Login Anomaly Detection for Credential-Stuffing Bot Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control methods in interactive computing environments fail to effectively detect and prevent credential-stuffing attacks, which involve automated systems using stolen user credentials to gain unauthorized access.
Innovation Solution
A detection system that analyzes log-in attempt data from logs to identify credential-stuffing attackers based on success percentages and geographical locations, and restricts access accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional access control methods (username/password) are used, then ease of operation is maintained, but security against credential-stuffing attacks deteriorates
Solution Approach 1:
The patent introduces an intermediary anomaly detection computing system that sits between the interactive computing environment and the credential-stuffing attackers. This mediator analyzes log-in attempts from multiple sources (attempt logs, geolocation data, device information) and makes intelligent decisions about whether to allow or block access, thereby protecting the target system while maintaining ease of operation for legitimate users
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring log-in attempts and their outcomes. The anomaly detection system analyzes patterns in successful and unsuccessful log-in attempts, adjusts its understanding of normal versus abnormal behavior, and dynamically modifies access decisions based on this feedback loop, improving security without significantly impacting user experience
2Reliability
If access control is strengthened to prevent credential-stuffing attacks, then security is improved, but ease of operation may deteriorate
Solution Approach 1:
The patent applies local quality by implementing differentiated access control based on the specific characteristics of each log-in attempt. Rather than applying uniform strict controls to all users, the system analyzes individual attempt patterns, device properties, and geolocation data to apply appropriate security measures only where needed, allowing legitimate users to experience minimal disruption while maintaining strong security against attacks
3Reliability
If anomaly detection analysis is performed on log-in attempts, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments the anomaly detection functionality into a separate, dedicated computing system that operates independently from the target interactive computing environment. This segmentation allows the target system to maintain simplicity while the specialized anomaly detection system handles the complex analysis of log-in attempts, geolocation data, and device information through dedicated hardware and software components
Data Source
AI summary
A computer-implemented method includes accessing data associated with log-in attempts of an interactive computing environment from attempt logs. The method further includes detecting a success percentage of log-in attempts by an entity. Additionally, the method includes identifying the entity as a credential-stuffing attacker based at least in part on the success percentage of log-in attempts by the entity. Moreover, the method includes restricting access to the interactive computing environment by the entity.