NETWORK INFRASTRUCTURE OBFUSCATION

摘要

A shadow network, which can be a virtual reproduction of a real, physical, base computer network, is described. Shadow networks duplicate the topology, services, host, and network traffic of the base network using shadow hosts, which are low interaction, minimal-resource-using host emulators. The shadow networks are connected to the base network through virtual switches, etc. in order to form a large obfuscated network. When a hacker probes into a host emulator, a more resource-intensive virtual machine can be swapped in to take its place. When a connection is attempted from a host emulator to a physical computer, the a host emulator can step in to take the place of the physical computer, and software defined networking (SDN) can prevent collisions between the duplicated IP addresses. Replicating the shadow networks within the network introduces problems for hackers and allows a system administrator easier ways to identify intrusions.

主权项

1. A method of obfuscating physical computers on a computer network from hackers, the method comprising:
instantiating and initializing a plurality of software-based host emulators, each host emulator configured to respond to an Internet control message protocol (ICMP) echo request packet; obtaining an Internet protocol (IP) address for each host emulator based on a logical topology of the computer network of physical computers; and connecting the host emulators to the computer network over time based on a schedule of connection activations and deactivations of the physical computers on the network and a random number generator, the connecting substantially interleaving the connecting of the host emulators with connection activations of the physical computers.