# US 2018/0027015 A1 · System and method for identifying cyber-attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027015 A1 - Document ID: US20180027015A1 - Status: Published application - Kind: A1 - Application number: 15/653,625 - Filed: 2017-07-19 - Published: 2018-01-25 - Earliest claimed: 2016-07-19 - Assignees: Nucleon Ltd. - Applicants: Nucleon Ltd. - Inventors: Moran ZAVDI; Yossi ACCAV; Dina SHOMER - Web page: https://patentgrep.com/patent/US20180027015A1 ## CPC - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A polymorphic sensor may be adapted to repeatedly, continuously and/or autonomously: receive a resource selection from a server and imitate the selected resource; detect an attack on the imitated resource; identify the attack and send, to the server, information characterizing the attack; and terminate the imitation of the resource upon receiving a command from the server. ## Claims ### Claim 1 A system comprising: a polymorphic sensor adapted to repeatedly and autonomously: receive a resource selection from a server and imitate the selected resource; detect an attack on the imitated resource; and terminate the imitation of the resource upon receiving a command from the server. ### Claim 2 (depends on 1) The system of claim 1, comprising: wherein information sent to the server includes data related to a session established between the attacker and the imitated resource. ### Claim 3 (depends on 1) The system of claim 1, wherein identifying the attack is based on an interaction of an attacker with the imitated resource. ### Claim 4 (depends on 1) The system of claim 1, wherein the imitated resource is a network and wherein imitating the resource includes imitating at least one of: a device, a server, a computerized service, a network protocol and an application in the network. ### Claim 5 (depends on 1) The system of claim 1, wherein the server is adapted to: select a resource to be imitated based on a set of rules; instruct the polymorphic sensor to imitate the selected resource; and instruct the polymorphic sensor to terminate an imitation of the resource. ### Claim 6 (depends on 1) The system of claim 1, wherein the server is adapted to categorize the attack and include a categorization of the attack in a report presented to a user. ### Claim 7 (depends on 1) The system of claim 1, wherein the server is adapted to identify an attack based on session data related to a session established between an attacker and the imitated resource. ### Claim 8 (depends on 1) The system of claim 1, wherein the server is adapted to categorize the attack and include a categorization of the attack in a report presented to a user, wherein categorizing the attack includes at least one of: identifying an application used by an attacker, identifying a method used for the attack and identifying a bot participating in the attack. ### Claim 9 (depends on 1) The system of claim 1, wherein the server is adapted to select a resource for imitation based on a set of rules, and based on at least one sensor configuration. ### Claim 10 (depends on 1) The system of claim 1, wherein the polymorphic sensor is adapted to autonomously terminate, and report to the server a termination of, an imitation of the resource based on at least one predetermined parameter. ### Claim 11 (depends on 10) The system of claim 10, wherein the predefined parameter is related to at least one of: a time period for imitating a resource, a number of interactions with an imitated resource and an identity of an attacker interacting with the resource. ### Claim 12 (depends on 1) The system of claim 1, wherein, based on a command received from the server, the sensor is adapted to do one of: autonomously terminate the imitation of the resource and terminate the imitation of the resource in response to a message from the server. ### Claim 13 (depends on 1) The system of claim 1, wherein the polymorphic sensor is adapted to imitate a resource according to predefined rules and report to the server upon terminating the imitation of the resource. ### Claim 14 (depends on 1) The system of claim 1, wherein the polymorphic sensor is adapted to: determine communication with the server is unavailable; record data related to the attack; modify a network configuration of at least one network interface of the polymorphic sensor; and attempt to communicate with the server using the network interface. ### Claim 15 (depends on 1) The system of claim 1, wherein if the polymorphic sensor determines that communication with the server is unavailable then the polymorphic sensor stores data related to the attack on a predefined storage system. ### Claim 16 A method for identifying cyber-attacks, the method comprising: receiving, by a polymorphic sensor, a resource selection from a server and imitating, by the polymorphic sensor, the selected resource; detecting, by the polymorphic sensor, an attack on the imitated resource; identifying, by the polymorphic sensor, the attack and sending information characterizing the attack to the server; and terminating the imitation of the resource upon receiving a command from the server. ### Claim 17 (depends on 16) The method of claim 16, wherein information sent to the server includes data related to a session established between the attacker and the imitated resource. ### Claim 18 (depends on 16) The method of claim 16, wherein identifying the attack is based on an interaction of an attacker with the imitated resource. ### Claim 19 (depends on 16) The method of claim 16, wherein the imitated resource is a network and wherein imitating the resource includes imitating at least one of: a device, a server, a computerized service, a network protocol and an application in the network. ### Claim 20 A method for identifying cyber-attacks, the method comprising: faking, by a polymorphic sensor, a resource based on a resource selection received from a server; determining, by the polymorphic sensor, an attack on the faked resource is in progress; collecting, by the polymorphic sensor, data characterising the attack the attack and sending the data to the server; and terminating the faking of the resource upon receiving a command from the server.