Credential Attack Blocking via Identity Intelligence Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for detecting credential stuffing attacks are ineffective in learning from historical data, contextualizing attacks, and distinguishing related attacks, leading to high false-positive rates and inability to block malicious login attempts effectively.
Innovation Solution
A system that uses rule-based clustering to group authentication transactions based on features like source IP, username, and password, and employs machine learning algorithms to classify clusters as malicious or non-malicious, enabling targeted blocking of malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based clustering is used to group authentication transactions, then the system can contextualize attacks and learn from historical data, but the device complexity increases due to multiple clustering dimensions and machine learning components
Solution Approach 1:
The patent segments the authentication transaction analysis into distinct clustering dimensions (source IP, username, password) and processes each dimension separately through dedicated clustering modules. This segmentation allows the system to handle complex multi-dimensional data by breaking it down into manageable segments that can be analyzed independently and then integrated, improving detection accuracy while keeping each component's complexity manageable.
Solution Approach 2:
The patent introduces clustered authentication transaction features (CATFs) as intermediary representations that bridge raw authentication transactions and final attack classification. These CATFs serve as intermediate processing artifacts that capture patterns across multiple dimensions, allowing the system to learn from historical data without requiring direct complex interactions between all raw features and classification algorithms.
2Object-affected harmful factors
If the system blocks activities using features from malicious clusters, then credential attacks are prevented, but false positives increase due to potential over-blocking of legitimate activities
Solution Approach 1:
The patent applies partial blocking by targeting specific features within malicious clusters rather than blocking entire source IPs or users. By identifying and blocking only the specific authentication features (username, password, or IP combinations) that form malicious patterns, the system prevents credential attacks while allowing legitimate activities using other features to continue uninterrupted, thereby reducing false positives.
Solution Approach 2:
The patent implements local quality by applying different blocking strategies to different identified patterns. Instead of uniform blocking, the system analyzes the specific characteristics of each malicious cluster and applies targeted blocking rules that match the local pattern characteristics, ensuring that blocking actions are precisely tailored to the detected threat while minimizing impact on legitimate activities.
3Adaptability or versatility
If clustering operates by assigning credentials from same source IP, same username, or same password to common CATF, then the system can identify attack patterns, but the measurement precision challenge increases in distinguishing malicious from non-malicious clusters
Solution Approach 1:
The patent transforms the classification problem by adding temporal and contextual dimensions to the clustering analysis. Instead of solely relying on static feature matching, the system incorporates historical pattern recognition and temporal analysis of authentication sequences, allowing it to distinguish malicious from non-malicious clusters by analyzing patterns across multiple dimensions including time, frequency, and contextual relationships between clustered features.
Solution Approach 2:
The patent implements feedback mechanisms where the classification results of malicious vs. non-malicious clusters are fed back into the clustering process. This feedback loop allows the system to continuously refine its understanding of attack patterns by analyzing classified outcomes and adjusting clustering parameters and thresholds, thereby improving measurement precision over time while maintaining adaptability to new attack variations.
Data Source
AI summary
A computer-implemented apparatus and related method prevent credential attacks. The method receives authentication transactions (ATs) comprising AT features (ATFs). The method then performs clustering, to produce clustered ATFs (CATFs) from the ATFs utilizing rule-based clustering. The clustering may operate by assigning user credentials: 1) from a same source IP to a common CATF; 2) targeting a same username to a common CATF; and/or with a same password to a common CATF. Upon determining a CATF is malicious, the method may classify the CATFs as malicious, and otherwise, classify the CATF as non-malicious. The method may further block an activity using a feature included in a malicious CATF.