Honeypot Link Detection for Automated Site Scan Origin Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting automated site scans and identifying their origin is challenging, especially in heavy traffic websites, due to high false negatives and false positives, and tracing the origin of attacks from multiple sources is nearly impossible.
Innovation Solution
Implementing honeypot links on a server that generate a session ID for computers selecting these links, displaying data after an artificial delay, and comparing selected links with attack targets to determine the attack origin.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If automated site scan detection is implemented in heavy traffic websites, then the ability to identify attack precursors is improved, but false positives and false negatives increase
Solution Approach 1:
The system segments traffic analysis into multiple independent detection layers: honeypot link selection detection, session ID tracking, artificial delay measurement, and attack pattern comparison. Each layer independently evaluates specific aspects of traffic behavior, allowing the system to maintain high detection precision while reducing false positives through cumulative evidence rather than relying on a single threshold-based decision.
Solution Approach 2:
The system introduces session IDs as intermediary identifiers that bridge honeypot link selections and subsequent attack detection. These session IDs act as mediators that track computer behavior across multiple interactions without requiring direct real-time analysis of every request, thereby reducing the computational burden and false positive rates while maintaining detection accuracy.
2Difficulty of detecting and measuring
If honeypot links are deployed to detect automated scans, then the ability to identify scan origins is improved, but system complexity increases
Solution Approach 1:
The honeypot links serve multiple functions simultaneously: they act as detection traps for automated scanners, generate session IDs for tracking, provide artificial delays for timing analysis, and serve as comparison points for attack pattern matching. This multi-functionality reduces the need for separate detection mechanisms, thereby managing system complexity while improving scan origin identification capabilities.
Solution Approach 2:
The system creates simplified copies of legitimate website links as honeypot traps. These honeypot links mirror the structure and appearance of real links but lead to detection mechanisms instead of actual content. This copying approach allows the system to identify scan origins without requiring complex analysis of every user interaction, maintaining simplicity while enhancing detection capability.
3Loss of information
If session tracking is implemented to link scans to attacks, then the ability to trace attack origins is improved, but data storage requirements increase
Solution Approach 1:
The system extracts only the essential identifying information from session data - specifically the session ID and associated honeypot link selections - and stores only this minimal necessary information. By extracting and storing only the critical traceability elements rather than complete session records, the system maintains full attack origin traceability while minimizing data storage requirements.
Solution Approach 2:
The system applies different data retention strategies to different types of information: session IDs and honeypot selection patterns are stored long-term for traceability, while detailed request parameters and temporary session data are discarded after use. This local quality differentiation ensures attack origin traceability is maintained for critical identifiers while reducing overall storage requirements by eliminating redundant data.
Data Source
AI summary
Automated site scans are often seen as precursors to a cyber attack, from URI enumeration and version mapping to timing scans used to identify the most valuable DDoS targets. Disclosed are methods and apparatuses for detecting automated site scans and identifying the source of cyber attacks. Honeypot links are provided on a web page via a server. If multiple honeypot links are selected by a visitor of the web page, the server may identify the visitor as an automated system and generate a session ID. The server induces an artificial delay prior to displaying the data associated with the selected honeypot link. After a subsequent attack, the server is able to identify the attacker by association with the stored session ID of an automated site scan.