Adaptive Greylisting for Malicious Login Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems are vulnerable to malicious login attempts, particularly due to credential reuse, spray attacks, spread attacks, and low and slow attacks, which can lead to performance degradation and false positives, and existing greylisting methods are costly and ineffective in covering all malicious use cases.
Innovation Solution
An improved greylisting process that segments login attempts based on IP address classification, using a ratio of successful to total login attempts to determine greylisting, and implements adaptive authentication techniques to differentiate between legitimate and malicious user behavior, thereby blocking malicious attempts at both verification and validation stages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional greylisting methods are used to block malicious login attempts, then security is improved, but operational costs and latency increase
Solution Approach 1:
The patent segments login attempts into different categories (verified, unverified, malicious) and processes them through different pathways. By segmenting the authentication flow, the system can quickly identify and block malicious attempts without subjecting all login attempts to expensive verification processes, thereby reducing latency while maintaining security.
Solution Approach 2:
The system performs preliminary analysis of login attempts to identify malicious patterns before full authentication verification. By detecting malicious behavior early in the authentication flow, the system can block these attempts without incurring the full cost and latency of complete verification processes.
2Reliability
If comprehensive authentication verification is performed on all login attempts, then security is improved, but system performance and productivity deteriorate due to high computational costs
Solution Approach 1:
The patent applies different levels of verification quality to different login attempts based on their characteristics. Verified users receive fast authentication, unverified users undergo intermediate checks, and malicious users are blocked immediately. This local differentiation of verification quality maintains security for legitimate users while reducing computational overhead for obviously malicious attempts.
Solution Approach 2:
Instead of performing full authentication verification on all login attempts, the system applies partial verification to unverified users and excessive blocking to malicious users. This selective application of verification actions reduces overall computational costs while maintaining adequate security through the ratio-based detection mechanism.
3Measurement precision
If adaptive authentication techniques are implemented to differentiate between legitimate and malicious users, then accuracy is improved, but device complexity and operational costs increase
Solution Approach 1:
The system dynamically adjusts its authentication requirements based on user behavior patterns and verification status. Verified users experience a simple authentication flow, while unverified and malicious users encounter progressively more complex verification steps. This dynamic adaptation improves accuracy in identifying malicious users without permanently increasing system complexity for all users.
Data Source
AI summary
Techniques are disclosed for mitigating against malicious login attempts. In some examples, a computer system receives a plurality of login attempts to the system, the plurality of login attempts being originated from an Internet Protocol (IP) subnet. The computer system determines a ratio of successful login attempts to unsuccessful login attempts of the plurality of login attempts. Then, in response to determining that the ratio of a number of successful login attempts to total login attempts is below a predetermined threshold, the computer system denies a future login attempt to the system that is associated with the IP subnet for a first time period.