System and method for VoIP honeypot for converged VoIP services
Disclosed herein are systems, methods, and computer-readable storage media for a honeypot addressing cyber threats enabled by convergence of data and communication services in an enterprise network. Suspicious incoming VoIP calls from the Internet to the enterprise network are intercepted and directed to a VoIP honeypot that acts as a network decoy and responds automatically during call sessions for the suspicious incoming VOIP calls while tracing the suspicious incoming VOIP calls. Suspicious outgoing VoIP calls from the enterprise network to the Internet are also intercepted and directed to the VoIP honeypot. Moreover, an unsolicited VoIP call is redirected to the VoIP honeypot when the unsolicited VoIP call has been received by a user agent in the enterprise network and a human user of the user agent confirms that the unsolicited VoIP call was unsolicited.
1. A method comprising:
establishing, at a voice over Internet protocol (VoIP) honeypot in a network, an occupancy schedule for a virtual user agent associated with the VoIP honeypot the VoIP honeypot acting as a decoy;
intercepting an unsolicited incoming VoIP call to the network when the unsolicited incoming VoIP call is addressed to the virtual user agent;
directing the unsolicited incoming VoIP call to a voice mailbox associated with the VoIP honeypot when the occupancy schedule indicates that the virtual user agent is unavailable when the unsolicited incoming VoIP call is received; and
responding, at the VoIP honeypot, to the unsolicited incoming VoIP call during a call session while tracing the unsolicited incoming VoIP call.
2. The method of claim 1 , wherein the unsolicited incoming VoIP call is directed to the voice mailbox when a human user confirms that the unsolicited incoming VoIP call is unsolicited.
3. The method of claim 1 , further comprising responding, at a non-VoIP honeypot in the network, to a client sending a VoIP packet to the VoIP honeypot.
4. The method of claim 1 , further comprising responding, at the VoIP honeypot, to a reference to a non-VoIP resource by sending a request, to a non-VoIP honeypot in the network, for access to the non-VoIP resource.
5. The method of claim 1 , further comprising:
detecting an unsolicited instant message; and
directing the unsolicited instant message to an instant message honeypot that impersonates a human recipient of the instant message by composing and sending an instant message response to the instant message.
6. The method of claim 1 , further comprising detecting that an outgoing VoIP call has been triggered by a user accessing a link contained in an unsolicited email, and directing the outgoing VoIP call to the VoIP honeypot.
7. The method of claim 1 , wherein responding to the unsolicited incoming VoIP call comprises composing and returning a voice response that impersonates a human recipient.
8. The method of claim 1 , further comprising identifying suspicious calls as originating from a common source of unsolicited calls, and compiling statistics of the suspicious calls to identify a call from an unknown source as being likely to have originated from the common source.
9. A system comprising:
a processor; and
a computer-readable storage medium storing instructions which, when executed by the processor, cause the processor to perform operations comprising:
establishing, at a voice over Internet protocol (VoIP) honeypot in a network, an occupancy schedule for a virtual user agent associated with the VoIP honeypot, the VoIP honeypot acting as a decoy;
intercepting an unsolicited incoming VoIP call to the network when the unsolicited incoming VoIP call is addressed to the virtual user agent;
directing the unsolicited incoming VoIP call to a voice mailbox associated with the VoIP honeypot when the occupancy schedule indicates that the virtual user agent is unavailable when the unsolicited incoming VoIP call is received; and
responding, at the VoIP honeypot, to the unsolicited incoming VoIP call during a call session while tracing the unsolicited incoming VoIP call.
10. The system of claim 9 , wherein the unsolicited incoming VoIP call is directed to the voice mailbox when a human user confirms that the unsolicited incoming VoIP call is unsolicited.
11. The system of claim 9 , wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising responding, at a non-VoIP honeypot in the network, to a client sending a VoIP packet to the VoIP honeypot.
12. The system of claim 9 , wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising responding, at the honeypot, to a reference to a non-VoIP resource by sending a request, to a non-VoIP honeypot in the network, for access to the non-VoIP resource.
13. The system of claim 9 , wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising:
detecting an unsolicited instant message; and
directing the unsolicited instant message to an instant message honeypot that impersonates a human recipient of the instant message by composing and sending an instant message response to the instant message.
14. The system of claim 9 , wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising detecting that an outgoing VoIP call has been triggered by a user accessing a link contained in an unsolicited email, and directing the outgoing VoIP call to the VoIP honeypot.
15. The system of claim 9 , wherein responding to the unsolicited incoming VoIP call comprises composing and sending a voice response that impersonates a human recipient.
16. The system of claim 9 , wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising identifying suspicious calls as originating from a common source of unsolicited calls, and compiling statistics of the suspicious calls to identify a call from an unknown source as being likely to have originated from the common source.
17. A computer-readable storage device storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
establishing, at a voice over Internet protocol (VoIP) honeypot in a network, an occupancy schedule for a virtual user agent associated with the VoIP honeypot the VoIP honeypot acting as a decoy;
intercepting an unsolicited incoming VoIP call to the network when the unsolicited incoming VoIP call is addressed to the virtual user agent;
directing the unsolicited incoming VoIP call to a voice mailbox associated with the VoIP honeypot when the occupancy schedule indicates that the virtual user agent is unavailable when the unsolicited incoming VoIP call is received; and
responding, at the VoIP honeypot, to the unsolicited incoming VoIP call during a call session while tracing the unsolicited incoming VoIP call.
18. The computer-readable storage device of claim 17 , wherein the unsolicited incoming VoIP call is directed to the voice mailbox when a human user confirms that the unsolicited incoming VoIP call is unsolicited.