Honeypot Pages for Directory Enumeration Protection
Solution Overview
Problem
Service providers face challenges in detecting and protecting against directory enumeration attempts by malicious actors within internal networks, which can lead to exposure of sensitive data and potential data breaches.
Innovation Solution
Deploying honeypot pages and files within directories to confuse and mislead directory enumeration attempts by returning altered status codes and byte sizes, while also logging information about the malicious devices attempting to access these pages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If honeypot pages are deployed within directories to prevent directory enumeration, then the security against directory enumeration is improved, but the device complexity increases
Solution Approach 1:
The patent creates fake honeypot pages that copy the structure and appearance of legitimate files and directories. These decoy elements mimic real resources (e.g., fake config files, database tables, or directory listings) to confuse attackers during enumeration scans. The honeypot pages replicate the visual and structural characteristics of actual resources while containing misleading or dummy content, causing attackers to waste time investigating false positives instead of finding real vulnerabilities.
Solution Approach 2:
The patent introduces honeypot pages as intermediary elements between the attacker and the actual vulnerable resources. These fake resources act as a buffer or mediator that intercepts enumeration attempts, absorbing the attacker's scanning efforts before they can reach legitimate targets. The honeypot pages serve as a protective layer that translates direct attacks on real resources into redirected attempts at dummy alternatives, thereby reducing the effectiveness of directory enumeration while maintaining network security architecture.
2Difficulty of detecting and measuring
If honeypot pages are deployed to confuse directory enumeration attempts, then the detection capability is improved, but the loss of time increases
Solution Approach 1:
The patent converts the harmful enumeration scanning process into a beneficial detection mechanism by deploying honeypot pages that actively participate in the scan. Instead of passively blocking requests, the honeypot pages return misleading information (such as fake file sizes, incorrect modification dates, or dummy directory listings) that appear legitimate to automated scanners. This transforms the attacker's time-consuming enumeration process into an extended detection period, where each scan iteration reveals more false leads while consuming additional time and resources from the attacker.
Solution Approach 2:
The patent implements preliminary deployment of honeypot pages throughout the network directory structure before actual attacks occur. These pre-positioned fake resources are strategically placed in common attack paths and high-value directories to intercept enumeration attempts early in the attack lifecycle. By having the honeypot pages ready in advance, the system can immediately confuse and delay attackers without waiting for detection, thereby reducing the overall time required for successful compromise while maintaining high detection capability.
Data Source
AI summary
There are provided systems and methods for protecting from directory enumeration using honeypot pages within a network directory. A service provider, such as an electronic transaction processor for digital transactions, may have an internal network that is utilized by employees, developers, and other end users within the organization of the service provider. When internal devices become compromised or internal users act maliciously, they may attempt to enumerate a directory to find hidden pages that have secret or sensitive data. The service provider may therefore detect a scan of an internal directory having files paths to files and pages and may deploy honeypot pages that change an error status. Further, the service provider may add a process or operation to log additional data on these honeypot pages and/or change a byte size of the corresponding pages to confuse the enumeration attempt and obtain true source information.