Generation and deployment of honeytokens in relational databases for cyber deception

Abstract

Despite considerable investments in database security, global statistics indicate an exponential increase in data breaches. Organizations are often unaware of data breaches for weeks, months, or even years. Sufficient for adversaries to compromise and ex-filtrate business or mission-critical data. Recent research suggests using honeytokens for early detection of data breaches in organizations. Existing honeytoken generation methods rely on regular expressions, rule mining, constraint satisfaction, or representation learning, which are complex and limited to a few attributes. We created a framework for generating and deploying honeytokens in relational databases that actively monitor sensitive records and quickly detect data breaches and their misuse. To generate the honeytoken we have used the hierarchical machine learning algorithm which uses a recursive technique to model the parent–child relationships of multi-table databases. The proposed method enables the organization to take remedial action to reduce the impact of data breaches and complement existing database security solutions.