Patent ID: 7904959

Claim:
A method for protecting applications from attacks, the method comprising: receiving traffic from a communication network that is attempting to reach an application; transmitting the received traffic through an anomaly detection component, wherein the anomaly detection component predicts whether the received traffic is a potential attack on the application and wherein the anomaly detection component is tuned to achieve a low false negative rate; receiving an indication from the anomaly detection component relating to the prediction of the potential attack on the application; in response to receiving the indication from the anomaly detection component, transmitting the received traffic to a honeypot, wherein the honeypot is an instance of the application that shares state information with the application and wherein the honeypot monitors the received traffic for attacks on the application; receiving an indication from the honeypot that the received traffic is an attack on the application; and receiving an instruction from the honeypot to repair the state information of the application.