{"id":"https://openalex.org/W7127941271","doi":"https://doi.org/10.1109/icts67612.2025.11369480","title":"Capturing Post-Login Behaviors in MS SQL Honeypots: Profiling Attackers via a Protocol-Aware TDS Relay","display_name":"Capturing Post-Login Behaviors in MS SQL Honeypots: Profiling Attackers via a Protocol-Aware TDS Relay","publication_year":2025,"publication_date":"2025-11-12","ids":{"openalex":"https://openalex.org/W7127941271","doi":"https://doi.org/10.1109/icts67612.2025.11369480"},"language":"en","primary_location":{"id":"doi:10.1109/icts67612.2025.11369480","doi":"https://doi.org/10.1109/icts67612.2025.11369480","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icts67612.2025.11369480","pdf_url":null,"source":{"id":"https://openalex.org/S7407088155","display_name":"International Conference on Information & Communication Technology and System (ICTS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 15th International Conference on Information & Communication Technology and System (ICTS)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5117172061","display_name":"Ardhi Atmaja Karo Karo","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I100406981","display_name":"Swiss German University","ror":"https://ror.org/047rtk203","country_code":"ID","type":"education","lineage":["https://openalex.org/I100406981"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Ardhi Atmaja Karo Karo","raw_affiliation_strings":["Swiss German University,Information Technology Department,Tangerang,Indonesia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Swiss German University,Information Technology Department,Tangerang,Indonesia","institution_ids":["https://openalex.org/I100406981"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101588651","display_name":"Charles Lim","orcid":"https://orcid.org/0000-0003-0910-5506","observed_orcids":["https://orcid.org/0000-0003-0910-5506"]},"institutions":[{"id":"https://openalex.org/I100406981","display_name":"Swiss German University","ror":"https://ror.org/047rtk203","country_code":"ID","type":"education","lineage":["https://openalex.org/I100406981"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Charles Lim","raw_affiliation_strings":["Swiss German University,Information Technology Department,Tangerang,Indonesia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Swiss German University,Information Technology Department,Tangerang,Indonesia","institution_ids":["https://openalex.org/I100406981"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030238087","display_name":"Kalpin Erlangga Silaen","orcid":"https://orcid.org/0009-0007-9977-6018","observed_orcids":["https://orcid.org/0009-0007-9977-6018"]},"institutions":[{"id":"https://openalex.org/I100406981","display_name":"Swiss German University","ror":"https://ror.org/047rtk203","country_code":"ID","type":"education","lineage":["https://openalex.org/I100406981"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Kalpin Erlangga Silaen","raw_affiliation_strings":["Swiss German University,Information Technology Department,Tangerang,Indonesia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Swiss German University,Information Technology Department,Tangerang,Indonesia","institution_ids":["https://openalex.org/I100406981"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I100406981"],"apc_list":null,"apc_paid":null,"fwci":0.7478,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.59313651,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.864300012588501,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.864300012588501,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.048500001430511475,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.019700000062584877,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sql-server","display_name":"SQL Server","score":0.8560000061988831},{"id":"https://openalex.org/keywords/attacker-profiling","display_name":"attacker profiling","score":0.890999972820282},{"id":"https://openalex.org/keywords/network-scanning","display_name":"network scanning","score":0.4580000042915344}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7336000204086304},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.6152999997138977},{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.550000011920929},{"id":"https://openalex.org/C2777810591","wikidata":"https://www.wikidata.org/wiki/Q16861606","display_name":"Credential","level":2,"score":0.5322999954223633},{"id":"https://openalex.org/C510870499","wikidata":"https://www.wikidata.org/wiki/Q47607","display_name":"SQL","level":2,"score":0.49720001220703125},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.48989999294281006},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.41449999809265137},{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.40149998664855957},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.387800008058548},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.38100001215934753},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.3720000088214874},{"id":"https://openalex.org/C147494362","wikidata":"https://www.wikidata.org/wiki/Q2078905","display_name":"Troubleshooting","level":2,"score":0.35839998722076416},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35199999809265137},{"id":"https://openalex.org/C2778156585","wikidata":"https://www.wikidata.org/wiki/Q174053","display_name":"Relay","level":3,"score":0.33660000562667847},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.319599986076355},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.31850001215934753},{"id":"https://openalex.org/C47487241","wikidata":"https://www.wikidata.org/wiki/Q5227230","display_name":"Data access","level":2,"score":0.30489999055862427},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2935999929904938},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2924000024795532},{"id":"https://openalex.org/C2984286706","wikidata":"https://www.wikidata.org/wiki/Q400708","display_name":"Sql server","level":2,"score":0.275299996137619},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.26260000467300415},{"id":"https://openalex.org/C2983355114","wikidata":"https://www.wikidata.org/wiki/Q161380","display_name":"Credit card","level":3,"score":0.2556000053882599},{"id":"https://openalex.org/C2780898871","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Performance metric","level":2,"score":0.25099998712539673},{"id":"https://openalex.org/C5655090","wikidata":"https://www.wikidata.org/wiki/Q192588","display_name":"Relational database","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icts67612.2025.11369480","doi":"https://doi.org/10.1109/icts67612.2025.11369480","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icts67612.2025.11369480","pdf_url":null,"source":{"id":"https://openalex.org/S7407088155","display_name":"International Conference on Information & Communication Technology and System (ICTS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 15th International Conference on Information & Communication Technology and System (ICTS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320334111","display_name":"Innovation Fund","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W2072627547","https://openalex.org/W2087189381","https://openalex.org/W2153329411","https://openalex.org/W2155070484","https://openalex.org/W2185907055","https://openalex.org/W2523738226","https://openalex.org/W2810097037","https://openalex.org/W2884962025","https://openalex.org/W2978421884","https://openalex.org/W3085628056","https://openalex.org/W3107170288","https://openalex.org/W3111233169","https://openalex.org/W3156178383","https://openalex.org/W3197786100","https://openalex.org/W4237987935","https://openalex.org/W4313315782","https://openalex.org/W4408346303","https://openalex.org/W4408812455","https://openalex.org/W4409494620"],"related_works":["https://openalex.org/W4409494620","https://openalex.org/W2362342579","https://openalex.org/W2922119930","https://openalex.org/W3217731863","https://openalex.org/W2383095955","https://openalex.org/W6963537038","https://openalex.org/W3015022107","https://openalex.org/W7160398066","https://openalex.org/W2356305935","https://openalex.org/W2295528388"],"abstract_inverted_index":{"Microsoft":[0],"SQL":[1,41,104],"Server":[2],"(MS":[3],"SQL)":[4],"is":[5],"a":[6,18,38],"frequent":[7],"target":[8],"of":[9,102],"internet":[10],"scanning":[11],"and":[12,43,47,89,98],"credential":[13],"attacks.":[14],"This":[15],"study":[16],"presents":[17],"safety-first,":[19],"higher-interaction":[20,110],"deception":[21,111],"design":[22],"to":[23,95],"capture":[24],"post-login":[25,79],"behavior":[26],"for":[27],"profiling.":[28,118],"A":[29,74],"protocol-aware":[30,109],"Python":[31],"Tabular":[32],"Data":[33],"Stream":[34],"(TDS)":[35],"relay":[36],"fronts":[37],"loopback-only":[39],"MS":[40,103],"instance":[42],"reconstructs":[44],"PRELOGIN,":[45],"LOGIN7,":[46],"SQLBATCH/RPC":[48],"frames.":[49],"Over":[50],"26":[51],"days,":[52],"the":[53],"deployment":[54],"recorded":[55],"845,597":[56],"TDS":[57],"events":[58],"across":[59],"456,294":[60],"sessions;":[61],"41":[62],"reached":[63],"post-login.":[64],"Among":[65],"those":[66],"sessions,":[67],"75.60%":[68],"showed":[69],"sensitive":[70],"or":[71],"administrative":[72],"actions.":[73],"compact":[75],"metric":[76],"suite":[77],"-":[78,93],"reach":[80],"(PLR),":[81],"sensitive/admin":[82],"prevalence":[83],"score":[84],"(SAPS),":[85],"tool/client":[86],"diversity":[87],"(TCD),":[88],"intelligence":[90],"yield":[91],"(IY)":[92],"introduced":[94],"standardize":[96],"evaluation":[97],"enable":[99],"reproducible":[100],"comparisons":[101],"deception.":[105],"Despite":[106],"limited":[107],"reach,":[108],"produces":[112],"high-signal":[113],"traces":[114],"that":[115],"improve":[116],"attacker":[117]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-02-07T00:00:00"}