# US 10,454,969 B2 · Automatic generation of low-interaction honeypots > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,969 B2 - Document ID: US10454969B2 - Status: Granted - Kind: B2 - Application number: 15/650,974 - Filed: 2017-07-17 - Published: 2019-01-17 - Granted: 2019-10-22 - Earliest claimed: 2017-07-17 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Martin Haerterich; Martin Johns; Marius Musch - Web page: https://patentgrep.com/patent/US10454969B2 ## CPC - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 8/60: Software deployment - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various embodiments of systems, computer program products, and methods to automatically generate low-interaction honeypots to protect application landscapes through are described herein. In an aspect, representative applications associated with resources in a network are identified. The low-interaction honeypots are automatically generated for the identified representative applications. Further, the representative applications are probed to retrieve responses corresponding to different requests. Templates are generated corresponding to request-response pairs by parsing the responses and the requests. During operation, new requests for accessing the resources are responded based on the generated templates. The new requests and corresponding responses are recorded. ## Claims ### Claim 1 A non-transitory computer readable storage medium storing instructions, which when executed by a computer cause the computer to: identify one or more representative applications associated with a plurality of resources in a network; automatically generate one or more low-interaction honeypots for the identified one or more representative applications; probe the one or more representative applications to retrieve a plurality of responses corresponding to a plurality of requests; generate one or more templates corresponding to one or more request-response pairs by parsing the plurality of responses and the plurality of requests; respond, through the one or more low-interaction honeypots, to one or more new requests for accessing the plurality of resources using the generated one or more templates, wherein responding to the one or more new requests for accessing the plurality of resources using the one or more templates comprises analyzing the one or more templates to determine best templates to respond to the one or more new requests and generating the corresponding responses based on the determined best templates; and record the one or more new requests and corresponding responses. ### Claim 2 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein identifying the one or more representative applications comprises: identifying the plurality of resources in the network; determining one or more applications corresponding to the plurality of resources; and identifying the one or more representative application from the one or more applications for the plurality of resources that share same characteristics. ### Claim 3 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the best templates to respond to the one or more new requests are determined based on ranks associated with the one or more templates. ### Claim 4 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein parsing the plurality of responses and the plurality of requests comprises: identifying static and non-static resources in the plurality of resources by determining differences in the plurality of responses for identical requests; and generating the one or more templates based on the identified static and non-static resources. ### Claim 5 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein parsing the plurality of responses and the plurality of requests comprises applying diffing to generate the one or more templates. ### Claim 6 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein automatically generating the one or more low-interaction honeypots further comprises deploying a honeypot factory instance to operate the generated one or more low-interaction honeypots in the network. ### Claim 7 A computer implemented method to automatically generate low-interaction honeypots, comprising: identifying one or more representative applications associated with a plurality of resources in a network; automatically generating one or more low-interaction honeypots for the identified one or more representative applications; probing the one or more representative applications to retrieve a plurality of responses corresponding to a plurality of requests; generating one or more templates corresponding to one or more request-response pairs by parsing the plurality of responses and the plurality of requests; responding, through the one or more low-interaction honeypots, to one or more new requests for accessing the plurality of resources using the generated one or more templates, wherein responding to the one or more new requests for accessing the plurality of resources using the one or more templates comprises analyzing the one or more templates to determine best templates to respond to the one or more new requests and generating the corresponding responses based on the determined best templates; and recording the one or more new requests and corresponding responses. ### Claim 8 (depends on 7) The computer implemented method of claim 7, wherein identifying the one or more representative applications comprises: identifying the plurality of resources in the network; determining one or more applications corresponding to the plurality of resources; and identifying the one or more representative application from the one or more applications for the plurality of resources that share same characteristics. ### Claim 9 (depends on 7) The computer implemented method of claim 7, wherein the best templates to respond to the one or more new requests are determined based on ranks associated with the one or more templates. ### Claim 10 (depends on 7) The computer implemented method of claim 7, wherein parsing the plurality of responses and the plurality of requests comprises: identifying static and non-static resources in the plurality of resources by determining differences in the plurality of responses for identical requests; and generating the one or more templates based on the identified static and non-static resources. ### Claim 11 (depends on 7) The computer implemented method of claim 7, wherein parsing the plurality of responses and the plurality of requests comprises applying diffing to generate the one or more templates. ### Claim 12 (depends on 7) The computer implemented method of claim 7, wherein automatically generating the one or more low-interaction honeypots further comprises deploying a honeypot factory instance to operate the generated one or more low-interaction honeypots in the network. ### Claim 13 A computing system to automatically generate low-interaction honeypots, comprising: at least one processor; and one or more memory devices communicative with the at least one processor, wherein the one or more memory devices store instructions to: identify one or more representative applications associated with a plurality of resources in a network; automatically generate one or more low-interaction honeypots for the identified one or more representative applications; probe the one or more representative applications to retrieve a plurality of responses corresponding to a plurality of requests; generate one or more templates corresponding to one or more request-response pairs by parsing the plurality of responses and the plurality of requests; respond, through the one or more low-interaction honeypots, to one or more new requests for accessing the plurality of resources using the generated one or more templates, wherein responding to the one or more new requests for accessing the plurality of resources using the one or more templates comprises analyzing the one or more templates to determine best templates to respond to the one or more new requests and generating the corresponding responses based on the determined best templates; and record the one or more new requests and corresponding responses. ### Claim 14 (depends on 13) The computing system of claim 13, wherein identifying the one or more representative applications comprises: identify the plurality of resources in the network; determine one or more applications corresponding to the plurality of resources; and identify the one or more representative application from the one or more applications for the plurality of resources that share same characteristics. ### Claim 15 (depends on 13) The computing system of claim 13, wherein parsing the plurality of responses and the plurality of requests comprises: identify static and non-static resources in the plurality of resources by determining differences in the plurality of responses for identical requests; and generate the one or more templates based on the identified static and non-static resources. ### Claim 16 (depends on 13) The computing system of claim 13, wherein parsing the plurality of responses and the plurality of requests comprises applying diffing to generate the one or more templates. ### Claim 17 (depends on 13) The computing system of claim 13, wherein automatically generating the one or more low-interaction honeypots further comprises deploying a honeypot factory instance to operate the generated one or more low-interaction honeypots in the network.