Patent ID: 7549166

Claim:
A method for protecting a server farm from an intrusion, the server farm comprising multiple machines, the method comprising: detecting an intrusion by a machine in a server farm to which the intrusion has been sent; isolating the machine from the server farm; in response to detecting the intrusion by the machine, reprovisioning the machine as a decoy system having access to only non-sensitive data, such that in response to the machine detecting the intrusion the non-sensitive data is moved from an intrusion response database disposed external to the machine such that the non-sensitive data is accessible to the machine, and such that only the non-sensitive data is accessible to the intrusion in the machine; wherein the intrusion response database is disposed external to and communicatively coupled to the machine which received and detected the intrusion; wherein the intrusion is sent to the machine by a load balancer which initially receives the intrusion undetected as a normal packet of external network traffic and, based on load requirements of the multiple machines in the server farm, the load balancer sends the intrusion to the machine; in response to determining that the intrusion is a non-malicious intrusion, functionally reconnecting the machine to the server farm, and reprovisioning the reconnected machine to a state held before being reprovisioned as the decoy machine.