Patent ID: 9742804
Date: 2017-08-22
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method for protecting virtual machines, the computer-implemented method comprising: creating a copy of a group of the virtual machines in an operating network in a deception network to form a group of cloned virtual machines in the deception network in response to determining that the group of the virtual machines in the operating network is accessed by an adversary; determining, in response to determining that the group of the virtual machines in the operating network is accessed by an adversary, at least one component from the operating network that the adversary has accessed; creating, in response to determining that the adversary has accessed at least one component from the operating network, an emulation of the at least one component in the deception network; and moving a group of network connections for the group of the virtual machines in the operating network used by the adversary from the group of the virtual machines in the operating network to the group of the cloned virtual machines in the deception network, thereby enabling protection of the group of the virtual machines from actions performed by the adversary, wherein the cloned virtual machine is shown to the adversary to have been running for the same period of time as that of a corresponding virtual machine in the operating network from which the cloned virtual machine was cloned.