INTRUSION AND MISUSE DETERRENCE SYSTEM

摘要

A method and apparatus is disclosed for increasing the security of computer networks through the use of an Intrusion and Misuse Deterrence System (IMDS) (65) operating on the network (10). The IMDS is a system that creates a synthetic network complete with synthetic hosts and routers (20). It is comprised of a network server with associated application software that appears to be a legitimate portion of a real network to a network intruder. The IMDS consequently invites inquiry and entices the intruder away from the real network (40). Simulated services are configured to appear to be running on virtual clients (30A-E) with globally unique class "C" IP addresses. Since there are no legitimate users of the virtual network (60) simulated by the IMDS, all such activity must be inappropriate and can be treated as such. Consequently, the entire set of transactions by an intruder can be collected and identified rather than just those transactions that meet a predefined attack profile.