Hashed Incorrect Password Frequency Analysis for Cyber Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in detecting sophisticated cyber attacks that occur slowly over extended periods, as these attacks often go unnoticed amidst legitimate access attempts, leading to potential unauthorized access.
Innovation Solution
Implementing a method that involves one-way hashing of incorrect passwords and storing their hashes in a database, identifying high-frequency hashed incorrect passwords across multiple usernames, and using changing hash seeds to track and detect cyber attacks, which allows for real-time and periodic analysis to mitigate such threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password monitoring methods are used to track incorrect password attempts, then individual account security can be monitored, but sophisticated cyber attacks occurring slowly over extended periods cannot be detected as they blend with legitimate access attempts
Solution Approach 1:
The patent segments the monitoring approach by separating password monitoring into two layers: (1) traditional per-account monitoring for immediate threats, and (2) a new aggregate layer that monitors hashed password frequencies across all accounts. This segmentation enables detection of slow sophisticated attacks without overwhelming system complexity, as the aggregate layer processes only hashed password data rather than full authentication logs.
Solution Approach 2:
The patent introduces hashed incorrect passwords as an intermediary element that bridges individual account monitoring and system-wide threat detection. By hashing passwords before aggregation and using the hashes as the monitoring unit, the system can detect patterns across accounts without exposing sensitive password data or requiring complex correlation of detailed authentication logs.
2Reliability
If all incorrect password attempts are monitored and stored in detail, then comprehensive security analysis is possible, but the system becomes vulnerable to database compromise and increases storage requirements
Solution Approach 1:
The patent extracts only the essential identifying feature of incorrect passwords (the hashed form) for storage and analysis, leaving out sensitive details such as the actual password values, associated usernames, and timing information. This extraction reduces the attack surface for database compromise while maintaining the ability to detect attack patterns through frequency analysis of the hashed values.
Solution Approach 2:
The patent treats hashed password data as disposable information that is useful only for frequency analysis and can be discarded after serving its detection purpose. The hashes are stored temporarily in a database optimized for frequency counting rather than long-term archival, reducing both storage costs and the impact of potential database compromise since the data has limited utility to attackers once its detection function is fulfilled.
3Reliability
If password hashes are stored without changing hash seeds, then historical attack patterns can be tracked, but the system becomes vulnerable to rainbow table attacks and the impact of database compromise increases
Solution Approach 1:
The patent makes the hashing process dynamic by periodically changing the hash seed, transforming a static hashing system into a dynamic one. This allows historical attack pattern tracking within each seed's validity period while preventing rainbow table attacks across different time periods, as the same incorrect password will produce different hashes under different seeds.
Solution Approach 2:
The patent implements periodic changes to the hash seed, creating distinct time periods for hashing operations. During each period, the same hash seed is used consistently to maintain tracking capability, but periodic rotation of the seed breaks the continuity that rainbow tables would require, thereby maintaining both pattern tracking and security against pre-computed attacks.
4Adaptability or versatility
If the system monitors incorrect passwords for each individual username, then account-specific security policies can be enforced, but sophisticated attacks targeting multiple accounts slowly over time remain undetected
Solution Approach 1:
The patent merges individual account monitoring data into an aggregate view by collecting hashed incorrect passwords from all accounts into a single frequency analysis database. This merging enables detection of sophisticated multi-account attacks while preserving account-specific policy enforcement, as the two operations work at different levels: policies are applied per-account using traditional monitoring, while attack detection uses the merged aggregate data to identify patterns across accounts.
Data Source
AI summary
Response to incorrect passwords being entered for usernames in attempts to access a computing system, each incorrect password is one-way hashed. The hashed incorrect passwords are stored within a database. High-frequency hashed incorrect passwords are determined from the stored hashed incorrect passwords. Each high-frequency hashed incorrect password corresponds to an incorrect password that was entered more than a threshold number of the attempts, regardless of the username for which the incorrect password was entered in any attempt. That the computing system is being subjected to a cyber attack is detected based on the determined high-frequency hashed incorrect passwords.