorised user or an attacker.
6. The method according to claim 1 , further comprising: determining a profile for one or more of the users from the plurality of users.
7. A computer-implemented security system comprising:
a computer-based storage resource is arranged to receive, process, and log network traffic data received from a plurality of users; and
one or more processors and memory, the memory storing instructions that, when executed by the one or more processors of a computer system, cause the computer-implemented security system to:
determine an attacker profile from the network traffic data, wherein the attacker profile includes attack prevention information associated with an attacker identity;
determine an attacker classification based on sophistication of the attacker with the attacker identity;
determine a configuration of a honeypot or a honeynet using the network traffic data, the attacker profile, and the attacker classification;
use the computer-based storage resource to store an attacker profile and a honeypot or honeynet configuration,
wherein the attacker profile and the honeypot or honeynet configuration are made available upon request to any of the plurality of users that are registered.
8. The computer-implemented security system according to claim 7 , wherein the computer-based storage resource is also arranged to store:
profile(s) relating to one or more of the plurality of users;
profile(s) relating to one or more attackers or groups or types of attackers; and/or
honeypot/honeynet configuration parameters.
9. A computer-implemented method comprising:
using a computer-based storage resource to store an attacker profile and a computer decoy, wherein the attacker profile and the computer decoy are made available upon request to a plurality of registered users;
receiving attacker profile information;
monitoring traffic to a network address;
comparing the monitored traffic to the attacker profile information;
determining an attacker classification based on sophistication of the attacker with an attacker identity, wherein the sophistication is determined based at least in part on behavior indicating skillfulness of an attack;
upon determining that the monitored traffic is associated with an attacker, retrieving configuration information to configure the computer decoy; and
configuring the computer decoy based on the retrieved configuration information and the attacker classification using a machine learning model.
10. The method of claim 9 , further comprising directing traffic to the computer decoy.
11. The method of claim 9 , further comprising storing the monitored traffic in the computer-based storage resource.
12. The method according to claim 9 , wherein the attacker profile information is generated using network traffic data provided by a plurality of users.
13. A system comprising:
one or more processors; and
memory storing instructions executable by the one or more processors to cause the system to:
determine an attacker profile based on network traffic data;
determine an attacker classification based on sophistication of the attacker with an attacker identity, wherein the sophistication is based at least in part on a behavior of the attacker,
determine a configuration of a honeypot or honeynet using the network traffic data, the attacker profile, and the attacker classification;
configure the honeypot or honeynet according to the determined configuration, wherein the instructions cause the system to determine the configuration of the honeypot or honeynet using a machine learning model;
use a computer-based storage resource to store the attacker profile and the honeypot or honeynet configuration,
wherein the attacker profile and the honeypot or honeynet configuration are made available upon request to any of the plurality of users that are registered.
14. The system according to claim 13 , wherein the instructions further cause the system to generate a database for the honeypot or honeynet.
15. The system according to claim 14 , wherein the database is an altered or false database.
16. The system according to claim 15 , wherein the database lacks data that is commercially or confidentially sensitive.
17. The system according to claim 13 , wherein the instructions further cause the system to configure different honeypots or honeynets for different attacker profiles.
18. The system according to claim 13 , wherein the machine learning model is a neural network.
19. The system according to claim 13 , wherein the attacker profile comprises information usable at least in part to identify the attacker.