Resilient polymorphic network architectures

1. A method for mutating a network topology on which various containers run, the method comprising:

assigning each of a plurality of hosts on a software defined network (SDN) an unchanging public virtual address that maps to a changing real address;

receiving a mutation policy;

receiving at least one mutation stimulus; and

executing the mutation policy to enact a container mutation, wherein the mutation policy involves a management module in communication with at least one container upholding a mapping from the virtual address of a selected host to the real address of the selected host by issuing an update to an SDN controller upon a virtual-to-real address binding changing,

wherein the container mutation that is enacted is defined by the received mutation policy and meets at least one constraint specified in the mutation policy and is based on the received at least one mutation stimulus, and

wherein the SDN controller services both communications to the virtual address of the selected host and communications to the real address of the selected host.

2. The method of claim 1 wherein the at least one mutation stimulus is generated upon detection of malicious activity.

3. The method of claim 1 wherein the at least one mutation stimulus is generated according to a random, unpredictable schedule.

4. The method of claim 1 , wherein at least one of the real address and the virtual address is defined by an IP address, a name, an IP address and a port combination, or a name and a port combination.

5. The method of claim 1 wherein executing the mutation policy to enact the container mutation includes changing an effective topology aspect of the SDN network.

6. The method of claim 1 wherein the mutation policy involves changing the real address without migrating a container on which a service executes.

7. The method of claim 1 wherein the mutation policy involves migrating a container on which a service executes from a first host to a second host, wherein the real address changes as a result of the container migration.

8. The method of claim 1 wherein executing the mutation policy to enact the container mutation includes:

capturing a state of a container on a first host,

migrating the state of the container to a second host, and

restarting the container on the second host.

9. The method of claim 1 wherein executing the mutation policy to enact the container mutation includes:

injecting a honeypot container into the network, wherein the honeypot container is accessible only by threat actors, and

monitoring all traffic going into the honeypot container.

10. The method of claim 1 wherein the network is a software configurable network.

11. The method of claim 1 wherein the containers are virtual machines.

12. The method of claim 1 further comprising routing traffic from the unchanging virtual address to the real address, wherein a service resides on the real address.

13. The method of claim 1 wherein the at least one mutation stimulus is generated according to a prescribed schedule.

14. A system for mutating a network topology of a single network on which various containers run, the system comprising:

at least one processor executing instructions stored on memory to provide:

a host controller configured to assign each of a plurality of hosts on a software defined network (SDN) au unchanging public virtual address that maps to a changing real address;

a threat detection module configured to detect at least one mutation stimulus; and

a management module in communication with at least one container configured to:

receive a mutation policy, and

execute the mutation policy to enact a container mutation upon the threat detection module detecting the mutation stimulus, wherein the mutation policy involves the management module upholding a mapping from the virtual address of a selected host to the real address of the selected host-by issuing an update to SDN controller upon a virtual-to-real-address binding changing,

wherein the container mutation that is enacted is defined by the received mutation policy and meets at least one constraint specified in the mutation policy and is based on the detected at least one mutation stimulus, and

wherein the SDN controller services both communications to the virtual address of the selected host and communications to the real address of the selected host.

15. The system of claim 14 wherein the at least one mutation stimulus is generated upon detection of malicious activity.

16. The system of claim 14 wherein the at least one mutation stimulus is generated according to a random, unpredictable schedule.

17. The system of claim 14 wherein at least one of the real address and virtual address is defined by an IP address, a name, an IP address and a port combination, or a name and a port combination.

18. The system of claim 14 wherein the containers are virtual machines.

19. The system of claim 14 wherein the containers are Docker containers.

20. A method for mutating a network topology of a single network on which various containers run, the method comprising:

assigning each of a plurality of hosts on a software defined network (SDN) an unchanging public virtual address that maps to a changing real address;

receiving a mutation policy;

receiving at least one mutation stimulus; and

executing the mutation policy to enact a container mutation by a management module in communication with at least one container,

wherein the container mutation that is enacted is defined by the received mutation policy and meets at least one constraint specified in the mutation policy and is based on the received at least one mutation stimulus, and

wherein an SDN controller services both communications to the virtual address of the selected host and communications to the real address of the selected host mutation policy involves:

morphing an application on a first container into a honeypot application so that the first container becomes a honeypot container,

monitoring traffic received by the honeypot container, and

starting on a second container, a second application that was previously executing on the first container.