Login Attempt Monitoring via Username Distance Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively mitigate security risks from fraudulent login attempts using compromised user account credentials, particularly in scenarios where multiple incorrect attempts are made with different credentials, often bypassing security measures implemented for individual usernames.
Innovation Solution
A computer-implemented method and system that monitor login attempts by tracking a login attempt counter and calculating the distance between successive usernames, using machine learning models to predict legitimate and fraudulent activity, thereby identifying and blocking potentially fraudulent attempts by enforcing security measures across different usernames.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If account locking is implemented for individual usernames after a threshold of incorrect attempts, then security for individual accounts is improved, but fraudulent attacks using distributed credential lists can still succeed by targeting multiple different usernames
Solution Approach 1:
The patent merges multiple individual account security checks into a unified session-based monitoring system. By combining login attempt data across different usernames within the same user session, the system detects coordinated attacks that target multiple accounts, thereby preventing list validation attacks while maintaining individual account protection
Solution Approach 2:
The login attempt counter and monitoring mechanism serves multiple functions: it protects individual accounts through traditional locking, detects distributed credential attacks by analyzing username patterns, and provides adaptive response capabilities. This multi-functional approach addresses both individual account security and system-wide threat prevention
2Ease of operation
If the system allows multiple login attempts with different usernames, then legitimate users can recover from forgotten credentials, but fraudulent users can validate compromised credential lists
Solution Approach 1:
The system dynamically adjusts its response to login attempts based on real-time analysis of username patterns. For legitimate users attempting to recover credentials, the system allows reasonable variations in username entry. For fraudulent users systematically testing credential lists, the system detects the pattern and blocks further attempts, thereby adapting to different user behaviors
Solution Approach 2:
The system provides feedback by analyzing the relationship between successive usernames in a login session. When username variations exceed expected thresholds or follow systematic patterns characteristic of credential list validation, the system intervenes to block further attempts. This feedback mechanism preserves legitimate credential recovery while preventing fraudulent validation
3Object-affected harmful factors
If the system monitors and compares successive usernames to detect fraud, then list validation attacks are prevented, but system complexity and processing overhead increase
Solution Approach 1:
The system applies partial monitoring by focusing only on the username comparison aspect of login attempts rather than analyzing all authentication parameters. By implementing a relatively simple string comparison operation between successive usernames, the system achieves effective fraud detection without requiring complex analysis, thereby minimizing processing overhead and system complexity
4Object-affected harmful factors
If the system blocks requests based on username distance calculations, then fraudulent attempts are stopped, but legitimate requests with unusual username variations may be blocked
Solution Approach 1:
The system uses parameter changes by establishing dynamic thresholds for username similarity based on the position in the login sequence and the specific pattern of variations. Rather than using fixed blocking rules, the system adjusts its tolerance for username variations to accommodate legitimate user behavior patterns while maintaining sensitivity to fraudulent systematic testing
Data Source
AI summary
Techniques for monitoring for fraudulent login attempts to remote services through an application. The method generally includes receiving a request to connect an application to a remote service. A login attempt counter tracking a number of attempts by a user to connect the application to one or more remote services is incremented. Based on determining that the login attempt counter is less than a maximum number of login attempts predicted to correspond to legitimate login activity in the application, the first username is compared to a second username included in a previous request. A distance is calculated between the first username and the second username, and one or more actions are taken to process the request based on determining whether the calculated distance exceeds a maximum predicted distance between usernames in successive requests that corresponds to legitimate login activity.