Password Spraying Detection via Cross-Tabulated Login Failures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security measures are inadequate in detecting and defending against password spraying attacks, as they often rely on limiting login attempts and identifying a common source, which can be evaded by attackers using spaced-out attempts and multiple accounts, leading to undetected access.
Innovation Solution
A system that monitors and records failed login attempts across all user accounts on a target system, identifying and alerting on common passwords used across a predetermined number of accounts within a specified time, enabling countermeasures such as blocking future attempts and disabling affected accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional account-lockout policies are used to prevent brute-force attacks, then single account security is improved, but password spraying attacks can proceed undetected across multiple accounts
Solution Approach 1:
Instead of monitoring login attempts per source IP address (traditional approach), the patent inverts the monitoring perspective to track failed login attempts per password across multiple user accounts. This reveals password spraying attacks where a single password is attempted against many accounts, while legitimate users attempting different passwords on their own accounts remain unaffected.
Solution Approach 2:
The patent adds a new dimension to login attempt monitoring by tracking the password dimension rather than just the source IP dimension. By creating a cross-tabulation of passwords versus user accounts and monitoring the matrix of failed attempts, the system detects attacks that span multiple accounts with a single password, complementing traditional per-IP rate limiting.
2Difficulty of detecting and measuring
If per-IP rate limiting is implemented to detect attacks, then source-based attacks are detected, but attacks from multiple IPs or spaced-out attempts go undetected
Solution Approach 1:
The patent creates a universal detection mechanism that works against multiple attack patterns simultaneously. By monitoring failed login attempts across the password-user account matrix, the system detects brute-force attacks (multiple passwords on one account), password spraying (one password on many accounts), and distributed attacks (multiple IPs), providing versatile protection against evolving attack methods.
Solution Approach 2:
The system implements feedback by continuously monitoring the matrix of failed login attempts and dynamically adjusting security responses. When a password is attempted against multiple accounts or a single account receives excessive failed attempts, the system can trigger alerts, lockout the affected account, or block the attacking IP, creating a responsive feedback loop that adapts to ongoing attack patterns.
Data Source
AI summary
Detecting and defending against password spraying attacks is provided. Information is received regarding failed attempts to login to user accounts located on a target system of a network. Each password used to attempt a failed login to any of the user accounts located on the target system is recorded. It is determined whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold. In response to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, an alert is sent regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system.