Controlled deployment of blended honeypot services
Methods and systems for monitoring activity on a network. The systems may include a host computer executing a non-honeypot service. The host computer may also include a control module configured to enable or disable a honeypot service on the host computer in response to at least one of computational resource availability and configured tolerance for degraded service.
1. A system comprising:
a first host on a network configured to:
execute a production service; and
execute a honeypot service used to monitor activity on the network;
wherein the first host implements a control module configured to execute instructions stored on a memory to:
determine to deploy the honeypot service on a second host in an isolated environment on the network;
determine an amount of resources required for executing the honeypot service on the second host to reduce a communication latency between the first host and the second host that differentiates responses by the first host and the second host, wherein the amount of resources is determined based on a service protocol of the honeypot service;
cause the second host to be configured with the required amount of resources and the honeypot service to be deployed on the second host; and
forward traffic directed to the honeypot service to the second host to prevent a malicious actor from accessing the production service on the first host.
2. The system of claim 1 , wherein
the control module is further configured to configure a level of interaction provided by the honeypot service.
3. The system of claim 2 , wherein
the control module configures the level of interaction provided by the honeypot service in response to an attack on the first host.
4. The system of claim 2 , further comprising:
a configuration manager in communication with the first host permitting an operator to configure the level of interaction provided by the honeypot service.
5. The system of claim 1 , wherein
the first host is configured to communicate instructions regarding deployment of the honeypot service on the second host in response to an attack on the first host.
6. The system of claim 1 , wherein
the honeypot service is executed without escalated privileges on the second host.
7. The system of claim 1 , wherein
the honeypot service and the production service share an assigned port on the first host, and the control module determines which of the honeypot service and the production service is configured to communicate using the assigned port.
8. The system of claim 1 , wherein
the honeypot service is configured to customize template content for its communications with a threat actor.
9. The system of claim 8 , wherein
the template content is selected from the group consisting of Telnet banners, SMB banners, database versions, and database schemas.
10. A method comprising:
performing, by a first host on a network:
executing a production service on the first host;
executing a honeypot service on the first host used to monitor activity on the network; and
executing a control module on the first host, comprising:
determining to deploy the honeypot service on a second host in an isolated environment on the network;
determining an amount of resources required for executing the honeypot service on the second host to reduce a communication latency between the first host and the second host that differentiates responses by the first host and the second host, wherein the amount of resources is determined based on a service protocol of the honeypot service;
causing the second host to be configured with the required amount of resources and the honeypot service to be deployed on the second host; and
forwarding traffic directed to the honeypot service to the second host to prevent a malicious actor from accessing the production service on the first host.
11. The method of claim 10 , further comprising:
configuring, using the control module, a level of interaction provided by the honeypot service.
12. The method of claim 11 , wherein
the control module configures the level of interaction provided by the honeypot service in response to an attack on the first host.
13. The method of claim 11 , further comprising:
permitting, using a configuration manager in communication with the first host, an operator to configure the level of interaction provided by the honeypot service.
14. The method of claim 10 , further comprising:
communicating, using the first host, instructions regarding deployment of the honeypot service on the second host in response to an attack on the first host.
15. The method of claim 10 , wherein
the honeypot service is executed without escalated privileges on the second host.
16. The method of claim 10 , wherein
the honeypot service and the production service share an assigned port on the first host, and the control module determines which of the honeypot service and the production service is configured to communicate using the assigned port.
17. The method of claim 10 , further comprising:
customizing, using the honeypot service, template content for its communications with a threat actor.
18. The method of claim 17 , wherein
the template content is selected from the group consisting of Telnet banners, SMB banners, database versions, and database schemas.