Red Hat Files Patent for Decoy Servers That Trap Hackers Mid-Attack
When a hacker breaks into one of your servers, the usual response is to slam the door. Red Hat's patent application describes the opposite: slide the intruder onto an identical fake and watch what they try.
What Red Hat's decoy-server trap actually does
A night guard spots a stranger sneaking toward the loading dock. Instead of tackling him, the guard waves him into an identical warehouse next door, stocked with fake inventory and walled off from everything valuable.
That is the trick in this Red Hat patent application, applied to computer networks. It targets a sneaky kind of break-in called a reverse shell, where a hacked computer reaches out to the attacker instead of the attacker reaching in. Many security tools trust connections that start from inside a company, so this attack can slip past them. Red Hat's system would spot the warning signs, spin up a lookalike machine, and move the intruder onto it without telling them.
Once the hacker is in the fake, the system watches what they do, learns from it, and eventually cuts them off. If you have ever worried about your company's data, this is a trap meant to buy defenders time.
executing a machine-learning model to detect a reverse shell attempt by an attacker in relation to a target network machine in a computer network …
Translation: An AI watches network computers to catch hackers trying to take control.
How the system spots a reverse shell attack
The system works in two stages. First, an anomaly detector (a simple watchdog) compares what a machine is doing right now, such as processor, memory and storage use, with a baseline profile built from weeks or months of normal behavior. If the gap is big enough, stage two kicks in. This keeps the heavier analysis from running all the time and saves computing power.
Stage two is a machine-learning model (software trained on examples to recognize patterns). It reads the machine's logs, including network traffic, applications run and system commands, looking for a reverse shell signature, meaning a sequence of events that tends to come right before this kind of attack. Security professionals can supply the training examples.
If the model finds one, the system does three things:
- Deploys a honeypot (a decoy computer), built from the same image file (the template used to create the original, either a virtual machine or a container), so it matches the real one's software, settings and even network identity.
- Walls the decoy off in a sandbox, so nothing the attacker does can touch the rest of the network.
- Reroutes the attacker's connection to the decoy by changing routing and firewall rules, keeping details like IP addresses and session identifiers the same so the attacker does not notice.
Afterward, the system records the attacker's commands and uses them to create new signatures, which it can feed back into the model or store in a database. It can then block the attacker's IP address and shut the decoy down. The claims center on the detect, deploy and redirect steps; the monitoring and retraining are add-ons.
What this means for teams guarding cloud servers
If your bank, employer or favorite app runs on cloud servers, an intruder who gets in through a side door is a real risk. This filing describes a way to answer that automatically, in real time, without waiting for a person to notice. Even better for defenders, every captured attack could make the detector sharper, because the attacker's moves become new training material.
It is still only a patent application. The examiner's first review rejected the claims as filed, which is routine at this stage and usually followed by amendments. The filing also says the same approach could be applied to other kinds of cyberattacks, so the idea is broader than one trick.
IBM's 393rd filing in our IBM coverage since May follows work like the car security patent and the medical sensor chip.
Of everything here, the software side looks the most doable. There is no new hardware, only code that watches logs, starts a copy of a machine, and changes a few network rules. Most big cloud setups already let software do those things on command, and the filing leans on exactly that.
The harder part is what has to exist first. You need a trained model with good examples of attack behavior, a baseline profile for every machine, and a decoy convincing enough that a skilled attacker does not smell a fake. Copying the original machine's template gets close, but faking realistic data and response times on the fly is the part that still needs proving.
The shortest route to a product is a feature inside an existing security or cloud management tool, not a brand-new system built from scratch. That makes this a plausible near-term add-on once the detection model is good enough, and a long way from a finished product until it is.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time IBM patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
3 drawing sheets from US 2026/0322853 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in