Defending against targeted database attacks by dynamic honeypot database response generation

Abstract

A technique is provided that includes receiving a query directed to a targeted database and determining that the query is from an unauthorized user. A response generated by a model is returned to the unauthorized user, where the response is dynamically generated to fulfill the query. The model is configured to generate a response that is consistent with any previous responses returned to the unauthorized user.

Description

[Technical Field]

[0001] The present invention relates generally to computer systems, and more particularly to computer-implemented methods, computer systems, and computer program products configured and arranged to defend against targeted database attacks through dynamic honeypot database response generation.

[0002] Database security involves the use of a wide range of information security controls to protect a database from compromises to its confidentiality, integrity, and availability. Database security includes various types or categories of controls, such as technical, procedural, administrative, and physical. Protecting a database potentially includes protecting data, database applications, stored functions, database systems, database servers, and associated network links. Security risks to a database system include, for example, unauthorized or unintended activity, or misuse by authorized or unauthorized database users. Security risks could result, for example, inappropriate access to sensitive data, metadata, or functionality within the database, or inappropriate changes to database programs, structures, or security configurations. Summary of the Invention

[0003]

[0006] Embodiments of the present invention are directed to a computer-implemented method for defending against targeted database attacks through dynamic honeypot database response generation. A non-limiting example computer-implemented method includes receiving a query directed to a targeted database and determining that the query is from an unauthorized user. The computer-implemented method also includes returning a model-generated response to the unauthorized user, where the response is dynamically generated to fulfill the query, and the model is configured to generate a response that is consistent with any previous responses returned to the unauthorized user.

[0004] Other embodiments of the present invention embody features of the above methods in computer systems and computer program products.

[0005] Further technical features and advantages are realized through the techniques of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered a part of the claimed subject matter. For a better understanding, reference is made to the detailed description and drawings. [Brief explanation of the drawings]

[0006] The details of the exclusive rights set forth herein are particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The above and other features and advantages of embodiments of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0007] [Figure 1] FIG. 1 illustrates a block diagram of an exemplary computer system for use with one or more embodiments of the present invention.

[0008] [Figure 2] 1 illustrates a block diagram of a system for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention.

[0009] [Figure 3] 1 illustrates a flowchart of a computer-implemented process for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention.

[0010] [Figure 4] FIG. 1 shows a block diagram of an example architecture that uses innocent users to train generative models, in accordance with one or more embodiments of the present invention.

[0011] [Figure 5] 1 illustrates a flowchart of a computer-implemented process for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention.

[0012] [Figure 6] FIG. 1 illustrates a block diagram of an example architecture for detecting malicious users attempting to gain access to targeted databases and the use of dynamic honeypot database response generation to thwart attacks in accordance with one or more embodiments of the present invention.

[0013] [Figure 7] 1 illustrates a flowchart of a computer-implemented method for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention.

[0014] [Figure 8] 1 illustrates a cloud computing environment in accordance with one or more embodiments of the present invention.

[0015] [Figure 9] 1 illustrates abstraction model layers in accordance with one or more embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0016] One or more embodiments of the present invention provide a computer-implemented method, computer system, and computer program product for protecting a database targeted by an attacker attempting to obtain sensitive information contained therein, the computer-implemented method including replacing the targeted database's responses with phony (honeypot) database responses. The honeypot database responses trick the attacker into believing that they are obtaining valuable information from the targeted database. In reality, the actual valuable information remains safe while the attacker's attention is kept away from the actual target. This provides an opportunity for an incident response team to monitor the attacker's activities.

[0017] When a corporate network or website is breached, databases are typically a high-priority target for attackers seeking to capture sensitive data, such as credit card information, personal information, usernames and passwords, and more. When a system is breached, incident response teams act to minimize damage, monitor and track the perpetrators, and understand their intentions. Keeping attackers busy on the network is an important part of incident response procedures, allowing investigators to understand the techniques, motives, and ultimately the source and possibly the attacker. Honeypots, or "fake" systems, are typically deployed on the network to keep attackers busy. Furthermore, while the attacker's attention is focused on the fake systems, their attention is kept away from the "real" systems containing sensitive data. This ultimately gives the incident response team more time and opportunity to monitor the attacker's activities. A skilled attacker can easily identify traditional honeypots, and as soon as the attacker detects that they are interacting with such a honeypot system, the attacker stops the attack and focuses on other systems. This not only hampers the incident response team's opportunity to monitor and track the attacker, but also keeps the attacker's attention away from other valuable systems.

[0018] According to one or more embodiments of the present invention, an ideal honeypot database is indistinguishable from the system of the targeted database. That is, the honeypot database response returned to the attacker should be consistent with previous responses generated for this attacker from the real targeted database before this user was detected as fraudulent. In other words, according to one or more embodiments, the honeypot response is attacker-specific based on the specific attacker's past history. Furthermore, the honeypot database response is consistent not only with previous responses generated but also with the real database data (i.e., the data contained in these honeypot database responses is similar to the data contained in the real database). One or more embodiments of the present invention provide attacker-specific responses as a honeypot defense solution that is scalable and defends itself against multiple simultaneous attackers. In other words, one or more embodiments of the present invention do not require creating a honeypot database by duplicating the entire target database for each attacker, which would be impractical. Rather, one or more embodiments of the present invention are configured such that the database query response time of the honeypot database response is equal to the response time of the actual response received from the target database to avoid any suspicion by an attacker. This not only benefits response time, but also the way in which the system (including the honeypot database response) can be scaled in accordance with one or more embodiments. Furthermore, generating the honeypot database response does not require multiple replications of a database consisting of potentially terabytes of data.

[0019] According to one or more embodiments of the present invention, a conditional generative model is provided that generates honeypot database responses on demand that are based on and consistent with an attacker's past queries, where the honeypot database responses do not contain any sensitive information, yet resemble the data contained in the genuine database. The conditional generative model utilizes a fraudulent query log that records and audits all fraudulent queries from the attacker along with the honeypot database responses to the attacker. A fraudulent query detector is used to direct the fraudulent queries to the honeypot database, which is a conditional generative model. A data anonymization tool is used to anonymize any sensitive information. A glossary is provided below.

[0020] Incident response: Incident response is an organized effort to address and manage the consequences of a security breach or cyber-attack, also known as an information technology (IT) incident, computer incident, or security incident.

[0021] Honeypot: A honeypot is a computer security mechanism configured to detect, avoid, or in some way negate attempts at unauthorized use of an information system.

[0022] Conditional Generative Model (GAN): A model, such as a conditional GAN, that learns to reproduce data similar to the original targeted data source. According to one or more embodiments of the present invention, the conditional aspect of the generative model further enables the model, once trained, to vary its output based on specific input conditions provided to the model at prediction time.

[0023] Confidential Information: Confidential information is any information that the database owner does not want revealed to an attacker. Of course, this includes personal information (such as names, addresses, etc.), but it can also include non-personal information such as contract amounts, sales figures, etc.

[0024] Turning now to FIG. 1 , a computer system 100 in accordance with one or more embodiments of the present invention is illustrated. Computer system 100 may be an electronic computer framework comprising and / or employing any number and combination of computing devices and networks utilizing various communication technologies, as described herein. Computer system 100 may be easily scalable, extensible, and modular, with the ability to be adapted to different services or reconfigured with some features independent of others. Computer system 100 may be, for example, a server, desktop computer, laptop computer, tablet computer, or smartphone. In some examples, computer system 100 may be a cloud computing node. Computer system 100 may be described in the general context of computer system-executable instructions, such as program modules, executed by the computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc., that perform particular tasks or implement particular abstract data types. Computer system 100 may be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.

[0025] As shown in FIG. 1, computer system 100 includes one or more central processing units (CPUs) 101a, 101b, 101c, etc. (collectively or generically referred to as processor 101). Processor 101 may be a single-core processor, a multi-core processor, a computing cluster, or any number of other configurations. Processor 101, also referred to as a processing circuit, is coupled to system memory 103 and various other components via system bus 102. System memory 103 may include read-only memory (ROM) 104 and random access memory (RAM) 105. ROM 104 is coupled to system bus 102 and may include a basic input / output system (BIOS) or its successor, such as a unified extensible firmware interface (UEFI), which controls certain basic functions of computer system 100. RAM is read-write memory coupled to system bus 102 for use by processor 101. System memory 103 provides temporary memory space for the execution of these instructions during operation. System memory 103 may include random access memory (RAM), read-only memory, flash memory, or any other suitable memory system.

[0026] Computer system 100 includes an input / output (I / O) adapter 106 and a communications adapter 107 coupled to system bus 102. I / O adapter 106 may be a small computer system interface (SCSI) adapter that communicates with a hard disk 108 and / or any other similar components. I / O adapter 106 and hard disk 108 are collectively referred to herein as mass storage 110.

[0027] Software 111 for execution on computer system 100 can be stored on mass storage 110. Mass storage 110 is an example of a tangible storage medium readable by processor 101, where software 111 is stored as instructions for execution by processor 101 to cause computer system 100 to operate as described herein below with respect to various figures. Examples of computer program products and the execution of such instructions are described in more detail herein. Communications adapter 107 interconnects system bus 102 with network 112, which may be an outside network, enabling computer system 100 to communicate with other such systems. In one embodiment, a portion of system memory 103 and mass storage 110 collectively store an operating system, which may be any suitable operating system for coordinating the functions of the various components shown in FIG. 1 .

[0028] Additional input / output devices are shown connected to system bus 102 via display adapter 115 and interface adapter 116. In one embodiment, adapters 106, 107, 115, and 116 may be connected to one or more I / O buses connected to system bus 102 via an intermediate bus bridge (not shown). A display 119 (e.g., a screen or display monitor) is connected to system bus 102 by display adapter 115, which may include a graphics controller and a video controller to improve performance of graphics-intensive applications. A keyboard 121, a mouse 122, speakers 123, etc. may be interconnected to system bus 102 via interface adapter 116, which may include, for example, a super I / O chip that integrates multiple device adapters into a single integrated circuit. Suitable I / O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols such as Peripheral Component Interconnect (PCI) and Peripheral Component Interconnect Express (PCIe). Thus, as configured in FIG. 1, computer system 100 includes processing functionality in the form of processor 101, storage functionality including system memory 103 and mass storage 110, input means such as keyboard 121 and mouse 122, and output functionality including speakers 123 and display 119.

[0029] In some embodiments, communications adapter 107 may transmit data using any suitable interface or protocol, such as an Internet Small Computer System Interface, among others. Network 112 may be a cellular network, a wireless network, a wide area network (WAN), a local area network (LAN), or the Internet, among others. External computing devices may be connected to computer system 100 through network 112. In some examples, the external computing device may be an external web server or a cloud computing node.

[0030] It should be understood that the block diagram of Figure 1 is not intended to indicate that computer system 100 includes all of the components shown in Figure 1. Rather, computer system 100 may include any suitable fewer or additional components (e.g., additional memory components, embedded controllers, modules, additional network interfaces, etc.) not shown in Figure 1. Furthermore, the embodiments described herein with respect to computer system 100 may be implemented using any suitable logic, and in various embodiments, logic referred to herein may include any suitable hardware (e.g., a processor, embedded controller, or application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware.

[0031] Figure 2 is a block diagram of a system 200 for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention. Figure 2 shows one or more computer systems 202 coupled to computer systems 220 and 224. Computer system 202 may represent multiple computers in a data center that serves various users. Computer system 220 may represent multiple user computers / devices requesting access to resources on computer system 202. Elements of computer system 100 may be used in and / or integrated with computer systems 202, 220, and 224.

[0032] FIG. 3 is a flowchart of a computer-implemented process 300 for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention. In particular, FIG. 3 incorporates the process of training a generative model 244, as described herein. FIG. 4 shows a block diagram of an example architecture using innocent users to train a generative model 244 in accordance with one or more embodiments of the present invention. The computer-implemented process 300 of FIG. 3 can be implemented using the system 200 shown in FIG. 2 and / or the computer architecture shown in FIG. 4. Accordingly, the computer-implemented process 300 will now be described with reference to the system 200 shown in FIG. 2 and the computer architecture shown in FIG. 4.

[0033] In block 302, the software application 204 on the computer system 202 is configured to receive a query 230 for the targeted database 208 from the computer system 220. The query 230 is a database query directed to the targeted database 208. A user can submit the query 230 from the computer system 220. While the targeted database 208 is used as an example, the query 230 may be directed to any portion of the memory 206, including the targeted database 208 and / or other memory spaces within the memory 206. The computer system 220 is a system for a user. In some exemplary scenarios, the user may be an innocent user. In this context, an innocent user is a user who interacts with the computer system 202 in a normal or authorized manner for authorized activities, for example, in accordance with the policies and procedures of the computer system 202. The computer system 220 can communicate with the computer system 202 over a wired and / or wireless network. Using computer system 220, a user can interface with software application 204 of computer system 202 directly and / or using client application 222. Software application 204 may be implemented as software 111 executing on one or more processors 101, as described in FIG. 1 . Similarly, client application 222 may be implemented using software 111 configured to run on one or more processors 101. Client application 222 may include cookies, plug-ins, thin clients, etc., and client application 222 may function as a piece of computer software that accesses computer system 202. Query 230 may include credentials, and / or credentials may have been previously submitted for query 230.Credentials include, for example, usernames and passwords, account numbers, tokens, physical characteristics of a person, etc. The targeted database 208 can represent a large number of databases. The targeted database 208 can include hundreds, thousands, and / or millions of documents, also known as "big data." According to one or more embodiments, the enormous size of the targeted database 208 requires machine management, processing, and retrieval, for example, using computer-executable instructions (e.g., computer system 202); the targeted database 208 cannot be practically managed, stored, analyzed, and / or processed within a human mind as described herein.

[0034] Referring to FIG. 3 , in block 304, the software application 204 is configured to detect whether the query 230 is fraudulent or benign. In FIG. 3 , the query 230 is determined to be benign, and therefore the user is referred to as a benign user. The software application 204 may use any suitable technique to determine whether a query is benign or fraudulent. For example, the software application 204 may include, integrate with, and / or employ one or more fraudulent query detectors 240. FIG. 4 illustrates a flow 401 from a user to a fraudulent query detector, and flow 402 illustrates a benign query being sent to a targeted database and generative model 244 for training. In FIG. 6 , dashed boxes are not used. The fraudulent query detector 240 may include software executing on one or more processors 101 and / or may include an application-specific integrated circuit (ASIC). The fraudulent query detector may include various intrusion algorithms. The fraudulent query detector 240 may use clustering algorithms, outlier algorithms, and others to detect and distinguish fraudulent queries from benign queries. The fraudulent query detector 240 can be configured to detect attempts to inject commands into a database system or otherwise initiate transactions to gain unauthorized access to records within the database system. The fraudulent query detector 240 can be used to match network traffic (i.e., queries) against a list of known attack patterns, including using a rule-based engine to employ pattern-based rules. The fraudulent query detector 240 can employ anomaly-based methods for detecting web-based intrusions, including analyzing log files or protocol-level information to detect anomalies based on heuristics or data mining techniques. The fraudulent query detector 240 can include other analysis techniques, including tree kernel-based learning as part of natural language processing (NLP). In one or more embodiments, machine learning models can be utilized to detect fraudulent queries.One or more embodiments may not utilize machine learning for the fraudulent query detector. One or more embodiments may utilize any intrusion detection system that can detect the presence of an attacker or attack on a targeted database or the network / environment in which the database is hosted. In other words, an attacker may not have yet interacted with the database, but is recognized as fraudulent based on actions performed on other systems; therefore, by the time they begin interacting with the system, the system already knows they are fraudulent.

[0035] Referring to FIG. 3 , in block 306, the software application 204 on the computer system 202 is configured to generate a response 232 from the targeted database 208 and return the response 232 to the computer system 220. The response 232 may also be referred to as a database response. FIG. 4 shows a diagram of the innocuous database response returned to the innocuous user, including the generative model 244, for training in flows 403 and 404. Using the software application 204, the targeted database 208 may generate the response 232. In one or more embodiments, the query may be interpreted or used as a Structured Query Language (SQL) statement that requests results (i.e., a response) from the targeted database. SQL is a standard language for storing, manipulating, and retrieving data from a database.

[0036] As part of training the generative model 244, in block 308, the software application 204 is configured to anonymize the responses 232 to the queries 230 for innocent users. The software application 204 can include, integrate with, and / or employ one or more data anonymization modules 242. The data anonymization modules 242 can include software applications and / or application-specific integrated circuits executing on one or more processors 101. As generally shown in flow 404 of FIG. 4, data anonymization is a type of information sanitization intended for privacy protection. It is the process of removing personally identifiable information from a dataset so that the people the data describes remain anonymous, but the data itself is not authentic or genuine. The data anonymization module 242 can use various masking techniques to replace the data in the responses 232 with different values ​​while preserving the format and structure of the authentic data (i.e., the original data) from the targeted database 208. As part of training the generative model 244, in block 310, the software application 204 is configured to forward the queries 230 and their corresponding anonymized responses to the generative model 244 for training, as generally shown in flows 402 and 404 of FIG. 4. In block 312, the software application 204 is configured to repeat this process 300 for each benign query to build a dataset of queries and their associated anonymized responses for the generative model 244, as generally shown in flow 405 of FIG. 4. The generative model 244 may be a generative adversarial network (GAN), a type of machine learning framework. Given a training set, the generative model learns to generate new data using the same statistics as the training set. The training set includes benign queries and their corresponding anonymized responses from the targeted database 208.Exemplary algorithms that can be used for generative models include, but are not limited to, Gaussian mixture models (and other types of mixture models), hidden Markov models, probabilistic context-free grammars, Bayesian networks (e.g., naive Bayes, autoregressive models, etc.), averaged one-dependence estimators, latent Dirichlet allocation, variational autoencoders, generative adversarial networks, flow-based generative models, etc. Regarding conditional GANs, GANs can use unsupervised learning, semi-supervised learning, fully supervised learning, and reinforcement learning. In one or more embodiments, GANs can include "indirect" training with a discriminator, which itself can be dynamically updated. A generator can be trained to fool the discriminator, allowing the GAN model to learn in an unsupervised manner. The generative network generates candidates, while the discriminator network evaluates them. The contest is run in terms of data distribution. The generative network learns to map from the latent space to the data distribution of interest, while the discriminator network distinguishes the candidates generated by the generator from the true data distribution. The goal of training the generative network is to increase the discriminator network's error rate (i.e., to "trick" the discriminator network by generating new candidates that the discriminator believes are not synthesized (part of the true data distribution)). A known dataset serves as the discriminator's initial training data. Training a GAN involves presenting it with samples from a training dataset (e.g., harmless queries and their corresponding anonymized responses from the targeted database 208) until it achieves acceptable accuracy. The generator trains based on whether it successfully tricks the discriminator. The candidates synthesized by the generator are then evaluated by the discriminator. The generator is typically a deconvolutional neural network, and the discriminator is generally a convolutional neural network.Although one or more embodiments describe generating honeypot database responses using a conditional GAN ​​model, it should be understood that one or more embodiments may not use a conditional GAN ​​and may employ any mechanism capable of generating honeypot database responses that include realistic-looking data.

[0037] FIG. 5 is a flowchart of a computer-implemented process 500 for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention. The computer-implemented process 500 of FIG. 5 can be implemented using the system 200 shown in FIG. 2. In particular, the generative model 244 is trained to receive queries (including fraudulent queries) and provide spurious responses, which are false responses based on the attacker's prior history. Terms such as fraudulent user, attacker, and unauthorized user can be used interchangeably. FIG. 6 shows a block diagram of an example architecture for the use of dynamic honeypot database response generation to thwart fraudulent users attempting to gain access to a targeted database and to thwart attacks in accordance with one or more embodiments of the present invention. Dashed boxes represent unused functionality in FIG. 6. The process 500 of FIG. 5 will be described with reference to FIGS. 2 and 6. At block 502, a software application 204 on a computer system 202 is configured to receive a query 230 directed to a targeted database 208 from a computer system 220. Again, a user can submit a query 230 from a computer system 220 .

[0038] Referring to FIG. 5, at block 504, software application 204 is configured to detect that query 230 is fraudulent. FIG. 6 shows flow 601 from user to fraudulent query detector, while flow 602 illustrates the detection of a fraudulent query. In FIG. 5, query 230 has been determined to be fraudulent and / or unauthorized, and therefore the user and query are designated as a fraudulent user by software application 204 and processed accordingly. Upon detecting that query 230 is fraudulent, software application 204 is configured to store the fraudulent query in attacker-specific query and response history record 246 for this user designated as the attacker. Attacker-specific query and response history record 246 is a system (e.g., a database system) that stores a log of database queries and corresponding responses for a particular attacker (i.e., user). Such database responses may include both targeted database responses and / or spurious responses (i.e., fake honeypot responses). Additionally, attacker-specific query and response history record 246 includes queries that were initially recognized as harmless before the attacker was detected and their corresponding genuine (e.g., as in FIGS. 3 and 4 ) targeted database responses. Similarly, attacker-specific query and response history record 246 includes queries that were initially recognized as harmless before the attacker was detected and their corresponding fake database responses (i.e., honeypot responses). In one or more embodiments, fraudulent query detector 240 may have a threshold that must be met before a user is classified as fraudulent. Initially, a user may interact with computer system 202 in an unauthorized manner and gradually increase toward unauthorized activity (e.g., queries), all of which are monitored by software application 204. A fraudulent user is, for example, a user who interacts with computer system 202 in an anomalous or unauthorized manner that does not comply with computer system 202 policies and procedures.Once a user is designated as fraudulent or unauthorized by software application 204 (e.g., meeting a threshold of fraudulent query detector 240), all past and current history of the user is stored for reference in attacker-specific query and response history record 246, as described herein. As described above, query 230 may include credentials, and / or credentials may have been previously submitted in response to query 230, which identify the user. These credentials may be utilized to track the user's past and current interactions with computer system 202. In addition to user credentials for identifying and tracking a user, a user may also be identified and tracked by a token associated with that person, an Internet Protocol (IP) address, and the like, all of which are stored for the user in attacker-specific query and response history record 246. Mapping 248 may be a table containing all user information, including credentials associated with the user, along with aliases, so that all of a user's information can be mapped back to that user. The software application 204 can reference the mapping 248 when creating, updating, and accessing the user's attacker-specific query and response history records 246 .

[0039] 5, at block 506, using the previously trained generative model 244, the software application 204 on the computer system 202 is configured to generate a response 232 to the fraudulent query (without accessing the targeted database 208) that is conditioned on (i.e., based on) this particular fraudulent user's attacker-specific query and response history record 246. In this case, the response 232 is a false response, also known as a honeypot response, that is a bogus response that does not include sensitive data contained in the targeted database 208. FIG. 6 illustrates the flow 603 of attacker-specific query and response history information provided to the generative model.

[0040] When generating the spoofed responses, the software application 204 generates the spoofed responses (i.e., honeypot database responses) in such a way that the malicious user receives a response that is consistent with any queries the malicious user has previously submitted. For example, a query previously submitted by a malicious user (who may have been an innocent user at the time of submission) was "Count * from table A." The previous answer received for that query was "4." Based on this user's attacker-specific query and response history record 246, any future queries submitted by this malicious user will receive a response where the total number of rows present in "table A" is equal to or less than 4. By keeping the responses consistent with all of this user's previous queries and responses, the software application 204 ensures that the malicious user is unaware that they have been provided with spoofed data (i.e., honeypot data), as opposed to the authentic targeted data in the targeted database 208. As another example, if a fraudulent user previously submitted a query to erase all data in rows 1-10, any future queries submitted by this fraudulent user for rows 1-10 will receive a response indicating that rows 1-10 are empty, based on this user's attacker-specific query and response history record 246. Software application 204 may be configured to simultaneously (e.g., in real time and / or near real time) generate and provide different fraudulent users with ostensible responses specific to their respective previous queries, thereby providing protection against simultaneous attackers.

[0041] Referring to Figure 5, at block 508, the software application 204 on the computer system 202 is configured to return a response 232 (i.e., a spurious response) to the fraudulent query and store the spurious response along with the corresponding fraudulent query in the fraudulent user's attacker-specific query and response history record 246 at block 510. In one or more embodiments, an anonymization module 242 can be utilized to anonymize the data in the spurious response as an additional precaution before returning it to the fraudulent user. Figure 6 illustrates a flow 604 of the spurious response back to the fraudulent user and back to the attacker-specific query and response history record for future queries. An incident response team on the computer system 224 can collect data related to the attack.

[0042] According to one or more embodiments of the present invention, technical advantages and benefits include a system and method that can protect databases containing personal information from attackers. The system does not require the creation of any honeypot database itself, but instead uses minimal configuration effort. The system can further delay an attacker's awareness that it has been detected, thus leveraging the attacked system to safely monitor the attacker's behavior while keeping the attacker busy with fake database responses. The use of generative models provides an unlimited number of attacker-specific honeypot database responses (i.e., spoofed responses). If an attacker publicly releases a spoofed dataset, this approach allows investigators to link the published spoofed dataset to the specific honeypot database system that generated it, and thus to a specific attacker. The use of generative models also allows the system to generate an infinite amount of data (uniquely) for each attacker, keeping the attacker busy. The system can provide incident response teams with a forensic record of how the attack was carried out and what information in the database was specifically targeted.

[0043] 7 illustrates a flowchart of a computer-implemented method 700 for defending against targeted database attacks through dynamic honeypot database response generation in accordance with one or more embodiments of the present invention. The computer-implemented method 700 of FIG. 7 may be implemented using the system 200 illustrated in FIG. 2. At block 702, the software application 204 of the computer system 202 is configured to receive a query 230 (e.g., a fraudulent query) directed to a targeted database 208. At block 704, the software application 204 of the computer system 202 is configured to determine that the query 230 is from an unauthorized user (e.g., a fraudulent query from a fraudulent user). In block 706, the software application 204 of the computer system 202 is configured to return to the unauthorized user a response 232 (e.g., a sham response that is a honeypot response) generated by a model (e.g., generative model 244), where the response 232 is generated uniquely and dynamically (in real time and / or near real time) to fulfill the query 230, and the model (e.g., generative model 244) is configured to generate a response that is consistent with any previous responses returned to the unauthorized user (e.g., generate (by the generative model 244) a sham response that is consistent with previous responses and queries in the attacker-specific query and response history record 246).

[0044] The model (e.g., generative model 244) is configured to synthesize fake response data of a structure and format consistent with that of an authentic response from the targeted database 208. For example, if the query requests account information and the targeted database 208 typically provides the account information as a nine-digit number, the generative model 244 is configured to provide a fake response that similarly has a nine-digit number. An authentic response is a response that originates from and includes data stored in the targeted database 208. In contrast, the fake response generated by the generative model 244 does not include data that originates from and is stored in the targeted database 208. The model is configured to access a historical record (e.g., attacker-specific query and response historical record 246), which includes any previous queries associated with the unauthorized user and any previous responses returned to the unauthorized user. Generating a response consistent with any previous responses returned to the unauthorized user includes verifying that the data generated in the fake response does not conflict with previous data of any previous responses to the same user. Responses to unauthorized users are generated by the model based on any previous queries received from the unauthorized user. The queries and returned responses are stored in a history record associated with the unauthorized user (e.g., attacker-specific query and response history record 246). The targeted database 208 contains sensitive information, and the model is configured to generate data that excludes the sensitive information. In one or more embodiments, the software application 204 can utilize an anonymization module 242 to anonymize the spurious responses, eliminating any possibility or eventuality that the generative model 244 creates spurious responses (i.e., honeypot responses) that include sensitive information in the targeted database 208.

[0045] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0046] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with the service provider. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0047] The characteristics are as follows:

[0048] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capabilities such as server time and network storage automatically as needed without the need for human interaction with the service provider.

[0049] Wide network access: Functionality is available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (eg, mobile phones, laptops, and PDAs).

[0050] Resource Pooling: Computing resources of a provider are pooled to serve multiple consumers using a multi-tenant model, with multiple different physical and virtual resources dynamically allocated and reallocated according to demand. Consumers generally have no control over or knowledge of the exact location of the resources provided, although location independence is meaningful in that the location can be specified at a higher level of abstraction (e.g., country, state, or data center).

[0051] Rapid Elasticity: Capabilities can be provisioned quickly and adaptively, sometimes automatically, to scale out quickly, and released quickly to scale in quickly. To the consumer, the capacity available for provisioning is often presented as unlimited, and can be purchased at any time in any quantity.

[0052] Metering Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0053] The service model is as follows:

[0054] Software as a Service (SaaS): The functionality offered to the consumer is the use of a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0055] Platform as a Service (PaaS): The capability offered to consumers is the deployment of consumer-created or acquired applications, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration.

[0056] Infrastructure as a Service (IaaS): The functionality offered to consumers is the provisioning of processing, storage, network, and other basic computing resources, upon which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and possibly limited control over selected network components (e.g., host firewalls).

[0057] The deployment model is as follows:

[0058] Private Cloud: Cloud infrastructure is operated solely for one organization. It is managed by the organization or a third party and may reside on-premise or off-premise.

[0059] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community with common interests (e.g., mission, security requirements, policies, and regulatory compliance considerations). It may be managed by the organization or a third party and may reside on-premises or off-premises.

[0060] Public Cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by an organization that sells cloud services.

[0061] Hybrid Cloud: A cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain distinct entities but are tied together by standard or proprietary technologies that allow for data and application portability (e.g., cloud bursting for load balancing between clouds).

[0062] Cloud computing environments are service-oriented, emphasizing statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0063] Referring now to FIG. 8, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10, with which local computing devices used by cloud consumers (e.g., personal digital assistants (PDAs) or mobile phones 54A, desktop computers 54B, laptop computers 54C, and / or automobile computer systems 54N) can communicate. The nodes 10 may communicate with each other. They may be grouped (not shown), physically or virtually, in one or more networks (e.g., private clouds, community clouds, public clouds, and / or hybrid clouds, as described above, or combinations thereof). This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service, thereby eliminating the need for cloud consumers to maintain resources on their local computing devices. The types of computing devices 54A-N shown in FIG. 8 are intended for illustrative purposes only, and it will be understood that the computing nodes 10 and the cloud computing environment 50 can communicate with any type of computerized device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0064] Referring now to Figure 9, there is shown a set of functional abstraction layers provided by cloud computing environment 50 (Figure 8). It should be understood in advance that the components, layers, and functions shown in Figure 9 are intended to be illustrative only, and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0065] Hardware and software layer 60 comprises hardware and software components. Examples of hardware components include mainframe 61, RISC (reduced instruction set computer) architecture-based server 62, server 63, blade server 64, storage device 65, and network and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0066] Examples of virtual entities that may be provided from the abstraction layer provided by the virtualization layer 70 include virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0067] In one example, management layer 80 may provide the following functions: Resource provisioning 81 provides dynamic procurement of computing and other resources used to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and accounting or billing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, and protection of data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides allocation and management of cloud computing resources to meet required service levels. Service level agreement (SLA) planning and fulfillment 85 provides pre-organization and acquisition of cloud computing resources for anticipated future needs in accordance with SLAs.

[0068] Workload tier 90 provides examples of functionality that may utilize a cloud computing environment. Examples of workloads and functionality that may be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, transaction processing 95, and software applications (e.g., software application 204, fraudulent query detector 240, anonymization module 242, generative model 244, etc.) implemented in workloads and functions 96. Software applications may also function in conjunction with and / or be integrated with resource provisioning 81.

[0069] Various embodiments of the present invention are described herein with reference to the associated drawings. Alternative embodiments of the present invention may be devised without departing from the scope of the present invention. Various connection and positional relationships (e.g., above, below, adjacent, etc.) are described between elements in the following description and in the drawings. These connection and / or positional relationships may be direct or indirect unless otherwise specified, and the present invention is not intended to be limited in this respect. Thus, connections between entities may refer to direct or indirect connections, and positional relationships between entities may be direct or indirect positional relationships. Furthermore, various tasks and process steps described herein may be incorporated into a broader procedure or process having additional steps or functions not described in detail herein.

[0070] One or more of the methods described herein may be implemented using any or a combination of the following technologies: discrete logic circuitry having logic gates for performing logical functions on data signals, application specific integrated circuits (ASICs) having appropriate combinatorial logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc., each of which is well known in the art.

[0071] For purposes of brevity, conventional techniques related to making and using aspects of the present invention may or may not be described in detail herein. In particular, various aspects of computing systems and specific computer programs for implementing various technical features described herein are well known. Thus, for purposes of brevity, many conventional implementation details are mentioned only briefly herein or omitted entirely without providing details of well-known systems and / or processes.

[0072] In some embodiments, various functions or operations may be performed at a given location and / or in conjunction with the operation of one or more devices or systems. In some embodiments, a portion of a given function or operation may be performed at a first device or location, and the remaining functions or operations may be performed at one or more additional devices or locations.

[0073] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It should be further understood that the terms "comprises" and / or "comprising," when used herein, specify the presence of stated features, integers, steps, operations, and / or elemental components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elemental components, and / or groups thereof.

[0074] In the following claims, corresponding structure, material, acts, and equivalents of any means-plus-function or step-plus-function element are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The present disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the disclosed form. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the present disclosure. The embodiments were chosen and described to best explain the principles and practical applications of the disclosure and to enable those skilled in the art to understand the disclosure in various embodiments with various modifications suited to the particular uses contemplated.

[0075] The drawings illustrated herein are exemplary. There may be many variations on the diagrams or operations described therein without departing from the scope of this disclosure. For example, operations may be performed in a different order, or operations may be added, deleted, or modified. Also, the term "coupled" indicates that there is a signal path between two elements, and does not imply a direct connection between elements with no intervening elements / connections between them. All of these variations are considered part of this disclosure.

[0076] The following definitions and abbreviations will be used in interpreting the claims and the specification. As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having," "contains," or "containing," or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a composition, mixture, process, method, article, or device that includes a list of elements is not necessarily limited to only those elements and may include a list of other elements not expressly listed or inherent to such composition, mixture, process, method, article, or device.

[0077] Moreover, the term "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" may be understood to include any integer number greater than or equal to one, i.e., 1, 2, 3, 4, etc. The term "plurality" may be understood to include any integer number greater than or equal to two, i.e., 2, 3, 4, 5, etc. The term "coupled" may include both an indirect and a direct "coupled."

[0078] The terms "about," "substantially," "approximately," and variations thereof are intended to include the degree of error associated with measurement of a particular quantity based on the equipment available at the time of filing. For example, "about" can include a range of ±8%, or 5%, or 2% of a given value.

[0079] The present invention may be a system, method and / or computer program product integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium having computer-readable program instructions for causing a processor to implement aspects of the present invention.

[0080] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves in which instructions are recorded, and any suitable combination of the foregoing. Computer-readable storage medium, as used herein, should not be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0081] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium into each computing / processing device, or may be downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may comprise copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium within the respective computing / processing device for storage.

[0082] The computer-readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk® or C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer-readable program instructions may be executed as a standalone software package, entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

[0083] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0084] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may be stored on a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer-readable storage medium having the instructions stored thereon comprises an article of manufacture containing instructions that perform aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0085] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to create a computer-implemented process by causing the computer, other programmable apparatus, or other device to perform a series of operational steps, such that the instructions executing on the computer, other programmable apparatus, or other device perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0086] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur in a different order than that noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or that implements a combination of special-purpose hardware and computer instructions.

[0087] The description of various embodiments of the present invention is presented for purposes of illustration and is not intended to be exhaustive or to be limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the market, or to enable others skilled in the art to understand the embodiments described herein.

Claims

1. receiving, by the computer system, a query directed to the targeted database; determining, by the computer system, that the query is from an unauthorized user; dynamically generating, by the computer system, a composite response consistent with any previous responses associated with each of the unauthorized users to fulfill the query according to the model; and returning, by the computer system, the composite response generated by the model to the unauthorized user. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, wherein determining, by the computer system, that the query is from an unauthorized user comprises sending the query to the model without accessing the targeted database in response to determining that the query is from an unauthorized user.

3. 3. The computer-implemented method of claim 1 or 2, wherein the model is a generative adversarial network (GAN), the GAN being trained based on queries and their corresponding anonymized responses.

4. 4. The computer-implemented method of claim 1, further comprising, in response to determining by the computer system that the query is from an unauthorized user, storing the query and the response in a historical record specific to the unauthorized user, the historical record including any previous queries associated with each of the unauthorized users and any responses corresponding to any of the previous queries, the historical record further including harmless queries that were initially recognized as harmless before the unauthorized user was detected as an attacker, along with genuine responses from the database to the harmless queries before the unauthorized user was detected as an attacker.

5. The step of dynamically generating, by the computer system, a synthetic response consistent with any previous responses associated with each of the unauthorized users to fulfill the query using a model includes the step of synthesizing, by the model, data in the synthetic response in a format consistent with data in authentic responses from the targeted database.

5. A computer-implemented method according to any one of claims 1 to 4.

6. accessing the historical record by the model; 5. The computer-implemented method of claim 4.

7. generating the composite response consistent with any previous responses associated with each of the unauthorized users includes verifying that generated data in the composite response is consistent with previous data in any previous responses; 7. A computer-implemented method according to any one of claims 1 to 6.

8. receiving, by the computer system, a query directed to the targeted database; determining, by the computer system, that the query is from an unauthorized user; dynamically generating, by the computer system, a response to fulfill the query according to the model, the response being consistent with any previous responses returned to the unauthorized user. returning, by the computer system, the response generated by the model to the unauthorized user.

1. A computer-implemented method comprising: A computer-implemented method, wherein generating the response consistent with any previous responses returned to the unauthorized user includes verifying that generated data in the response is consistent with previous data in any previous responses.

9. The method of claim 8, wherein the step of dynamically generating the response includes generating, by the model, the response to the unauthorized user based on any previous queries received from the unauthorized user.

9. A computer-implemented method according to any one of claims 1 to 8.

10. the targeted database includes sensitive information, and dynamically generating the response includes generating data excluding the sensitive information using the model.

10. A computer-implemented method according to any one of claims 1 to 9.

11. a memory having computer-readable instructions; and 1. A system comprising one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations, the operations including: receiving a query directed to the targeted database; determining that the query is from an unauthorized user; dynamically generating a composite response consistent with any previous responses associated with each of the unauthorized users to fulfill the query according to the model; and returning the composite response generated by the model to the unauthorized user. having system.

12. The step of dynamically generating, by a model, a synthetic response consistent with any previous responses associated with each of the unauthorized users to fulfill the query includes the step of synthesizing, by the model, data in the synthetic response in a format consistent with data in authentic responses from the targeted database. The system of claim 11.

13. The operations further include accessing, by the model, a historical record including any previous queries associated with the unauthorized user and any previous responses returned to the unauthorized user.

13. A system according to claim 11 or 12.

14. generating the composite response consistent with any previous responses associated with each of the unauthorized users includes verifying that generated data in the composite response is consistent with previous data in any previous responses; 14. A system according to any one of claims 11 to 13.

15. a memory having computer-readable instructions; and 1. A system comprising one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations, the operations including: receiving a query directed to the targeted database; determining that the query is from an unauthorized user; dynamically generating a response consistent with any previous responses returned to the unauthorized user to fulfill the query according to the model; and returning the response generated by the model to the unauthorized user. and The system, wherein the step of generating a response consistent with any previous responses returned to the unauthorized user includes the step of verifying that generated data in the response is consistent with previous data in any previous responses.

16. The method of claim 15, wherein the step of dynamically generating the response includes generating, by the model, the response to the unauthorized user based on any previous queries received from the unauthorized user.

16. A system according to any one of claims 11 to 15.

17. The operation further comprising storing the query and the returned response in a history record associated with the unauthorized user.

17. A system according to any one of claims 11 to 16.

18. the targeted database contains sensitive information, and the step of dynamically generating the response includes generating data excluding the sensitive information using the model.

18. A system according to any one of claims 11 to 17.

19. The processor receiving a query directed to the targeted database; determining that the query is from an unauthorized user; dynamically generating a composite response consistent with any previous responses associated with each of the unauthorized users to fulfill the query according to the model; and returning the composite response generated by the model to the unauthorized users. A computer program for executing

20. The step of dynamically generating a synthetic response consistent with any previous responses associated with each of the unauthorized users to fulfill the query by a model includes the step of synthesizing, by the model, data in the synthetic response in a format consistent with data in authentic responses from the targeted database.

20. A computer program according to claim 19.

21. The method of claim 20, further comprising causing said processor to perform the steps of: accessing a historical record comprising any previous queries associated with said unauthorized user and any previous responses returned to said unauthorized user according to said model; 21. A computer program according to claim 19 or 20.

22. generating the composite response consistent with any of the previous responses associated with each of the unauthorized users includes verifying that generated data in the composite response is consistent with previous data in any of the previous responses; 22. A computer program according to any one of claims 19 to 21.

23. The processor receiving a query directed to the targeted database; determining that the query is from an unauthorized user; dynamically generating a response consistent with any previous responses returned to the unauthorized user to fulfill the query according to the model; a computer program for causing the computer to execute a procedure for returning the response generated by the model to the unauthorized user, the computer program comprising: wherein the step of generating the response consistent with any previous responses returned to the unauthorized user includes the step of verifying that generated data in the response is consistent with previous data in any previous responses.

24. The method of claim 23, wherein the step of dynamically generating the response includes generating, by the model, the response to the unauthorized user based on any previous queries received from the unauthorized user.

24. A computer program according to any one of claims 19 to 23.

25. The method of claim 24, further causing said processor to perform the steps of: storing said query and said returned response in a history record associated with said unauthorized user.

25. A computer program according to any one of claims 19 to 24.

Images