IP Location Classifier for Brute Force Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for mitigating denial of service attacks, particularly brute force attacks, are inadequate as they rely on IP blacklisting and whitelisting, which are ineffective against large botnets that can evade rate limits by spreading requests across multiple IP addresses and geographic locations, leading to increased processing loads and service disruptions.
Innovation Solution
The implementation of an IP geographic location classifier that analyzes intercepted data packets to determine the location of login attempts and verifies if prior successful logins have occurred from the same location, allowing for targeted authentication and mitigation actions such as rate limiting or blocking requests that exceed predetermined login thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP blacklisting and whitelisting methods are used to mitigate brute force attacks, then authentication security is improved, but the system becomes ineffective against large botnets that spread requests across multiple IP addresses and geographic locations
Solution Approach 1:
The patent introduces geographic location as an additional dimension for analyzing login attempts. Instead of relying solely on IP addresses, the system determines the geographic location of each login attempt and compares it with the user's historical login locations. This dimensional expansion allows the system to effectively identify and mitigate distributed botnet attacks that use multiple IP addresses from different geographic locations.
Solution Approach 2:
The system implements a feedback mechanism by storing and analyzing historical login location data for each user account. When a login attempt is made, the system retrieves the user's historical login locations and compares them with the current attempt's geographic location. This feedback loop enables dynamic adaptation to attack patterns while maintaining legitimate user access.
2Productivity
If rate limiting is applied to prevent brute force attacks, then server processing load is reduced, but legitimate users experiencing increased login attempts due to location changes may be incorrectly blocked
Solution Approach 1:
The patent applies local quality by making the authentication decision specific to each user's geographic context. Instead of applying uniform rate limiting to all users, the system evaluates each login attempt individually by comparing its geographic location with that user's historical login locations. This localized approach ensures that rate limiting is applied selectively to malicious attempts while allowing legitimate users to access their accounts regardless of location changes.
3Measurement precision
If geographic location analysis is added to login authentication, then accuracy in identifying malicious attempts is improved, but system complexity and processing time increase
Solution Approach 1:
The system performs preliminary action by pre-storing geographic location data from users' historical login attempts. This historical data is maintained in advance, so when a login attempt occurs, the system can quickly retrieve and compare locations without performing complex real-time geographic analysis. This preliminary preparation significantly reduces the computational complexity and processing time during actual authentication while maintaining high detection accuracy.
Data Source
AI summary
A computer method and system for detecting denial of service network attacks by analyzing intercepted data packets on a network to determine a user account associated with a preselected target host sought to be accessed via a user account login attempt. Determine if the login attempt exceeds a predetermined login value for previous failed login attempts associated with the user account sought to be accessed. Determine a geographic location associated with the login attempt if determined the login attempt exceeded the predetermined login value. Determine if a prior login attempt to the user account sought to be accessed was successful from the determined geographic location. Authenticate the login attempt to the user account sought to be accessed in the event it was determined a prior successful login attempt was made to the user account from the determined geographic location or no prior login attempts originated from the determined geographic location.