# US 2013/0160079 A1 · Deception-based network security using false positive responses to unauthorized access requests > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160079 A1 - Document ID: US20130160079A1 - Status: Published application - Kind: A1 - Application number: 13/331,972 - Filed: 2011-12-20 - Published: 2013-06-20 - Earliest claimed: 2011-12-20 - Assignees: Sap SE - Inventors: Cedric Hebert - Web page: https://patentgrep.com/patent/US20130160079A1 ## CPC - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A request handler may receive an access request for access to application server resources of an application server and determine that the access request is unauthorized. A response manager may provide a false positive response including apparent access to the application server resources. ## Claims ### Claim 1 A computer system including instructions recorded on a computer-readable storage medium and readable by at least one processor, the system comprising: a request handler configured to cause the at least one processor to receive an access request for access to application server resources of an application server and to determine that the access request is unauthorized; and a response manager configured to cause the at least one processor to provide a false positive response including apparent access to the application server resources. ### Claim 2 (depends on 1) The computer system of claim 1, wherein the response handler is configured for execution at a deception manager configured to receive the access request on behalf of the application server resources. ### Claim 3 (depends on 2) The computer system of claim 2, wherein the request handler is configured for execution at a network firewall. ### Claim 4 (depends on 1) The computer system of claim 1, wherein the request handler includes a probe detector configured to determine that the access request is for a closed port and part of a port scanning attack. ### Claim 5 (depends on 1) The computer system of claim 1, wherein the request handler includes a password system configured to determine that the access request includes a false password which is not associated with any authorized user. ### Claim 6 (depends on 1) The computer system of claim 1, wherein the request handler is configured to communicate with a knowledge base in order to determine that the access request is requesting non-available or inappropriately requested server resources, and to determine accordingly that the access request is unauthorized. ### Claim 7 (depends on 1) The computer system of claim 1, wherein the request handler is configured for execution in conjunction with an application of the application server, and wherein the request handler is configured to detect application-level attacks. ### Claim 8 (depends on 7) The computer system of claim 7, wherein the request handler is configured to communicate with a deceiver library agent to determine that the access request is requesting non-available or inappropriately-requested application-level resources, and to determine accordingly that the access request is unauthorized. ### Claim 9 (depends on 1) The computer system of claim 1, wherein the response manager is configured for execution at a deception manager configured to receive the access request on behalf of the application server resources. ### Claim 10 (depends on 9) The computer system of claim 9, wherein the response manager is configured to execute as a reverse proxy to re-route the unauthorized access request to a decoy server configured to provide the apparent access. ### Claim 11 (depends on 1) The computer system of claim 1, wherein the apparent access mimics an appearance and function of the requested application server resources. ### Claim 12 (depends on 1) The computer system of claim 1, wherein the access request is received from a client computer, and wherein the system comprises a logging engine configured to monitor and store interactions of the client computer during the apparent access. ### Claim 13 A computer-implemented method for causing at least one processor to execute instructions recorded on a computer-readable storage medium, the method comprising: receiving an access request for access to application server resources of an application server; determining that the access request is unauthorized; and providing a false positive response including apparent access to the application server resources. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein the determining that the access request is unauthorized comprises communicating with a knowledge base in order to determine that the access request is requesting non-available or inappropriately requested server resources; and determining accordingly that the access request is unauthorized. ### Claim 15 (depends on 13) The computer-implemented method of claim 13, wherein the providing the false positive response includes: re-routing the unauthorized access request to a decoy server configured to provide the apparent access, and wherein the decoy server is configured to provide the apparent access including mimicking an appearance and function of the requested application server resources. ### Claim 16 A computer program product, the computer program product being tangibly embodied on a computer-readable medium and comprising instructions that, when executed, are configured to cause at least one processor to: receive an access request for access to application server resources of an application server; determine that the access request is unauthorized; and provide a false positive response including apparent access to the application server resources. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the determining that the access request is unauthorized includes determining that the access request is for a closed port and part of a port scanning attack. ### Claim 18 (depends on 16) The computer program product of claim 16, wherein the instructions, when executed, are configured to cause the at least one processor to determine that the access request includes a false password which is not associated with any authorized user. ### Claim 19 (depends on 16) The computer program product of claim 16, wherein the access request is received from a client computer, and wherein the instructions, when executed, are configured to cause the at least one processor to monitor and store interactions of the client computer during the apparent access. ### Claim 20 (depends on 16) The computer program product of claim 16, wherein the instructions, when executed, are configured to cause the at least one processor to re-route the unauthorized access request to a decoy server configured to provide the apparent access, and wherein the decoy server is configured to provide the apparent access including mimicking an appearance and function of the requested application server resources.