Reactive and pre-emptive security system for the protection of computer networks systems

摘要

The invention provides mechanisms for enhancing the security and protection of a computer-based system or network. It relates, in part, to the use of a decoy (which may be termed "honeypot" or "honeynet") for collecting attacker-related data, and/or diverting malicious behaviour away from legitimate resources. In one embodiment, the invention provides a method comprising the steps of receiving, processing and logging network traffic data of a plurality of users, where the network traffic is received from a plurality of participating users; determining an attacker profile from the network traffic data; determining a honeypot or honeynet configuration based on the attacker profile; and upon receipt of a valid information request from a user of the plurality of users, providing the determined attacker profile and configuration to the user. Additionally or alternatively, it may provide a computer-implemented method comprising the steps of receiving, processing and logging network traffic data; based on processed network traffic data: determining that network traffic originates from an attacker, determining a risk classification; and determining a decoy configuration based on the risk classification; upon receipt of a valid information request from a user, providing the determined risk classification and decoy configuration to the user.