Graduated Deny Lists for Login Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of digital communication and computing systems makes them vulnerable to persistent malicious login attempts by both human actors and bots, which can lead to account compromise and system overload, locking legitimate users out of their accounts.
Innovation Solution
A threat detection system that includes sensors and detectors to identify non-genuine login attempts by identifying the origin of illicit requests and adding the IP address to a system deny list, utilizing geotargeting machine-learning models and cumulative sum control charts to flag aberrant behavior, and managing a deny list with an aging protocol to dynamically manage network addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a deny list is used to block malicious login attempts, then system security is improved, but legitimate users may be falsely blocked (false positives)
Solution Approach 1:
The deny list is made dynamic through an aging protocol that automatically removes IP addresses after a predetermined period. This transforms the static deny list into a dynamic one that adapts over time, reducing the likelihood of permanently blocking legitimate users while maintaining security against active threats.
Solution Approach 2:
The system performs preliminary analysis of login attempt patterns using machine learning models and cumulative sum control charts before adding IP addresses to the deny list. This preliminary action helps distinguish between malicious bots and legitimate users, reducing false positives before the blocking action is taken.
2Measurement precision
If multiple detection methods are used to identify malicious attempts, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The detection system is segmented into independent functional components: machine learning models for pattern recognition, cumulative sum control charts for statistical analysis, and an aging protocol for list management. This segmentation allows each component to be developed, maintained, and optimized independently while working together to improve detection accuracy.
3Reliability
If the deny list is maintained indefinitely, then security protection is improved, but storage and processing overhead increase
Solution Approach 1:
The aging protocol implements a discard mechanism that automatically removes IP addresses from the deny list after a predetermined period. This prevents the indefinite accumulation of blocked addresses, managing storage overhead while maintaining security protection against active threats. The system recovers storage space by discarding outdated entries that are no longer relevant to current security concerns.
Data Source
AI summary
In an example aspect, a method includes receiving, using a hardware processing device, a first classification of a network address associated with a login attempt as an account validator actor. The method also includes based on the first classification, updating, using the hardware processing device, a system deny list to include the network address for a first length of time. The method also includes after expiration of the first length of time removing the network address from the system deny list, receiving a second of classification of the network address as an account validator actor, and updating the system deny list to include the network address for a second length of time.