Patent Description:
"Honeypots" are one mechanism that can be used to study and detect attackers as well as attack patterns. Honeypots are computing systems or resources that are not meant to be used by ordinary non-malicious users. Instead, they are designed to attract cyber attackers to launch cyberattacks. Honeypots, however, require additional computing resources to build and maintain. For example, a honeypot builder might be required to acquire and use additional cloud resources to host honeypots. These honeypots would need to use additional network bandwidth for their activities so that they appear to attackers to be ordinary computing resources. Honeypots might also pose security risks on third-party resources that are co-located on the same computing device as the honeypots.

<CIT> describes that a method for assessing security posture for entities in a computing, network is implemented on a computing device and includes: receiving behavior data from one or more of the entities, where the behavior data is associated with at least activity on the computing network by the one or more entities, calculating a risk score for at least one of the entities by comparing the behavior data with a classification model, where the classification model represents at least a baseline for normative network behavior by the entities in a computing network, assessing a security posture for the at least one the entities based on the risk score, and allocating network security resources to the at least one of the entities at least in accordance with the security posture.

<CIT> describes approaches for providing security in a networked computing environment. The method includes detecting, by at least one computer device, a breach of a first system in the networked computing environment. The method also includes identifying a second system in the in the networked computing environment as an at-risk system based on a proximity of the second system to the first system. The method additionally includes re-generating, by the at least one computer device, the second system as a new system at a new location in the networked computing environment. The method further includes converting, by the at least one computer device, the second system to a decoy system.

<NPL> describes the great advance in attacks against network has led to outgrowth of interest in more aggressive forms of defense to supplement the existing security approaches. One of these techniques involves the use of the deception to collect information about attacks. A honeypot is a security deception resource whose value lies in being probed, attacked or compromised. In the paper the authors present an overview of techniques used by honeypots to deceive the attacker and attacking process, and provide a comparison for persons who are interested in study and developing this new technology. They examine various types of honeypots, and deception techniques they use to counter attacks.

The techniques disclosed herein enable systems to detect network attacks and vulnerable network resources utilizing existing network resources. For example, ordinary network resources (i.e. non-honeypots) that are vulnerable to attack can be utilized as virtual honeypots. Activity patterns that are unique to the ordinary resources, but not other well-protected resources, can be used to identify attack patterns against network resources. The techniques disclosed herein can improve the security of network resources by detecting vulnerable network resources, recognizing attack patterns and taking actions to reduce the risk of further attacks. In addition, by utilizing virtual honeypots, rather than real honeypots, computing resources, such as CPU time, memory usage and network bandwidth can also be saved because there is no need to operate additional network resources apart from the real network resources.

More specifically, implementations of the techniques described herein can build and train a vulnerability model for predicting the vulnerability of network resources. The training of the vulnerability model can be performed using a set of training examples. The training examples can be collected by using initial vulnerability scores and activity data for the network resources. The initial vulnerability scores can be calculated based on configuration data associated with the network resources, such as the security configuration of the network resources. The activity data of the network resources can include activity data. such as the network traffic coming into or going out of the network resources or data identifying activities that occurred on the network resources. The activity data can be used as input and the initial vulnerability scores can be used as labels for training the vulnerability model.

Once the vulnerability model has been trained, new activity data can be monitored and collected from the network resources. The new activity data can then be used as input to the vulnerability model to generate updated vulnerability scores for the network resources. Because the updated vulnerability scores are calculated based upon the new activity data, the updated vulnerability scores can be considered predicted vulnerability scores indicating the vulnerability of the corresponding network resources in their current network environment.

Based on the predicted vulnerability scores, vulnerable network resources can be identified, and activities associated with the vulnerable network resources can be compared with activities of other secure network resources to identify activity patterns that are unique to the vulnerable network resources. These unique activity patterns represent the attack patterns of the attackers and can be analyzed to provide insights in understanding the nature of the attack itself and the attackers who launched the attack. In addition, one or more actions can be taken to increase the security of the vulnerable network resources. For example, the vulnerable network resources can be taken offline, or shut down. Alternatively, or additionally, a warning message can be sent to the administrators or owners of the network resources to inform them about the vulnerability of the network resources as well as the attack patterns. The vulnerability of the network resources and the attack patterns can facilitate the administrators of the network resources to take proper actions, such as reconfigure the network resources, to strengthen the security of the network resources.

This Summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. The term "techniques," for instance, may refer to system(s), method(s), computer-readable instructions, module(s), algorithms, hardware logic, and/or operation(s) as permitted by the context described above and throughout the document.

The following Detailed Description discloses techniques and technologies for identifying vulnerable network resources and detecting attack patterns on network resources by utilizing virtual honeypots. The virtual honeypots can include pre-existing network resources that are poorly configured in terms of their security so that these network resources are vulnerable to cyberattacks. The virtual honeypots are real network resources and thus do not consume extra resources associated with a real honeypot, such as CPU time, memory spaces, network bandwidth, etc. However, the pre-existing vulnerability of the virtual honeypots can attract attackers just like real honeypots. Analyzing the activities associated with virtual honeypots can reveal information about the cyberattacks and the attackers and be utilized to strengthen the security of network resources.

More specifically, one or more security servers can collect data about network resources and generate an initial vulnerability score for each of the network resources. The security servers can further observe activity data associated with the network resources, such as the network traffic data, process creation data, and/or query data of the network resources. The initial vulnerability scores and the activity data can be utilized to build and train a vulnerability model for predicting the vulnerability of the network resources.

After the vulnerability model has been trained, the vulnerability model can accept new activity data associated with the network resources as input, and output vulnerability scores for the network resources as a prediction of their respective vulnerabilities in the current network environment. One or more vulnerable network resources can then be identified based on the predicted vulnerability scores.

Activities associated with vulnerable network resources can then be compared to activities associated with other secure network resources to identify attack patterns that are unique to the vulnerable network resources. Because the attack patterns have been found to be associated with the vulnerable network resources, it can be determined that the vulnerable network resources have been compromised, that actions need to be taken in order to prevent further attacks, and the type of actions that need to be taken to improve the security of the vulnerable network resources. For example, these network resources can be taken offline or shut down. In addition, warning messages can be sent to the administrators or owners of the network resources to inform them about the compromise, the vulnerability of the network resources as well as the attack pattern. The vulnerable network resources and other network resources can also be re-configured to improve their security.

The techniques disclosed herein can improve the security of the network resources by detecting vulnerable network resources, recognizing attack patterns and initiating actions to reduce the risk of further attacks. In addition, the techniques disclosed herein eliminate the need of building real honeypots thereby eliminating the consumption of resources, such as CPU time, memory space and network bandwidth, associated with building and maintaining real honeypots.

It should be appreciated that the above-described subject matter may be implemented as a computer-controlled apparatus, a computer process, a computing system, or as an article of manufacture such as a computer-readable storage medium. While the subject matter described herein is presented in the general context of program modules that execute in conjunction with the execution of an operating system and application programs on a computer system, those skilled in the art will recognize that other implementations may be performed in combination with other types of program modules. Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that the subject matter described herein may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and the like.

In the following detailed description, references are made to the accompanying drawings that form a part hereof, and in which are shown by way of illustration specific configurations or examples. Referring now to the drawings, in which like numerals represent like elements throughout the several figures, aspects of a computing system, computer-readable storage medium, and computer-implemented methodologies for determining qualified contributors of a document are presented.

Referring now to <FIG>, a system <NUM> is provided to illustrate aspects of the present disclosure. In this example, a system <NUM> can include one or more security servers <NUM>. The security servers <NUM> may represent one or more conventional server computers, Web servers, database servers, or network appliances. Alternatively, the security servers <NUM> may represent a user computing device, such as a personal computer ("PC"), a desktop workstation, a laptop, a notebook, a mobile device and the like.

The security servers <NUM> can be configured to include a security evaluation module <NUM> for evaluating the security or vulnerability of one or more network resources 104A-104D (which may be referred to herein individually as a network resource <NUM> or collectively as the network resources <NUM>). The network resources <NUM> can include various server computers, such as conventional server computers, Web servers, database servers, or network appliances. In addition, the network resources <NUM> may also include user computing devices, such as a PC, a desktop workstation, a laptop, a notebook, a mobile computing device and the like. The network resources <NUM> may also include virtual machines executing on one or more physical servers. The network resources <NUM> can communicate with the security servers <NUM> over a network <NUM>, which might be a local-area network ("LAN"), a wide-area network ("WAN"), the Internet, or any type of data communications network known in the art that enables communications with the security servers <NUM>.

In one scenario, the security servers <NUM> can be hosted by a cloud service provider configured to provide network resources <NUM>, such as virtual machines, to various users. The users can utilize the network resources <NUM> to meet their respective needs, such as providing an online service to customers or employees. For example, a company might choose to acquire a network resource <NUM> from the cloud service provider to host a company server so that employees of the company can log into the server remotely for work-related purposes. However, the network resource <NUM> might not be properly configured, thereby making it vulnerable to cyberattacks. For example, an administrator of the network resources <NUM> for the company might have failed to configure a firewall for the network resource <NUM> and permitted access to the network resources <NUM> using default usernames and passwords. As a result, this network resource <NUM> is more likely to be compromised by cyberattacks than other properly configured network resources <NUM>.

For instance, an attacker <NUM> might try to gain access to the network resources <NUM> by "cracking" a user's password. The attacker <NUM> can run programs on its own device to use many methods to access accounts. For example, the attacker <NUM> can use brute force attacks to guess the password or compare various word combinations against a dictionary file to obtain the password. In such an attack, the network resources <NUM> having a weak password configuration, such as network resource 104A shown in <FIG> in a shaded block, will likely be compromised by the attack and the attacker <NUM> can gain access to the network resource 104A. After gaining access to the network resource 104A, the attacker <NUM> can perform various actions on the network resource 104A, including the possibility of gaining access to other network resources <NUM>.

As an example, the attacker <NUM> can install malware or other types of malicious software on the network resource 104A to instruct the network resource 104A to communicate with and execute commands from a network server <NUM> under the control of the attacker <NUM>, such as a command and control server. This compromised network resource 104A can cause further damage to the network resources <NUM> on the network, such as collecting sensitive information or distributing spam. It should be noted that the above example is merely illustrative and should not be construed as limiting. Various other types of attacks can be launched by the attacker <NUM> and can be detect by the technologies presented herein.

To identify the vulnerable network resource 104A, the security servers <NUM> can be employed to implement a security evaluation module <NUM> that evaluates the vulnerability of the network resources <NUM>. The security servers <NUM> can monitor the network resources <NUM> by receiving activity data <NUM> from each of the network resources <NUM>. The activity data <NUM> can include dynamic information about the network resources <NUM>, such as inbound and outbound network traffic of the network resources <NUM>. The network traffic of a network resource <NUM> can indicate suspicious behavior by the network resources <NUM>, thereby indicating that the network resources <NUM> might have been compromised. For example, the outbound network traffic of the network resource 104A might show that the network resource 104A constantly communicates with a control and command server or an unknown IP address. In another example, the network traffic of the network resource 104A might show that it has sent a large number of domain name server ("DNS") requests to a DNS server within a short period of time.

In addition to network traffic, process creation data describing the activity of creating new processes on the network resources <NUM> can also be helpful in identifying vulnerable and compromised network resources <NUM> and be included in the activity data <NUM>. For example, malware installed on the compromised network resource 104A might have caused the network resource 104A to create many processes in order to carry out various malicious tasks. Such a high volume of process creation activities can be utilized to identify the vulnerability of the network resources <NUM>. Similarly, other activities occurring on the network resources <NUM>, such as performing queries, are also indicative of a network resource <NUM> that has been compromised and can be included in the activity data <NUM>. It should be understood that the activities of the network resources described above are provided by way of illustration only and should not be construed as limiting. Data describing any type of activity associated with the operation of network resources can be utilized herein for predicting the vulnerability of the network resources.

The obtained activity data <NUM> can be utilized by the security evaluation module <NUM> to train a vulnerability model <NUM>. The vulnerability model <NUM> can be any machine learning model suitable for predicting outcomes based on a set of input features. For example, the vulnerability model <NUM> can be an artificial neural network ("ANN") model trained to predict the vulnerability of network resources <NUM> by considering examples of vulnerability of the network resources <NUM> and without being programmed with any task-specific rules.

The vulnerability model <NUM> can be trained before it is used to predict the vulnerability of the network resources <NUM>. The training can be performed by generating a set of initial vulnerability scores <NUM> for the network resources <NUM> as the examples of the vulnerability of the network resources <NUM> and for labeling activity data <NUM> collected from the network resources <NUM>. The initial vulnerability scores <NUM> can be determined based on configuration data of the network resources <NUM>, such as the security configuration of the network resources <NUM> including the setup of a firewall, the strength of user passwords, the number of users, etc..

Once the vulnerability model <NUM> is trained, the security evaluation module <NUM> can obtain new activity data <NUM> from the network resources <NUM> and use the new activity data <NUM> as an input to the vulnerability model <NUM> to predict the vulnerability of the network resources <NUM>. Additional details regarding the training and operation of the vulnerability model <NUM> will be provided below with regard to <FIG>.

In some implementations, the predicted vulnerability of a network resource <NUM> is quantified as a vulnerability score <NUM> for the network resource <NUM>. In some configurations, the higher the vulnerability score <NUM> of a network resource <NUM> is, the more vulnerable the network resource <NUM> is and the higher likelihood that the network resource <NUM> has been compromised. Likewise, the lower the vulnerability score <NUM> of a network resource <NUM> is, the less vulnerable the network resource <NUM> is and the lower likelihood that the network resource <NUM> has been compromised.

The security evaluation module <NUM> can choose a mechanism to identify the vulnerable network resources <NUM> based on the vulnerability scores <NUM>. For example, the security evaluation module <NUM> can determine that the network resources <NUM> whose vulnerability scores <NUM> are higher than a threshold value can be considered as vulnerable and have been compromised. It should be noted that the technologies presented herein analyze activities of the network resources <NUM> to identify vulnerable network resources <NUM>. A network resource <NUM> typically perform suspicious activities after being compromised. As such, it is highly likely that the identified vulnerable network resources <NUM> have already been compromised. Accordingly, network resources <NUM> that have been identified as vulnerable and those network resources <NUM> that have actually been compromised are used interchangeably in this application.

In addition to the vulnerable network resources <NUM>, the output of the vulnerability model <NUM> can also be useful in analyzing the attacks and the attacker <NUM>. As discussed above, vulnerable network resources <NUM>, i.e. the virtual honeypots, act similarly to real honeypots and, as a result, are likely to attract attackers <NUM>. As such, analyzing the activities associated with the virtual honeypots can reveal the nature of the attacks. Specifically, the activity data <NUM> for the identified compromised network resources <NUM>, i.e. the virtual honeypots, can be summarized and compared with the activity data <NUM> of the uncompromised network resources <NUM>. Those activity patterns that are unique to the compromised network resources <NUM> can indicate an attack pattern and can be analyzed to provide helpful insights in understanding the attack itself, the attacker <NUM> who launched the attack, and changes that can be made to the network resource <NUM> to prevent a similar attack in the future.

Once the compromised network resources <NUM> have been identified, one or more actions can be taken to avoid further attacks on the compromised network resources <NUM> and to increase the security of the compromised network resources <NUM>. For example, the security servers <NUM> can send an instruction <NUM> to the compromised network resource 104A to have the compromised network resources <NUM> be turned off or taken offline to eliminate further network traffic. Alternatively, or additionally, a warning message <NUM> can be sent to the administrators or owners of the network resources <NUM> to inform them about the vulnerability of the network resources <NUM> as well as the attack pattern <NUM> and recommend remedial actions to be taken to avoid further attacks, such as reconfiguring the compromised network resources and other network resources in a proper way to strengthen their security. Additional details regarding the identification of vulnerable network resources <NUM> will be provided below with regard to <FIG>.

It should be noted that in some scenarios, such as a cloud service provider hosting the security servers <NUM>, the cloud service provider can reserve the right to access the configuration data and activity data of the network resources <NUM> for security monitoring and improvement purposes. In other scenarios where the entity hosting the security servers <NUM> does not have the right to access the data of the network resources <NUM>, the owners or administrators of the network resources <NUM> can grant permission for the security servers <NUM> to obtain such activity data <NUM>. For example, the administrator or owner of the network resources <NUM> can subscribe to security evaluation services provided by the security servers <NUM> and grant permission to access the configuration data or activity data along with the subscription. It should be appreciated that although the above disclosures describe a cloud service provider hosting the security servers <NUM>, the security servers <NUM> can be hosted and managed by any entity that would like to monitor and improve the security of network resources.

Referring now to <FIG>, where the training and testing of the vulnerability model <NUM> is illustrated. As discussed briefly above, the vulnerability model <NUM> is configured to map activity data <NUM> of a network resource <NUM> to a vulnerability score <NUM>. In other words, the vulnerability model <NUM> can classify each of the network resources <NUM>, based on its activity data <NUM>, into a class represented by the predicted vulnerability score <NUM>. As a result, when new activity data <NUM> is collected for a network resource <NUM>, the vulnerability model <NUM> can predict the vulnerability score <NUM> of the network resource <NUM> based on the new activity data <NUM>.

There are two stages associated with the vulnerability model <NUM>: a training stage and a production stage, also called a testing stage. During the training stage, the vulnerability model <NUM> can learn to predict the vulnerability of network resources <NUM> by considering examples of vulnerability of the network resources <NUM>. In one implementation, supervised training is performed on the vulnerability model <NUM>. During supervised training, the vulnerability model <NUM> is provided with a set of training examples, each training example including an input-output pair: input activity data <NUM> of a network resource <NUM> and a predicted vulnerability score of the network resource <NUM>. The training algorithm can analyze the training data and produce an inferred function for mapping the inputs to the outputs. The inferred function can be reflected in the weights used by the vulnerability model <NUM>.

In order to generate the training examples, the security evaluation module <NUM> can calculate an initial vulnerability score <NUM> for each of the network resources <NUM> as the output vulnerability score in the training examples. The initial vulnerability scores <NUM> can be calculated by employing a vulnerability score estimator <NUM> implementing any vulnerability score estimation method known in the art. For example, the vulnerability score estimator <NUM> can calculate the initial vulnerability scores <NUM> based on configuration data <NUM> associated with the network resources <NUM>, such as the security configuration of the network resources <NUM> including data indicating whether a firewall has been configured for a network resource, the strength of user passwords, the number of users, etc..

The input activity data <NUM> in the training examples can be obtained by collecting the current activity data <NUM> from the network resources <NUM>. In some implementations, the activity data <NUM> for each network resource <NUM> can be converted into a set of dynamic resource features <NUM> before being applied onto the vulnerability model <NUM> for training. The dynamic resource features <NUM> can include the aspects of the activity data <NUM> that the designer of the vulnerability model <NUM> deems important in predicting the vulnerability of the network resources <NUM>. In other implementations, the dynamic resource features <NUM> can include all aspects of the activity data <NUM>, and the vulnerability model <NUM> can determine the important aspects of the activity data <NUM> during training. In addition, the dynamic resource features <NUM> can be generated in a format that is suitable for the vulnerability model <NUM>, such as a vector or a matrix of values representing the relevant activities.

After the training stage is complete, the vulnerability model <NUM> can be used in the production stage to perform the task of predicting vulnerability scores of the network resources <NUM>. During the production stage, new activity data <NUM> can be collected from the network resources <NUM>, which can be converted to dynamic resource features <NUM> in the same way as in the training stage. The vulnerability model <NUM> can take the new dynamic resource features <NUM> as input and output the predicted vulnerability score <NUM> for each of the network resources <NUM>.

Vulnerable network resources <NUM> can then be identified based on the vulnerability scores <NUM>. For example, the security evaluation module <NUM> can determine that the network resources <NUM> whose vulnerability score <NUM> is higher than a threshold value can be considered a vulnerable network resource <NUM>. In addition, the activity data <NUM> associated with the vulnerable network resources <NUM> can be analyzed and compared with the activity data <NUM> of well-protected network resources <NUM> to identify activity patterns that are unique to the vulnerable network resources <NUM>. These unique activity patterns can identify the attack pattern <NUM> of the attacker and can be analyzed to provide helpful insights in understanding the attack itself and the attackers who launched the attack. The unique activity patterns can also be helpful in reconfiguring the network resources to strengthen their security.

It should be understood that while in the above description, the initial vulnerability scores <NUM> are determined based on configuration data <NUM> associated with the network resources <NUM>, the initial vulnerability scores <NUM> can be determined in other ways, such as by using both the configuration data <NUM> and the activity data <NUM> or using the activity data <NUM> alone. It should be further appreciated that while above description focuses on supervised training, unsupervised training of the vulnerability model <NUM> can also be utilized. In addition, the training stage and production stage of the vulnerability model <NUM> are described merely for illustration purposes and should not be construed as limiting. The mechanisms of building and utilization of a vulnerability model <NUM> that do not involve separate training and production stages can also be employed herein to predict the vulnerability of the network resources <NUM>.

Referring now to the example shown in <FIG>, where a security server <NUM> monitors the vulnerability of five network resources 104A - 104E, namely, NR1, NR2, NR3, NR4 and NR5. In this example, an attacker <NUM> might have tried to attack the five network resources to gain access to the network resources <NUM>. In order to improve the security of these resources, the security server <NUM> can first collect activity data <NUM> from the five network resources <NUM> as the input data for training the vulnerability model <NUM>. In addition, the security server <NUM> can also collect configuration data <NUM> from each of five network resources <NUM> to generate the initial vulnerability scores <NUM> as the output data in the training examples.

In the example shown in <FIG>, the values of the initial vulnerability scores <NUM>, VS_0, fall between <NUM> and <NUM>, with <NUM> representing no risk of the network resource being vulnerable and <NUM> representing highest risk of being vulnerable. In <FIG>, The initial vulnerability score <NUM> for NR1 is <NUM> indicating a high likelihood of NR1 being vulnerable. The initial vulnerability score <NUM> for NR2 is <NUM> indicating a low likelihood of NR2 being vulnerable. The initial vulnerability scores <NUM> for NR3, NR4 and NR5 are <NUM>, <NUM> and <NUM>, respectively, each indicating a low likelihood of the respective network resource <NUM> being vulnerable.

After the training of the vulnerability model <NUM> is complete, new activity data <NUM> can be collected from the five network resources <NUM>, and the vulnerability model <NUM> can be utilized to predict the vulnerability of the five network resources <NUM> based on the new activity data <NUM>. <FIG> illustrates the predicted vulnerability scores, VS_P, for each of the five network resources <NUM>. As can be seen from <FIG>, the predicted vulnerability score <NUM> of NR1 is high, which is consistent with its initial vulnerability score <NUM>. Similarly, the predicted vulnerability scores <NUM> for NR3, NR4, and NR5 are relatively low, which is also consistent with their respective initial vulnerability scores <NUM>. The predicted vulnerability score <NUM> for NR2, however, is much higher than its initial vulnerability score <NUM>.

One of the reasons for the discrepancies between the initial vulnerability score <NUM> and the predicted vulnerability scores <NUM> is that they are determined based on different aspects of the network resources <NUM>. In the above example, the initial vulnerability scores <NUM> are determined based on the configuration data <NUM> of the network resources <NUM>, such as the security configuration, whereas the vulnerability scores <NUM> are determined based on the activity data of the network resources <NUM>, such as network traffic and/or process creation data of the network resources <NUM>. In practice, a network resource <NUM> that is properly configured in terms of security might nonetheless be successfully attacked and compromised by the attacker <NUM>. As such, a properly configured network resource <NUM> can have a low initial vulnerability score <NUM>, but a high predicted vulnerability score <NUM>. This illustrates one advantage of the technologies presented herein over the existing methods for estimating the vulnerability scores <NUM>, that is, the technologies presented herein for predicting the vulnerability can evolve as conditions change and can successfully identify compromised network resources <NUM> regardless of their initial vulnerability scores.

Based on the predicted vulnerability scores <NUM>, the security evaluation module <NUM> can determine that NR1 and NR2 are compromised vulnerable network resources <NUM> and can then analyze the activity data <NUM> associated with NR1 and NR2 to identify unique activity patterns for NR1 and NR2. The analysis can show that both NR1 and NR2 have been communicating with an unknown IP address <NUM> at a high frequency, such as sending a large number of requests <NUM> to the unknown IP address <NUM> over a short time period. Other network resources, NR3 - NR5, are not performing activities. The security evaluation module <NUM> can then determine that the attack pattern <NUM> for the current attacker includes frequent communications the same unknown IP address. The security evaluation module <NUM> can further label the unknown IP address as a suspicious or malicious IP address.

The security evaluation module <NUM> can further identify measures to be implemented in order to reduce the likelihood that future attacks on the compromised network resources NR1 and NR2 will be successful. For example, the security evaluation module <NUM> might determine that based on the permission given by the administrator or owner of NR1, an instruction <NUM> can be sent to NR1 to shut down and/or lock NR1 so that no further communication to and from NR1 can be conducted. In addition, a message can be sent to the administrator or owner of NR1 to report the attack and the attack pattern so that further actions to increase the security of NR1 can be performed, such as setting up a firewall, increasing the strength of user passwords, etc. Regarding NR2, the security evaluation module <NUM> might determine that the owner of NR2 has not given the security evaluation module <NUM> permission to directly operate on NR2. In such a scenario, a warning message <NUM> can be sent to the owner of NR2 to warn him or her about the attack and the identified attack pattern so that the owner can determine on his own the type of actions to take to reduce the vulnerability of NR2.

It should be understood that the example shown in <FIG> is merely illustrative and should not be construed as limiting. Various types of attacks might occur and be detected by the security evaluation module <NUM>, and various actions can be taken by the security evaluation module <NUM> to reduce the likelihood of success of future attacks.

Turning now to <FIG>, aspects of a routine <NUM> for predicting vulnerability of network resources <NUM> are shown and described below. It should be understood that the operations of the methods disclosed herein are not presented in any particular order and that performance of some or all of the operations in an alternative order(s) is possible and is contemplated. The operations have been presented in the demonstrated order for ease of description and illustration. Operations may be added, omitted, and/or performed simultaneously, without departing from the scope of the appended claims.

It also should be understood that the illustrated methods can end at any time and need not be performed in their entireties. Some or all operations of the methods, and/or substantially equivalent operations, can be performed by execution of computer-readable instructions included on a computer-storage media, as defined below. The term "computer-readable instructions," and variants thereof, as used in the description and claims, is used expansively herein to include routines, applications, application modules, program modules, programs, components, data structures, algorithms, and the like. Computer-readable instructions can be implemented on various system configurations, including single-processor or multiprocessor systems, minicomputers, mainframe computers, personal computers, hand-held computing devices, microprocessor-based, programmable consumer electronics, combinations thereof, and the like.

Thus, it should be appreciated that the logical operations described herein are implemented (<NUM>) as a sequence of computer implemented acts or program modules running on a computing system and/or (<NUM>) as interconnected machine logic circuits or circuit modules within the computing system. The implementation is a matter of choice dependent on the performance and other requirements of the computing system. Accordingly, the logical operations described herein are referred to variously as states, operations, structural devices, acts, or modules. These operations, structural devices, acts, and modules may be implemented in software, in firmware, in special purpose digital logic, and any combination thereof.

For example, the operations of the routine <NUM> are described herein as being implemented, at least in part, by modules running the features disclosed herein can be a dynamically linked library ("DLL"), a statically linked library, functionality produced by an application programing interface ("API"), a compiled program, an interpreted program, a script or any other executable set of instructions. Data can be stored in a data structure in one or more memory components. Data can be retrieved from the data structure by addressing links or references to the data structure.

Although the following illustration refers to the components of the figures, it can be appreciated that the operations of the routine <NUM> may be also implemented in many other ways. For example, the routine <NUM> may be implemented, at least in part, by a processor of another remote computer or a local circuit. In addition, one or more of the operations of the routine <NUM> may alternatively or additionally be implemented, at least in part, by a chipset working alone or in conjunction with other software modules. In the example described below, one or more modules of a computing system can receive and/or process the data disclosed herein. Any service, circuit or application suitable for providing the techniques disclosed herein can be used in operations described herein.

With reference to <FIG>, the routine <NUM> begins at operation <NUM> where the security evaluation module <NUM> generates initial vulnerability scores <NUM> for the network resources <NUM>. In one implementation, the initial vulnerability scores <NUM> can be calculated based on the configuration data <NUM> of the network resources <NUM>, such as the configuration or settings of the network resources <NUM>. Additionally, or alternatively, the initial vulnerability scores <NUM> can also be determined based on activity data of the network resources <NUM>, such as the activity data <NUM>.

From operation <NUM>, the routine <NUM> proceeds to operation <NUM> where the security evaluation module <NUM> can obtain activity data <NUM> of the network resources <NUM>. As described above, the activity data <NUM> can include dynamic information about the network resources <NUM>, such as inbound and outbound network traffic of the network resources <NUM>, process creation data describing the activity of creating new processes on the network resources <NUM>, query data and/or other activities occurred on the network resources <NUM>.

In some implementations, the activity data <NUM> for each network resource <NUM> is converted into a set of dynamic resource features <NUM>. For example, the dynamic resource features <NUM> can specify the aspects of the activity data <NUM> that the designer of the vulnerability model <NUM> deems important in predicting the vulnerability of the network resources <NUM>. Alternatively, the dynamic resource features <NUM> can include all aspects of the activity data <NUM>, and the vulnerability model <NUM> can determine the important aspects of the activity data <NUM> during training. In addition, the dynamic resource features <NUM> can be generated in a format that is suitable for the vulnerability model <NUM>, such as a vector or a matrix of values representing the relevant activities.

The routine <NUM> then proceeds to operation <NUM> where a vulnerability model <NUM> can be trained through a supervised training mechanism. In supervised training, the vulnerability model <NUM> is provided with a set of training examples, each training example including an input-output pair: input activity data <NUM> or the dynamic resource features <NUM> of a network resource <NUM> and initial vulnerability scores <NUM> for the network resource <NUM>. The training algorithm can analyze the training examples and produce an inferred function for mapping the input to the outputs. The inferred function can be reflected in the parameters and/or settings of the vulnerability model <NUM>.

After the vulnerability model <NUM> has been trained, the routine <NUM> proceeds to operation <NUM> where the vulnerability model <NUM> can be used to predict the vulnerability of the network resources <NUM>. Specifically, at operation <NUM>, the security evaluation module <NUM> can obtain new activity data <NUM> from the network resources <NUM> and apply the new activity data <NUM> to the vulnerability model <NUM> to generate predicted vulnerability scores <NUM>. In implementations where the activity data <NUM> is converted to dynamic resource features <NUM> during the training, the new activity data <NUM> can also be converted in the same way so that the format and dimension of the input to the vulnerability model <NUM> at the production stage are consistent with those at the training stage.

It should be noted that there might be discrepancies between the vulnerability scores <NUM> and the initial vulnerability scores <NUM>. This is because the initial vulnerability scores <NUM> are calculated based on the configuration data of the network resources <NUM>, whereas the vulnerability scores <NUM> are determined based on activity data of the network resources <NUM> considering the actual activities occurring on the network resources <NUM>. In addition, the vulnerability scores <NUM> are determined based on the latest activity data <NUM> which captures the changed environment of the network resources <NUM>. As such, the vulnerability scores <NUM> can better indicate the vulnerability of the network resources <NUM>.

From operation <NUM>, the routine <NUM> proceeds to operation <NUM> where the security evaluation module <NUM> can identify vulnerable resources <NUM> based on the vulnerability scores <NUM>. For example, the security evaluation module <NUM> can determine that the network resources <NUM> whose vulnerability scores <NUM> are higher than a threshold value can be considered vulnerable network resources <NUM>. In addition, the security evaluation module <NUM> can also identify attack patterns <NUM> at operation <NUM>. For instance, the security evaluation module <NUM> can compare the activity data <NUM> of the identified vulnerable network resources <NUM> with the activity data <NUM> of the well-protected network resources <NUM>. Those activity patterns that are unique to the identified vulnerable network resources <NUM> can show the attack pattern <NUM> of the attacker, can be analyzed to provide helpful insights in understanding the attack itself and the attackers who launched the attack and to help reconfigure the identified vulnerable network resources and other network resources to increase their security.

The routine <NUM> then proceeds to operation <NUM> where one or more actions can be performed to increase the security of the vulnerable network resources <NUM>. As discussed above, the vulnerable network resources <NUM> are determined based on activities of the network resources <NUM> and a network resource <NUM> typically perform suspicious activities after being compromised. As such, it is likely that the identified vulnerable network resources <NUM> have already been compromised. Actions should be taken to avoid further attacks and to increase the security level of the vulnerable network resources <NUM>. For example, the security servers <NUM> can send an instruction <NUM> to the compromised network resources <NUM> to have the compromised network resources <NUM> be turned off or taken offline to eliminate further network traffic. Alternatively, or additionally, a warning message <NUM> can be sent to the administrators or owners of the network resources <NUM> to inform them about the vulnerability of the network resources as well as the attack pattern <NUM> and recommend remedial actions to be taken to avoid further attacks.

From operation <NUM>, the routine <NUM> proceeds to operation <NUM> where it is determined whether the security evaluation module <NUM> should continue monitoring the vulnerability of the network resources <NUM>. If so, the routine <NUM> proceeds to operation <NUM> where the above described operations <NUM>-<NUM> can be performed again; if not, the routine <NUM> proceeds to operation <NUM>, where it ends.

<FIG> shows additional details of an example computer architecture <NUM> for a computer, such as the security servers <NUM> (<FIG>), capable of executing the program components described herein. Thus, the computer architecture <NUM> illustrated in <FIG> illustrates an architecture for a server computer, a desktop computer, a netbook computer, a tablet computer, and/or a laptop computer. The computer architecture <NUM> may be utilized to execute any aspects of the software components presented herein.

The computer architecture <NUM> illustrated in <FIG> includes a central processing unit <NUM> ("CPU"), a system memory <NUM>, including a random-access memory <NUM> ("RAM") and a read-only memory ("ROM") <NUM>, and a system bus <NUM> that couples the memory <NUM> to the CPU <NUM>. A basic input/output system containing the basic routines that help to transfer information between elements within the computer architecture <NUM>, such as during startup, is stored in the ROM <NUM>. The computer architecture <NUM> further includes a mass storage device <NUM> for storing an operating system <NUM>, other data, and one or more applications, such as the security evaluation module <NUM>.

The mass storage device <NUM> is connected to the CPU <NUM> through a mass storage controller (not shown) connected to the bus <NUM>. The mass storage device <NUM> and its associated computer-readable media provide non-volatile storage for the computer architecture <NUM>. Although the description of computer-readable media contained herein refers to a mass storage device, such as a solid state drive, a hard disk or CD-ROM drive, it should be appreciated by those skilled in the art that computer-readable media can be any available computer storage media or communication media that can be accessed by the computer architecture <NUM>.

Communication media includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any delivery media. The term "modulated data signal" means a signal that has one or more of its characteristics changed or set in a manner so as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of the any of the above should also be included within the scope of computer-readable media.

By way of example, and not limitation, computer storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. For example, computer media includes, but is not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid-state memory technology, CD-ROM, digital versatile disks ("DVD"), HD-DVD, BLU-RAY, or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the computer architecture <NUM>. For purposes of the claims, the phrase "computer storage medium," "computer-readable storage medium" and variations thereof, does not include waves, signals, and/or other transitory and/or intangible communication media, per se.

According to various configurations, the computer architecture <NUM> may operate in a networked environment using logical connections to remote computers through the network <NUM> and/or another network (not shown). The computer architecture <NUM> may connect to the network <NUM> through a network interface unit <NUM> connected to the bus <NUM>. It should be appreciated that the network interface unit <NUM> also may be utilized to connect to other types of networks and remote computer systems. The computer architecture <NUM> also may include an input/output controller <NUM> for receiving and processing input from a number of other devices, including a keyboard, mouse, or electronic stylus (not shown in <FIG>). Similarly, the input/output controller <NUM> may provide output to a display screen, a printer, or other type of output device (also not shown in <FIG>).

It should be appreciated that the software components described herein may, when loaded into the CPU <NUM> and executed, transform the CPU <NUM> and the overall computer architecture <NUM> from a general-purpose computing system into a special-purpose computing system customized to facilitate the functionality presented herein. The CPU <NUM> may be constructed from any number of transistors or other discrete circuit elements, which may individually or collectively assume any number of states. More specifically, the CPU <NUM> may operate as a finite-state machine, in response to executable instructions contained within the software modules disclosed herein. These computer-executable instructions may transform the CPU <NUM> by specifying how the CPU <NUM> transitions between states, thereby transforming the transistors or other discrete hardware elements constituting the CPU <NUM>.

As another example, the computer-readable media disclosed herein may be implemented using magnetic or optical technology. In such implementations, the software presented herein may transform the physical state of magnetic or optical media, when the software is encoded therein. These transformations may include altering the magnetic characteristics of particular locations within given magnetic media. These transformations also may include altering the physical features or characteristics of particular locations within given optical media, to change the optical characteristics of those locations. Other transformations of physical media are possible without departing from the scope of the present description, with the foregoing examples provided only to facilitate this discussion.

In light of the above, it should be appreciated that many types of physical transformations take place in the computer architecture <NUM> in order to store and execute the software components presented herein. It also should be appreciated that the computer architecture <NUM> may include other types of computing devices, including hand-held computers, embedded computer systems, personal digital assistants, and other types of computing devices known to those skilled in the art. It is also contemplated that the computer architecture <NUM> may not include all of the components shown in <FIG>, may include other components that are not explicitly shown in <FIG>, or may utilize an architecture completely different than that shown in <FIG>.

<FIG> depicts an illustrative distributed computing environment <NUM> capable of executing the software components described herein. Thus, the distributed computing environment <NUM> illustrated in <FIG> can be utilized to execute any aspects of the software components presented herein. For example, the distributed computing environment <NUM> can be utilized to execute aspects of the software components described herein.

According to various implementations, the distributed computing environment <NUM> includes a computing environment <NUM> operating on, in communication with, or as part of the network <NUM>. The network <NUM> may be or may include the network <NUM>, described above with reference to <FIG>. The network <NUM> also can include various access networks. One or more client devices 606A-606N (hereinafter referred to collectively and/or generically as "clients <NUM>" and also referred to herein as computing devices <NUM>) can communicate with the computing environment <NUM> via the network <NUM> and/or other connections (not illustrated in <FIG>). In one illustrated configuration, the clients <NUM> include a computing device 606A such as a laptop computer, a desktop computer, or other computing device; a slate or tablet computing device ("tablet computing device") 606B; a mobile computing device 606C such as a mobile telephone, a smart phone, or other mobile computing device; a server computer 606D; and/or other devices 606N. It should be understood that any number of clients <NUM> can communicate with the computing environment <NUM>. An example computing architecture for the clients <NUM> are illustrated and described herein with reference to <FIG>. It should be understood that the illustrated clients <NUM> and computing architectures illustrated and described herein are illustrative, and should not be construed as being limited in any way.

In the illustrated configuration, the computing environment <NUM> includes application servers <NUM>, data storage <NUM>, and one or more network interfaces <NUM>. According to various implementations, the functionality of the application servers <NUM> can be provided by one or more server computers that are executing as part of, or in communication with, the network <NUM>. The application servers <NUM> can host various services, virtual machines, portals, and/or other resources. In the illustrated configuration, the application servers <NUM> host one or more virtual machines <NUM> for hosting applications or other functionality. According to various implementations, the virtual machines <NUM> host one or more applications and/or software modules for enabling prediction of vulnerability of network resources. It should be understood that this configuration is illustrative, and should not be construed as being limiting in any way. The application servers <NUM> also host or provide access to one or more portals, link pages, Web sites, and/or other information ("Web portals") <NUM>.

According to various implementations, the application servers <NUM> also include one or more mailbox services <NUM> and one or more messaging services <NUM>. The mailbox services <NUM> can include electronic mail ("email") services. The mailbox services <NUM> also can include various personal information management ("PIM") and presence services including, but not limited to, calendar services, contact management services, collaboration services, and/or other services. The messaging services <NUM> can include, but are not limited to, instant messaging services, chat services, forum services, and/or other communication services.

The application servers <NUM> also may include one or more social networking services <NUM>. The social networking services <NUM> can include various social networking services including, but not limited to, services for sharing or posting status updates, instant messages, links, photos, videos, and/or other information; services for commenting or displaying interest in articles, products, blogs, or other resources; and/or other services. In some configurations, the social networking services <NUM> are provided by or include the FACEBOOK social networking service, the LINKEDIN professional networking service, the FOURSQUARE geographic networking service, and the like. In other configurations, the social networking services <NUM> are provided by other services, sites, and/or providers that may or may not be explicitly known as social networking providers. For example, some web sites allow users to interact with one another via email, chat services, and/or other means during various activities and/or contexts such as reading published articles, commenting on goods or services, publishing, collaboration, gaming, and the like. Examples of such services include, but are not limited to, the WINDOWS LIVE service and the XBOX LIVE service from Microsoft Corporation in Redmond, Washington. Other services are possible and are contemplated.

The social networking services <NUM> also can include commenting, blogging, and/or micro blogging services. Examples of such services include, but are not limited to, the YELP commenting service, the TWITTER messaging service, and/or other services. It should be appreciated that the above lists of services are not exhaustive and that numerous additional and/or alternative social networking services <NUM> are not mentioned herein for the sake of brevity. As such, the above configurations are illustrative, and should not be construed as being limited in any way. According to various implementations, the social networking services <NUM> may host one or more applications and/or software modules for providing the functionality described herein, such as enabling smart versioning of files. For instance, any one of the application servers <NUM> may communicate or facilitate the functionality and features described herein. For instance, a social networking application, mail client, messaging client or a browser running on a phone or any other client <NUM> may communicate with a networking service <NUM> and facilitate the functionality, even in part, described above with respect to <FIG>. Any device or service depicted herein can be used as a resource for supplemental data, including email servers, storage servers, etc..

As shown in <FIG>, the application servers <NUM> also can host other services, applications, portals, and/or other resources ("other resources") <NUM>. The other resources <NUM> can include, but are not limited to, document sharing, rendering or any other functionality. It thus can be appreciated that the computing environment <NUM> can provide integration of the concepts and technologies disclosed herein with various mailbox, messaging, social networking, and/or other services or resources.

As mentioned above, the computing environment <NUM> can include the data storage <NUM>. According to various implementations, the functionality of the data storage <NUM> is provided by one or more databases operating on, or in communication with, the network <NUM>. The functionality of the data storage <NUM> also can be provided by one or more server computers configured to host data for the computing environment <NUM>. The data storage <NUM> can include, host, or provide one or more real or virtual datastores 626A-626N (hereinafter referred to collectively and/or generically as "datastores <NUM>"). The datastores <NUM> are configured to host data used or created by the application servers <NUM> and/or other data. Although not illustrated in <FIG>, the datastores <NUM> also can host or store web page documents, word documents, presentation documents, data structures, algorithms for execution by a recommendation engine, and/or other data utilized by any application program or another module. Aspects of the datastores <NUM> may be associated with a service for storing files.

The computing environment <NUM> can communicate with, or be accessed by, the network interfaces <NUM>. The network interfaces <NUM> can include various types of network hardware and software for supporting communications between two or more computing devices including, but not limited to, the computing devices and the servers. It should be appreciated that the network interfaces <NUM> also may be utilized to connect to other types of networks and/or computer systems.

Claim 1:
A system (<NUM>) comprising:
one or more processing units (<NUM>); and
a computer-readable storage medium (<NUM>) having computer-executable instructions stored thereupon, which, when executed by the one or more processing units (<NUM>), cause the one or more processing units to:
access security configuration data of a plurality of network resources, wherein the security configuration data includes at least one of a setup of a firewall, a strength of a user password, or a number of users of a corresponding network resource;
generate an initial vulnerability score (<NUM>) for each of the plurality of network resources (<NUM>) based on the security configuration data of the corresponding network resource to identify vulnerable network resources that act as virtual honeypots, wherein the virtual honeypots are network resources that are poorly configured in terms of security so are vulnerable to cyberattack and attract attackers;
collect activity data (<NUM>) from the plurality of network resources (<NUM>);
build a vulnerability model (<NUM>) based on the initial vulnerability scores (<NUM>) and the activity data (<NUM>) collected from the plurality of network resources (<NUM>), wherein building the vulnerability model comprises performing supervised training on a machine-learning model using a set of training examples, wherein each training example includes an input-output pair, wherein the input comprises the activity data (<NUM>) for the network resource (<NUM>) and the output comprises the initial vulnerability score (<NUM>) for the network resource (<NUM>);
collect new activity data (<NUM>) for the plurality of network resources (<NUM>);
generate predicted vulnerability scores (<NUM>) for the plurality of network resources (<NUM>) by applying the new activity data (<NUM>) to the vulnerability model (<NUM>);
identify at least one vulnerable network resource (<NUM>) from the plurality of network resources (<NUM>) that has a predicted vulnerability score (<NUM>) that exceeds a threshold vulnerability score established to identify a virtual honeypot; and
analyze an activity pattern that is unique to the at least one vulnerable network resource to determine that the activity pattern is associated with an attack pattern used by a malicious entity.