Detection of malicious attempts to access a decoy database object based on connection type

1. A method by a security system implemented by one or more electronic devices for detecting malicious attempts to access a decoy database object in a database, wherein the database includes database objects, including the decoy database object, accessible by clients of the database called database clients, the method comprising:

detecting access to a decoy database object of the database is being attempted by a database client over a connection to the database, wherein the decoy database object is a database object that is created for the purpose of deceiving an attacker as opposed to being a legitimate database object;

determining that the connection is of an application connection type as opposed to a user connection type, wherein the application connection type is a type of connection over which queries generated by application code of a database client are submitted, and wherein the user connection type is a type of connection over which ad-hoc queries generated by a user interacting with a database client are submitted;

responsive to the determination that the connection is of the application connection type, causing an alert to be generated;

detecting a second access and a third access to the decoy database object of the database is being attempted by a database client over a second connection to the database;

determining that the second connection is of the user connection type as opposed to the application connection type;

responsive to the determination that the second connection is of the user connection type and that with the second access, a threshold number of accesses to read from the decoy database object will not have been made within a given period of time, allowing the second access; and

responsive to a determination that with the third access, the threshold number of accesses to read from the decoy database object will have been made within the given period of time, causing a second alert to be generated.

2. The method of claim 1 , further comprising:

detecting a fourth access to the decoy database object of the database is being attempted by a database client over the second connection to the database; and

responsive to a determination that the fourth access attempts to modify the decoy database object, causing a third alert to be generated.

3. The method of claim 1 , wherein the database client is a web server.

4. The method of claim 1 , wherein determining that the connection is of the application connection type is based on analyzing one or more of: a name of the database client, a driver being used by the database client to connect to the database, queries submitted over the connection, an amount of data sent over the connection.

5. The method of claim 1 , wherein the security system includes a security gateway.

6. The method of claim 1 , wherein the security system includes a security analysis server and an agent of the database.

7. The method of claim 1 , wherein the database is a production database.

8. The method of claim 1 , wherein the alert causes the attempt by the database client to access the decoy database object to be blocked.

9. A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for detecting malicious attempts to access a decoy database object in a database, wherein the database includes database objects, including the decoy database object, accessible by clients of the database called database clients, the operations comprising:

detecting access to a decoy database object of the database is being attempted by a database client over a connection to the database, wherein the decoy database object is a database object that is created for the purpose of deceiving an attacker as opposed to being a legitimate database object;

determining that the connection is of an application connection type as opposed to a user connection type, wherein the application connection type is a type of connection over which queries generated by application code of a database client are submitted, and wherein the user connection type is a type of connection over which ad-hoc queries generated by a user interacting with a database client are submitted;

responsive to the determination that the connection is of the application connection type, causing an alert to be generated;

detecting a second access and a third access to the decoy database object of the database is being attempted by a database client over a second connection to the database;

determining that the second connection is of the user connection type as opposed to the application connection type;

responsive to the determination that the second connection is of the user connection type and that with the second access, a threshold number of accesses to read from the decoy database object will not have been made within a given period of time, allowing the second access; and

responsive to a determination that with the third access, the threshold number of accesses to read from the decoy database object will have been made within the given period of time, causing a second alert to be generated.

10. The set of one or more non-transitory computer readable storage media of claim 9 , wherein the operations further comprise:

detecting a fourth access to the decoy database object of the database is being attempted by a database client over the second connection to the database; and

responsive to a determination that the fourth access attempts to modify the decoy database object, causing a third alert to be generated.

11. The set of one or more non-transitory computer readable storage media of claim 9 , wherein the database client is a web server.

12. The set of one or more non-transitory computer readable storage media of claim 9 , wherein determining that the connection is of the application connection type is based on analyzing one or more of: a name of the database client, a driver being used by the database client to connect to the database, queries submitted over the connection, an amount of data sent over the connection.

13. A computing device configured to detect malicious attempts to access a decoy database object in a database, wherein the database includes database objects, including the decoy database object, accessible by clients of the database called database clients, the computing device comprising:

one or more processors; and

a non-transitory machine-readable storage medium having instructions stored therein,

which when executed by the one or more processors, causes the computing device to:

detect access to a decoy database object of the database is being attempted by a database client over a connection to the database, wherein the decoy database object is a database object that is created for the purpose of deceiving an attacker as opposed to being a legitimate database object,

determine that the connection is of an application connection type as opposed to a user connection type, wherein the application connection type is a type of connection over which queries generated by application code of a database client are submitted, and wherein the user connection type is a type of connection over which ad-hoc queries generated by a user interacting with a database client are submitted,

responsive to the determination that the connection is of the application connection type, cause an alert to be generated,

detect a second access and a third access to the decoy database object of the database is being attempted by a database client over a second connection to the database,

determine that the second connection is of the user connection type as opposed to the application connection type,

responsive to the determination that the second connection is of the user connection type and that with the second access, a threshold number of accesses to read from the decoy database object will not have been made within a given period of time, allow the second access, and

responsive to a determination that with the third access, the threshold number of accesses to read from the decoy database object will have been made within the given period of time, cause a second alert to be generated.

14. The computing device of claim 13 , wherein the instructions, when executed by the one or more processors, further causes the computing device to:

detect a fourth access to the decoy database object of the database is being attempted by a database client over the second connection to the database,

determine that the second connection is of the user connection type as opposed to the application connection type, and

responsive to a determination that the fourth access attempts to modify the decoy database object, cause a third alert to be generated.

15. The computing device of claim 13 , wherein the database client is a web server.

16. The computing device of claim 13 , wherein the determination that the connection is of the application connection type is based on analyzing one or more of: a name of the database client, a driver being used by the database client to connect to the database, queries submitted over the connection, an amount of data sent over the connection.

17. The computing device of claim 13 , wherein the computing device implements a security gateway or a security analysis server.