System and a method for identifying the presence of malware using mini-traps set at network endpoints

A method for identifying the presence of advanced persistent threats on a network including a plurality of resources, the method comprising:

• providing at least one decoy resource forming part of the network, at least one of said at least one decoy resource comprising a virtual decoy resource;
• installing at least one mini-trap on at least one of said plurality of resources, said at least one mini-trap being functionally associated with at least one of said at least one decoy resource, said at least one mini-trap comprising deceptive information directing malware accessing said at least one mini-trap to said at least one decoy resource associated therewith, such that said malware proceeds from said at least one mini-trap to said decoy resource associated therewith;
• associating each of said at least one mini-trap with a unique value, such that when infecting malware accesses one of said at least one mini-trap located on a specific one of said plurality of resources, the mini-trap being accessed is uniquely identified, thereby uniquely identifying the specific resource as being infected;
• detecting use of said at least one mini-trap by infecting malware by detecting said unique value associated with said at least one mini-trap, thereby to identify the presence of malware on said at least one of said plurality of resources where said at least one mini-trap is installed;
• and
• managing placement of said at least one mini-trap on said at least one of said plurality of resources and association between said at least one mini-trap and said decoy resources associated therewith.