Development of honeypot system emulating functions of database server

Abstract

Possibilities to develop the honeypot type intrusion detection systems (IDS) for databases are discussed. Two types of concept honeypot systems are suggested. Network level system is based on the emulation of the database connections and is aimed to detect intruders searching for database servers and attempting to read basic database listeners information. Honeypot type database level IDS module is aimed to react to enquiries of database tables not used by real applications but loaded to the database to attract intruders.