DETECTION OF MALICIOUS ATTEMPTS TO ACCESS A DECOY DATABASE OBJECT BASED ON CONNECTION TYPE

A method by a security system for detecting malicious attempts to access a decoy database object in a database. The database includes database objects accessible by clients of the database called database clients. The method includes detecting access to a decoy database object of the database is being attempted by a database client over a connection to the database, where the decoy database object is a database object that is created for the purpose of deceiving an attacker as opposed to being a legitimate database object, determining that the connection is of an application connection type, where the application connection type is a type of connection over which queries generated by a database client are submitted, and responsive to the determination that the connection is of the application connection type, causing an alert to be generated.