Patent ID: 8949986
Filing Date: 2015-02-03
Classification: H04L

Abstract:
1. A method for a distributed network security system providing a honeypot operation for a computer network, the method comprising: receiving a request from a sender for access to a network at a first endpoint server of a plurality of endpoint servers, each of the plurality of endpoint servers including an endpoint network security element, each of the endpoint network security elements being a part of the distributed network security system, the first endpoint server including a first endpoint network security element; detecting that the request for access to the network includes an unauthorized request; directing the unauthorized request to the first endpoint network security element of the first endpoint server, the first endpoint network security element being operable to emulate a server for purposes of processing of unauthorized requests received by the first endpoint server; generating at the first endpoint network security element an acknowledgement for the unauthorized request, the acknowledgement being sent from the first endpoint network security element to the sender of the request; and generating by the first endpoint network security element a statistic describing the unauthorized request and forwarding the statistic from the first endpoint network security element to a central security server for the network, the central security server operating as a controller for operations of the distributed security system, including the endpoint network security elements of the endpoint servers.