Abstract: A system and methods of cybersecurity are provided, implementing: receiving multiple TCP/IP packets destined for a target host; determining from among the multiple TCP/IP packets, a subset of suspicious TCP/IP packets characterized by one or more suspicious traits; for each of the TCP/IP packets characterized by the one or more suspicious traits, extracting a TCP/IP timestamp header value and calculating a normalized timestamp value by subtracting a local system time from the TCP/IP timestamp header value; identifying a subgroup of the TCP/IP packets having a common normalized timestamp value indicative of generation by a common source host; receiving a subsequent TCP/IP packet destined for the target host; determining that the subsequent TCP/IP packet's normalized timestamp value is the common normalized timestamp value; and responsively blocking the subsequent TCP/IP packet from reaching the target host.

Abstract: A system and methods of cybersecurity are provided, implementing: receiving multiple TCP/IP packets destined for a target host; determining from among the multiple TCP/IP packets, a subset of suspicious TCP/IP packets characterized by one or more suspicious traits; for each of the TCP/IP packets characterized by the one or more suspicious traits, extracting a TCP/IP timestamp header value and calculating a normalized timestamp value by subtracting a local system time from the TCP/IP timestamp header value; identifying a subgroup of the TCP/IP packets having a common normalized timestamp value indicative of generation by a common source host; receiving a subsequent TCP/IP packet destined for the target host; determining that the subsequent TCP/IP packet’s normalized timestamp value is the common normalized timestamp value; and responsively blocking the subsequent TCP/IP packet from reaching the target host.

Abstract: A drone unit operatively connected to a server may identify an attack, launched by a botnet, on a resource. A drone unit may continuously and iteratively, while the attack is in progress, determine and report to a server a first set of values of a respective set of operational parameters related to the resource. A drone unit may determine, and report to the server, a second set of values of the set of operational parameters after the attack is terminated. A server may determine an impact of an attack by relating the first set values to the second set of values.

Abstract: A polymorphic sensor may be adapted to repeatedly, continuously and/or autonomously: receive a resource selection from a server and imitate the selected resource; detect an attack on the imitated resource; identify the attack and send, to the server, information characterizing the attack; and terminate the imitation of the resource upon receiving a command from the server.

Abstract: A polymorphic sensor may be adapted to repeatedly, continuously and/or autonomously: receive a resource selection from a server and imitate the selected resource; detect an attack on the imitated resource; identify the attack and send, to the server, information characterizing the attack; and terminate the imitation of the resource upon receiving a command from the server.

Abstract: A drone unit operatively connected to a server may identify an attack, launched by a botnet, on a resource. A drone unit may continuously and iteratively, while the attack is in progress, determine and report to a server a first set of values of a respective set of operational parameters related to the resource. A drone unit may determine, and report to the server, a second set of values of the set of operational parameters after the attack is terminated. A server may determine an impact of an attack by relating the first set values to the second set of values.