Enhancing OpenCanary Honeypot to Profile Attackers Behavior on MS SQL

The rapid growth of global data emphasizes the critical need for robust, scalable, and secure database systems. Among these, Microsoft SQL Server (MS SQL) stands out as a widely used yet frequently targeted platform for cyberattacks, exposing organizations to risks such as data breaches and operational disruptions. This study leverages deception technologies, employing OpenCanary and Dionaea honeypots to emulate MS SQL environments and gather actionable intelligence on attacker behavior. By analyzing enriched datasets and visualizing attack patterns, the research reveals geographic origins, tools, and attacker profiles, providing valuable insights to inform targeted defense strategies and enhance database security.