Use of decoy data in a data store

摘要

Disclosed are various embodiments for identifying a table of non-decoy data matching a set of criteria. Decoy data is inserted into the table of non-decoy data. The decoy data is detected in a result comprising the decoy data, the result generated in response to an access of the data store. An alarm is generated based at least upon the result.

主权项

1. A non-transitory computer-readable medium embodying a program executable in a network device, the program, when executed, causing the at least one computing device to at least:
obtain signature data indicating decoy data as a column of data appended to a plurality of non-decoy data; detect the decoy data among the plurality of non-decoy data by determining whether the column of data is included in a response to an access of a data store, the response being communicated via the network device; perform, responsive to the column of data being included in the response, an action based at least in part on a position of the network device in a network; and wherein the action comprises at least one of generating an alarm, quarantining at least a portion of the response, or logging a detection of the decoy data.