Granted Patent B2

US 12,732,539 · App. 18/360,124 · Granted Sep 8, 2026

Inventors: M. David Hanes (Lewisville, NC); Amanda L. Holst (Campbell, CA); Sudha Katgeri (Allen, TX); Ana M Montenegro (Mexico City, MX); Ishita Maheshkumar Thanki (San Jose, CA)

Assignee: CISCO TECHNOLOGY, INC.

H04L63/1491H04L63/1416H04L67/306

Abstract

Claims (58)

1 . A method comprising:

creating, via a server, a plurality of virtualized human personalities associated with respective human users;

receiving, via the server, a cyberattack message;

determining, via the server, the cyberattack message does not target any of the respective human users;

selecting, via the server, an additional virtualized human personality that is not associated with the respective human users in response to determining the cyberattack message does not target any of the respective human users; and

responding, via the server, to the cyberattack message using the additional virtualized human personality.

2 . The method of claim 1 , wherein responding, via the server, to the cyberattack message using the additional virtualized human personality comprises:

generating, via the server, a response using the additional virtualized human personality; and

sending, via the server, the response.

3 . The method of claim 2 , wherein the response is generated using the additional virtualized human personality and a plurality of large language models.

4 . The method of claim 2 , further comprising generating, via the server, a honeypot profile, wherein the response is sent via the honeypot profile.

5 . The method of claim 1 , further comprising determining, via the server, user information associated with the respective human users from social media profiles related to the respective human users, wherein the plurality of virtualized human personalities is created based on the user information determined from the social media profiles.

6 . The method of claim 1 , wherein responding to the cyberattack message using the additional virtualized human personality comprises transmitting, via the server, a response that incorporates user information.

7 . The method of claim 1 , further comprising:

generating the additional virtualized human personality by compiling information related to other human users.

8 . The method of claim 1 , wherein responding to the cyberattack message using the additional virtualized human personality comprises transmitting, via the server, a response that does not incorporate any user information.

9 . The method of claim 1 , wherein the additional virtualized human personality is randomly selected.

10 . A non-transitory computer readable medium comprising instructions that, when executed by one or more processors, are configured to cause the one or more processors to perform operations comprising:

creating a generic virtualized human personality that is not associated with any human user;

creating a specific virtualized human personality associated with a human user;

receiving a first cyberattack message;

determining whether the first cyberattack message is targeted to any human user;

responding to the first cyberattack message with a first response message generated using the generic virtualized human personality in response to determining the first cyberattack message is not targeted to any human user;

receiving a second cyberattack message;

determining whether the second cyberattack message is targeted to any human user; and

responding to the second cyberattack message with a second response message generated using the specific virtualized human personality in response to determining the second cyberattack message is targeted to the human user.

11 . The non-transitory computer readable medium of claim 10 , wherein the instructions, when executed by the one or more processors, are configured to cause the one or more processors to perform operations comprising:

identifying information related to the human user from a social media platform; and

creating the specific virtualized human personality based on the information.

12 . The non-transitory computer readable medium of claim 11 , wherein the instructions, when executed by the one or more processors, are configured to cause the one or more processors to respond to the second cyberattack message using the specific virtualized human personality by sending a response message containing the information related to the human user.

13 . The non-transitory computer readable medium of claim 10 , wherein the instructions, when executed by the one or more processors, are configured to cause the one or more processors to perform operations comprising:

determining information related to the human user is unavailable; and

creating the specific virtualized human personality based on default information.

14 . The non-transitory computer readable medium of claim 10 , wherein the instructions, when executed by the one or more processors, are configured to cause the one or more processors to respond to the second cyberattack message using the specific virtualized human personality by generating the second response message using a plurality of large language models (LLMs) and outputting the second response message.

15 . The non-transitory computer readable medium of claim 14 , wherein the instructions, when executed by the one or more processors, are configured to cause the one or more processors to perform operations comprising:

determining an additional cyberattack message is not received within a threshold duration of time since output of the second response message; and

adjusting generation of a subsequent response message using the plurality of LLMs in response to determining the additional cyberattack message is not received within the threshold duration of time since the output of the second response message.

16 . The non-transitory computer readable medium of claim 10 , wherein the instructions, when executed by the one or more processors, are configured to cause the one or more processors to perform operations comprising:

selecting a mood as a basis for generating response messages; and

generating the first response message and/or the second response message in accordance with the mood.

17 . The non-transitory computer readable medium of claim 10 , wherein the first response message and/or the second response message contain a company status.

18 . An apparatus comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions stored on the memory to perform operations comprising:

generating a specific virtualized human personality associated with a human user;

generating a generic virtualized human personality that is not associated with any human user;

receiving an initial cyberattack message from a source;

determining the initial cyberattack message is not targeted to any human user;

generating an initial response message using the generic virtualized human personality in response to determining the initial cyberattack message is not targeted to any human user;

sending the initial response message to the source;

receiving a cyberattack message from the source;

determining the cyberattack message is targeted to the human user;

generating a response message using the specific virtualized human personality associated with the human user to contain a company status associated with the human user in response to determining the cyberattack message is targeted to the human user; and

sending the response message to the source.

19 . The apparatus of claim 18 , wherein the processor is configured to execute the instructions stored on the memory to perform operations comprising:

determining the company status associated with the human user; and

generating the specific virtualized human personality associated with the human user based on the company status.

20 . The apparatus of claim 19 , wherein the processor is configured to execute the instructions stored on the memory to perform operations comprising determining the company status associated with the human user via publicly available information, a user input, or both.

Assignments (1)

Continuity (1)

References Cited (28)