Dynamic honeypots for computer program execution environments

A computer-implemented method comprising:

• monitoring a plurality of computer program execution environments executing computer programs that provide a user service to determine a length of time each individual computer program execution environment has been executing a computer program, at least two of the computer program execution environments having different execution start times;
• determining whether a predetermined time period has expired since a computer program execution environment of the plurality of computer program execution environments began executing a computer program based on the corresponding determined length of time for the computer program execution environment;
• and
• changing the computer execution environment of the plurality of computer program execution environments into a computer security mechanism that counteracts an attempt of unauthorized use of a system that comprises the computer program execution environment in response to a determination that the time period has expired for the computer execution environment.

A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein to be executed by one or more processors, the program code including instructions to:

• monitor a plurality of computer program execution environments executing computer programs that provide a user service to determine a length of time each individual computer program execution environment has been executing a computer program, at least two of the computer program execution environments having different execution start times;
• determine whether a predetermined time period has expired since a computer program execution environment of the plurality of computer program execution environments began executing a computer program based on the corresponding determined length of time for the computer program execution environment;
• and
• change the computer execution environment of the plurality of computer program execution environments into a computer security mechanism that counteracts an attempt of unauthorized use of a system that comprises the computer program execution environment in response to a determination that the time period has expired for the computer execution environment.