Virtual security appliances for eliciting attacks

1. A method for monitoring network activity, the method comprising:

deploying, on a network, a virtual security appliance that comprises a port associated with a service;

detecting an attack on the virtual security appliance that targets the service using a protocol associated with the port;

in response to the attack on the virtual security appliance, deploying, on another network, a subsequent virtual security appliance that simulates the service and the port of the virtual security appliance; and

configuring the subsequent virtual security appliance to elicit a subsequent attack, comprising

opening the simulated port,

enabling the simulated port to accept communication using the protocol, and

including a vulnerability in the simulated service that compromises the subsequent virtual security appliance.

2. The method of claim 1 , wherein the subsequent virtual security appliance is deployed on the another network calculated to receive the subsequent attack.

3. The method of claim 1 , further comprising querying:

an attack pattern database for attack pattern data including data from previously attacked sectors, services, or geographies;

an internet scan database for internet scan data; and

a threat intelligence database for threat intelligence data regarding previously-observed attacked services or sectors.

4. A system for monitoring network activity, the system comprising:

a processing device; and

memory, wherein the processing device is configured to execute instructions stored on the memory to:

deploy, on a network, a virtual security appliance that comprises a port associated with a service;

detect an attack on the virtual security appliance that targets the service using a protocol associated with the port;

in response to the attack on the virtual security appliance, deploy, on another network, a subsequent virtual security appliance that simulates the service and the port of the virtual security appliance; and

configure the subsequent virtual security appliance to elicit a subsequent attack, comprising

opening the simulated port,

enabling the simulated port to accept communication using the protocol, and

including a vulnerability in the simulated service that compromises the subsequent virtual security appliance.

5. The system of claim 4 , wherein the subsequent virtual security appliance is deployed on the another network calculated to receive the subsequent attack.

6. The system of claim 4 , further comprising querying:

an attack pattern database for the attack pattern data including data from the previously attacked sectors, services, or geographies;

an internet scan database for internet scan data; and

a threat intelligence database for threat intelligence data regarding previously-observed attacked services or sectors.

7. A method comprising:

deploying a virtual security appliance in a network;

receiving data comprising attack pattern data, internet scan data, and threat intelligence data, the received data comprising information regarding a previous attack on a service of an another virtual security appliance in another network, the attack using a protocol associated with a port of the another virtual security appliance; and

after the attack on the virtual security appliance, updating the virtual security appliance, wherein the updating comprises

tailoring, based on the attack pattern data, the internet scan data, and the threat intelligence data, a feature of the virtual security appliance, wherein the tailoring comprises configuring the virtual security appliance to simulate the service that was previously attacked to entice a subsequent attack on the virtual security appliance using the protocol associated with the port.

8. The method of claim 7 , wherein tailoring the feature further comprises deploying the virtual security appliance to a network location calculated to receive a subsequent attack.

9. The method of claim 8 , further comprising:

receiving data regarding a subsequent attack on the virtual security appliance after the tailoring; and

tailoring another feature of the virtual security appliance in response to the subsequent attack.

10. The method of claim 8 , further comprising:

deploying another virtual security appliance to another network location calculated to receive another subsequent attack.

11. The method of claim 7 , wherein tailoring the feature is based on targeted ports, targeted services, user agent strings, specific vulnerabilities of the virtual security appliance, and specific versions of services known to be vulnerable on the virtual security appliance.

12. The method of claim 7 , further comprising: querying:

an attack pattern database for the attack pattern data;

an internet scan database for the internet scan data; and

a threat intelligence database for the threat intelligence data.