Detection of malicious attempts to access a decoy database object based on connection type

A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for detecting malicious attempts to access a decoy database object in a database, wherein the database includes database objects, including the decoy database object, accessible by clients of the database called database clients, the operations comprising:

• detecting access to a decoy database object of the database is being attempted by a database client over a connection to the database, wherein the decoy database object is a database object that is created for the purpose of deceiving an attacker as opposed to being a legitimate database object;
• determining that the connection is of an application connection type as opposed to a user connection type, wherein the application connection type is a type of connection over which queries generated by application code of a database client are submitted, and wherein the user connection type is a type of connection over which ad-hoc queries generated by a user interacting with a database client are submitted;
• responsive to the determination that the connection is of the application connection type, causing an alert to be generated;
• detecting a second access and a third access to the decoy database object of the database is being attempted by a database client over a second connection to the database;
• determining that the second connection is of the user connection type as opposed to the application connection type;
• responsive to the determination that the second connection is of the user connection type and that with the second access, a threshold number of accesses to read from the decoy database object will not have been made within a given period of time, allowing the second access;
• and
• responsive to a determination that with the third access, the threshold number of accesses to read from the decoy database object will have been made within the given period of time, causing a second alert to be generated.

A computing device configured to detect malicious attempts to access a decoy database object in a database, wherein the database includes database objects, including the decoy database object, accessible by clients of the database called database clients, the computing device comprising:

• one or more processors;
• and
• a non-transitory machine-readable storage medium having instructions stored therein,
• which when executed by the one or more processors, causes the computing device to:
• detect access to a decoy database object of the database is being attempted by a database client over a connection to the database, wherein the decoy database object is a database object that is created for the purpose of deceiving an attacker as opposed to being a legitimate database object,
• determine that the connection is of an application connection type as opposed to a user connection type, wherein the application connection type is a type of connection over which queries generated by application code of a database client are submitted, and wherein the user connection type is a type of connection over which ad-hoc queries generated by a user interacting with a database client are submitted,
• responsive to the determination that the connection is of the application connection type, cause an alert to be generated,
• detect a second access and a third access to the decoy database object of the database is being attempted by a database client over a second connection to the database,
• determine that the second connection is of the user connection type as opposed to the application connection type,
• responsive to the determination that the second connection is of the user connection type and that with the second access, a threshold number of accesses to read from the decoy database object will not have been made within a given period of time, allow the second access, and
• responsive to a determination that with the third access, the threshold number of accesses to read from the decoy database object will have been made within the given period of time, cause a second alert to be generated.