Cross-Workload Password Spray Detection With Malware Signal Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to accurately detect password spraying attacks in cloud environments without disrupting legitimate users or misidentifying non-attacking machines, while attackers use low-cost resources and low-and-slow methods to evade detection.
Innovation Solution
Implement a malware detection application on machines to identify password spray tools, combined with failed sign-in attempt tracking and filtering based on tenant information, such as account numbers, subscription types, and creation times, to confirm malicious activity and enable targeted responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection systems monitor failed sign-in attempts to identify password spraying attacks, then attack detection capability is improved, but false positives increase causing legitimate users to be misidentified as attackers
Solution Approach 1:
The detection system segments the analysis by separating malware detection results from authentication failure analysis. The system independently identifies password spray tools using malware detection applications on machines, then cross-references this with authentication service data. This segmentation allows the system to focus on machines with detected malicious tools, significantly reducing false positives while maintaining high detection accuracy.
Solution Approach 2:
The system introduces an intermediary verification layer that combines malware detection application results with authentication service data. This intermediary analysis cross-validates findings by checking both the presence of password spray tools and the pattern of authentication failures, ensuring that only machines with confirmed malicious activity are flagged as attackers.
2Object-affected harmful factors
If detection systems block machines with failed sign-in attempts, then security is improved, but legitimate user operations are disrupted
Solution Approach 1:
The system segments the response action by applying different treatments based on verification results. Machines confirmed to have password spray tools through malware detection are blocked, while machines with only authentication failures but no detected malicious tools are not blocked. This segmented approach ensures security protection is applied only where genuinely needed, preserving legitimate user operations.
Solution Approach 2:
The system performs preliminary identification using malware detection applications before taking blocking actions. By detecting password spray tools in advance and verifying their presence before blocking, the system ensures that only machines with confirmed malicious intent are restricted, preventing disruption to legitimate users while maintaining security.
3Ease of manufacture
If attackers use low-cost resources and low-and-slow methods, then attack cost is reduced, but detection difficulty increases
Solution Approach 1:
The system performs preliminary detection by deploying malware detection applications on machines before authentication attacks occur. This preliminary action identifies password spray tools in advance, allowing the system to flag and monitor suspicious machines before they launch low-and-slow attacks, thereby detecting even subtle malicious activities that traditional post-hoc analysis might miss.
Solution Approach 2:
The system introduces an intermediary malware detection layer that operates independently of authentication service data. This intermediary detection mechanism identifies password spray tools based on their presence and behavior characteristics, enabling the system to detect low-cost, low-and-slow attacks that traditional authentication monitoring alone would struggle to identify.
Data Source
AI summary
A method for detecting password spray attacks. The method includes obtaining information from an on-machine malware detection application for a particular machine indicating that a password spray tool is detected on the particular machine. Information is obtained indicating that the particular machine has performed failed sign in attempts. As a result, a determination is made that the particular machine is performing password spray attacks.