Honeypot System for Brute Force Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Brute force attacks on computer networks consume significant resources and are difficult to stop as attackers can change their IP addresses, making it challenging to effectively block the attacks.
Innovation Solution
A system and method that detect brute force attacks by creating a honeypot with simulated secret information and updating its state based on simulated activity, redirecting the attack to the honeypot and limiting resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blocking methods are used to stop brute force attacks, then the attack can be temporarily halted, but the attacker can simply change IP addresses and continue the attack
Solution Approach 1:
The patent introduces a honeypot system as an intermediary between the attacker and the real system. The honeypot contains simulated secret information that attracts and engages the attacker, while the real system remains protected. This mediator absorbs the attack without compromising the actual target.
Solution Approach 2:
The patent creates a copy of the secret information (honeypot credentials) that mimics the real secret information. The honeypot contains fabricated usernames and passwords that appear legitimate to the attacker, redirecting the brute force attack away from the real system while consuming the attacker's resources.
2Reliability
If brute force attacks are allowed to continue, then the attacker may eventually gain access, but significant network resources are consumed throughout the attack process
Solution Approach 1:
The patent extracts the harmful resource consumption from the real system by redirecting it to a honeypot. The honeypot is designed to absorb the brute force attack attempts, isolating the resource consumption to a controlled environment that does not impact the real system's performance or security.
Solution Approach 2:
The honeypot uses inexpensive, easily replaceable simulated credentials that can be quickly updated or regenerated. When the honeypot credentials are compromised, new fake credentials can be generated without significant cost or effort, maintaining the trap's effectiveness while minimizing resource investment.
Data Source
AI summary
As described herein, a system, method, and computer program are provided for an unattended trap for a brute force attack. A brute force attack on private data in a computer network is detected. Secret information expected by the brute force attack is generated. At least one honeypot having the secret information is created in the computer network. A state of the at least one honeypot is updated based on simulated activity.