Resource security system using fake connections

A computer system for handling security threats in a network data processing system, the computer system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• determine whether a connection between a target database server and a requestor is a threat connection or a normal connection based on applying a security policy to a set of actions performed by the requestor in response to detecting the connection between the target database server in the network data processing system and the requestor;
• responsive to determining that the connection is a threat connection, determine a threat level associated with the threat connection based on the security policy;
• send, based on the threat level, an alert message to an administrator;
• log, based on the threat level, continuing access by the requestor via the connection;
• create a fake connection by redirecting the connection from the target database server to a virtual security database server in response to the computer system determining that the connection is a threat connection, wherein the virtual security database server creates data packets that include information indicating that the data packets are from the target database server such that the requestor originating the connection to the target database server is unable to perceive a redirection of the connection from the target database server to the virtual security database server, and wherein the virtual security database server has tables that provide logically similar information to information stored in the target database server such that the virtual security database server is able to provide responses that appear to be information consistent with responses that would have been provided by the target database server, but with incorrect information;
• record information in the fake connection redirected from the target database server to the virtual security database server to form recorded information;
• and
• adjust the security policy for handling connections in the network data processing system using the recorded information, wherein the security threats in the network data processing system are decreased using the security policy.

A computer program product for handling security threats in a network data processing system, the computer program product comprising:

• a computer-readable storage media storing program code, the program code comprising;
• program code responsive to detecting a connection between a target database server in the network data processing system and a requestor, for determining whether the connection between the target database server and the requestor is a threat connection or a normal connection based on applying a security policy to a set of actions performed by the requestor;
• program code for determining, responsive to determining that the connection is a threat connection, a threat level associated with the threat connection based on the security policy;
• program code for sending, based on the threat level, an alert message to an administrator;
• program code for logging, based on the threat level, continuing access by the requestor via the connection;
• program code for creating a fake connection by redirecting the connection from the target database server to a virtual security database server in response to determining that the connection is a threat connection, wherein the virtual security database server creates data packets that include information indicating that the data packets are from the target database server such that the requestor originating the connection to the target database server is unable to perceive a redirection of the connection from the target database server to the virtual security database server, and wherein the virtual security database server has tables that provide logically similar information to information stored in the target database server such that the virtual security database server is able to provide responses that appear to be information consistent with responses that would have been provided by the target database server, but with incorrect information;
• program code for recording information in the fake connection redirected from the target database server to the virtual security database server to form recorded information;
• and
• program code for adjusting the security policy for handling connections in the network data processing system using the recorded information, wherein the security threats in the network data processing system are decreased using the security policy.