Multilayered Deception for Intrusion Detection and Prevention

摘要

Concepts and technologies are disclosed herein for multilayered deception for intrusion detection. According to various embodiments of the concepts and technologies disclosed herein, a multilayer deception system includes honey servers, honey files and folders, honey databases, and/or honey computers. A multilayer deception system controller generates honey activity between the honey entities and exposes a honey profile with contact information associated with a honey user. Contact directed at the honey user and/or activity at any of the honey entities can trigger alarms and/or indicate an attack, and can be analyzed to prevent future attacks.

主权项

1. A method comprising:
generating, by a processor executing a multilayer deception system controller application, a plurality of honey entities and an instance of honey activity associated with one honey entity of the plurality of honey entities at a private network, the plurality of honey entities including a honey profile for a honey user; exposing, by the processor, the honey profile outside of the private network; detecting, by the processor, an interaction with the one honey entity of the plurality of honey entities; and analyzing, by the processor, the interaction to determine if the interaction corresponds to an attack.