Patent ID: 9178899
Filing Date: 2015-11-03
Classification: H04L

Abstract:
1. A computer-implemented method, comprising: providing, from a computer server, a plurality of honeypot links in a web page to detect automatic scans; detecting, at the computer server via a communications module, that at least two of the plurality of honeypot links have been selected by a computer a predetermined number of times; generating, at the computer server, a session ID associated with the computer and the at least two selected honeypot links; storing, at the computer server, the session ID; displaying, from the computer server, data in response to each selected honeypot link, wherein the data is displayed on the web page after an artificial delay, and wherein the data does not include links to other web pages; determining, at the computer server, that the computer is an origin of an attack, wherein the determining is performed by comparing the selected honeypot links associated with the session ID with the links targeted in the attack to determine the similarities.