ATO Threat Detection Using Dynamic IP Threshold Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting Account Takeover (ATO) threats in online social networks are inadequate in identifying and preventing malicious login attempts, particularly when attackers use multiple IP addresses that differ by one or two octets, leading to false positives and restrictions on legitimate users.
Innovation Solution
An ATO threat detection system that sets different threshold values for solo and group IP addresses, restricting login attempts from suspected groups of IP addresses and using a three-dimensional coordinates system to visualize login attempts, allowing for more precise identification and restriction of malicious activity while exempting whitelisted legitimate IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a single threshold value is used for all IP addresses, then the system is simple to operate, but it cannot distinguish between solo IP addresses and group IP addresses, leading to false positives and restrictions on legitimate users
Solution Approach 1:
The patent segments IP addresses into two categories: solo IP addresses (individual attackers) and group IP addresses (coordinated attack groups). Different threshold values are assigned to each category, allowing the system to apply more stringent limits to group IPs while maintaining higher thresholds for solo IPs, thereby improving detection accuracy without uniformly restricting all users.
Solution Approach 2:
The system applies different threshold values based on the local characteristics of each IP address type. Group IP addresses receive a first threshold value (more restrictive), while solo IP addresses receive a second threshold value (less restrictive). This localized approach ensures that security measures are appropriately tailored to the specific threat level of each IP category.
2Reliability
If the system monitors and restricts login attempts from all IP addresses uniformly, then it can prevent ATO threats, but it causes false positives and interrupts legitimate users
Solution Approach 1:
The system dynamically adjusts the threshold values based on the IP address category. Instead of applying a static threshold to all IPs, the system automatically determines whether an IP belongs to a group or is a solo IP and applies the appropriate threshold dynamically. This dynamic adjustment prevents false positives while maintaining effective ATO prevention.
Solution Approach 2:
The system changes the parameter (threshold value) based on the identified threat type. For group IP addresses suspected of coordinated attacks, a lower first threshold value is applied. For solo IP addresses, a higher second threshold value is applied. This parameter change allows the system to maintain security effectiveness while reducing false positives that would interrupt legitimate users.
3Adaptability or versatility
If the system uses a single threshold value for login attempts, then the configuration is simple, but it fails to account for coordinated attacks from multiple IP addresses
Solution Approach 1:
The patent segments the threshold value structure into two distinct levels: a first threshold value for group IP addresses and a second threshold value for solo IP addresses. This segmentation enables the system to detect coordinated attacks from multiple IPs by applying stricter limits to group IPs, while maintaining operational simplicity through automated classification.
Solution Approach 2:
The dual threshold system serves multiple functions: it detects solo attacks, detects coordinated group attacks, and automatically classifies IPs into appropriate categories. This multi-functionality enhances the system's adaptability to various attack patterns without requiring complex manual configuration for each scenario.
Data Source
AI summary
An Account Takeover (ATO) threat detection system is configured to detect that a group of IP addresses is a suspected group of IP addresses (in that there is an indication that same potentially malicious entity is using a group of IP addresses to attempt logins) and automatically select a lower value that limits how many login attempts from the same IP address are permitted during a predetermined period of time before a login request from the suspected group of IP address is no longer accepted for processing. The limit that is used to restrict login attempts from a single IP address is set to be lower than a solo threshold value.