Amazon Technologies, Inc.

Dennis Naylor Brown, Jr

Volker Helmut Mosthaf

Eric Dawson LaMothe

Horizontal port scanning enables an attacker to gain information about the services running on a host computer system and/or about the users of the computer system so that the subsequent attacks can be targeted to those services and/or those users. A horizontal port scanning detection system enables a network administrator to use a system of cascading ring buffers to maximize network resources to detect attackers. The horizontal port scanning system employs a series of ring buffers, where each ring buffer is associated with a specific port and each cascade of ring buffers is associated with a specific source. As communications requests are received, the destination address is stored in the ring buffer associated with the requested port and a process is run across each ring buffer, such that when a threshold is passed, an alarm is raised.

Horizontal scan detection

Disclosed are various embodiments for virtualized network honeypots. Network traffic is received from a connecting device. It is determined whether the network traffic is authorized or unauthorized. The network traffic is selectively routed to a requested network service or to a honeypot server based at least in part on whether the network traffic is authorized or unauthorized.

Virtualized network honeypots

Disclosed are various embodiments for virtualized network honeypots. In one embodiment, client computing devices that are coupled to a network are each configured with both a primary operating system and a honeypot operating system. The primary operating system is configured to provide workstation functionality for a user having permission, and the honeypot operating system is configured to route unauthorized network traffic to a honeypot server. The honeypot server is configured to provide a honeypot environment that mimics characteristics of client or server computing devices.

Disclosed are various embodiments for virtualized network honeypots. In one embodiment, client computing devices that are coupled to a network are each configured with both a primary host and a secondary virtualized host. The primary host provides workstation functionality for users having permission. The secondary virtualized host is configured to route network traffic to and from a honeypot server. The honeypot server is configured to provide a honeypot environment. In another embodiment, a network connection request for a requested service is received from a connecting device. If the connecting device is authorized, the network connection request is routed to the requested service. If the connecting device is not authorized, the network connection request is routed to a honeypot server.

Growing community of inventors

Seattle, WA, United States of America

Dennis Naylor Brown, Jr