Patent ID: 9690932
Date: 2017-06-27
CPC Classifications: G06F,G06N,H04L

Claim:
1. A method for cyber security, comprising: detecting, by a decoy management server, a breach by an attacker of a specific resource within a network of resources in which users access the resources based on credentials, wherein access to the resources via network connections is governed by a firewall, wherein each resource has a domain name server (DNS) record stored on a DNS server, and wherein some of the resources are servers that are accessed via IP addresses; changing, by the decoy management server, the DNS record for the breached resource on the DNS server, in response to said detecting; predicting, by the decoy management server, which credentials are compromised, based on credentials stored on the breached resource; changing, by the decoy management server, those credentials that were predicted to be compromised, in response to said predicting which credentials; predicting, by the decoy management server, which servers in the network are compromised, based on connections created during the breach; changing, by the decoy management server, IP addresses of the predicted compromised servers in response to said predicting which servers; generating firewall rules to block access to the predicted compromised servers from the breached resource, in response to said predicting which servers; predicting, by the decoy management server, a target subnet, based on real and decoy connections created during the breach; and isolating, by the decoy management server, the target subnet in response to said predicting a target subnet.