Preventing Attacks on Back-End Servers using Masquerading/Honeypots

Perhaps the most significant threats remaining to Web-based applications are back-end server attacks. In general, back-end servers are separate entities that contain more sensitive information such as a database than front-end servers which connect directly to client machines; these front-end servers are typically insulated from such malicious endeavors as denial-of service (DoS) attacks by the ability to massively replicate interfaces. Back-end servers cannot be replicated in the same manner and typically contain sensitive information that is more desirable to attackers; for this reason, back-end servers must be protected from malicious attacks by more stringent means. In this paper, a protective model for back-end servers are be outlined that can provide: (1) network isolation from unauthorized traffic; (2) blacklisting of misbehaving client traffic; and (3) a limitation of the effectiveness of back-end DoS attacks. This is accomplished by the novel combination of honeypot deployment, honeypot masquerading, and strict authentication for back-end server access