公开(公告)号：US11233823B1

公开(公告)日：2022-01-25

申请号：US16707578

申请日：2019-12-09

Applicant: Amazon Technologies, Inc.

Inventor： Eknath Venkataramani ,  Daniel J. Miller ,  Swati Kulkarni

IPC: H04L29/06 ,  G06F9/455

Abstract: The present disclosure generally relates to enabling efficient implementation of honeypot devices in a honeypot service environment. Each honeypot device can be implemented as a virtualized device, executing software modified from a production version of a device such that interactions with the honeypot device closely match interactions with a production device. By using virtualization, each honeypot device can be reset to a known good state when a potential security breach occurs. Because network-based attacks are often wide-spread, the honeypot service environment can deduplicate attacks that occur at a large number of devices, discarding duplicate attack traffic to reduce overall load on the environment. While deduplication can be inappropriate for production environments (given the corresponding data loss), deduplication in a honeypot environment can reduce load while still enabling detection of a network attack.