Patent Document ID: 9509716
Application ID: 14700551
Patent Flag: 1

Claim One:
1. A method for using a system for creating, managing, and monitoring social network (SN) honeypots that will trap attempts to attack an organization's infrastructure through its employees during the reconnaissance phase of an Advanced Persistent Threat (APT), the system having: (a) a Profile Manager device adapted to wire the artificial profile in the SN by taking actions including identifying the best location in the target social network for seeding the artificial profile, accepting friendship requests, proposing friendship requests and sending posts and messages on behalf of the artificial profile that will affect the profile in the SN; (b) a Profile Monitoring device comprising monitoring software adapted to collect events relating to the artificial profiles and comprising detectors, software, and scanning logic adapted to collect emails sent to specific honeypot mailboxes to which it has been granted access; to store the email content including timestamp, sender, recipients, subject, content, attachments and URLs in a database; and to scan and detect any attachments and URLs for possible threats, and to notify a human system manager of every event relating to the artificial profiles and the honeypot mailboxes; and (c) a Management graphical user interface (GUI) device comprising a graphical user interface that supports the entire process of creating, managing, and monitoring the SN honeypot profiles by allowing the human system manager to carry out activities such as activating specific crawling tasks, viewing the crawled profiles and the topology they create, zooming into profiles and viewing the events related to honeypots by exploring the emails and scanning results, characterized in that: A) the Management GUI device also comprises software adapted to perform reoccurring scanning of previous attachments and URLs collected and stored by the Profile Monitoring device; and B) the system also has: d) a SN Crawler device comprising at least one plugin, wherein each plugin comprises software adapted to extract actual user SN profiles of the target organization and/or similar organizations from a designated SN and insert said extracted actual SN profiles into a generic database of profiles; e) a Profiles Database which comprises the actual SN profiles extracted by the at least one plugin of the SN Crawler device; and f) an Artificial Profile Generator device adapted to generate massive numbers of artificial profiles by using statistical methods on actual SN profiles stored in a Profiles Database and to connect the artificial profile with other real and artificial profiles in a social network; to detect attackers that are interested in attacking an organization's infrastructure through the organization's employees during the reconnaissance phase of the APT, said method comprising: a. activating the Profile Manager device to: i) create artificial user accounts for said artificial users; ii) add said artificial user accounts to social networks and to employee contact lists; iii) create email accounts for each of said artificial users; b) activating the Profile Monitoring device to: i) monitor the activity of said artificial user accounts in the social networks; ii) monitor the activity of said email accounts; and iii) report as suspicious all attempts of third parties to contact said artificial user accounts and said email accounts of said artificial users; c) activating the Management GUI device to perform reoccurring scanning of previous attachments and URLs collected and stored by a Profile Monitoring device; characterized in that the artificial user profiles are created by: i) activating at least one plugin of the SN Crawler device to extract actual user profiles from social networks; ii) storing the extracted actual user profiles in the Profiles Database; and iii) activating either the Artificial Profile Generator device to generate artificial profiles records by using statistical methods on the actual SN profiles stored in the Profiles Database or the Management GUI device to enable a human expert to generate the artificial profiles using data collected by the SN Crawler device from social networks.