Replay Attack Detection via Multi-Period Counter Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current approaches to detect replay attacks are insufficient due to the difficulty in identifying malicious activities that utilize valid credentials from one website on another, often masked by legitimate computer systems.
Innovation Solution
A system and method that increment counters for IP addresses and browser attributes across various time periods, generating a score to determine the likelihood of a replay attack, and invalidating credentials if the score indicates a potential attack, while allowing valid users to access web services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current approaches are used to detect replay attacks, then detection capability is limited, but false positives increase and legitimate users are disrupted
Solution Approach 1:
The system segments the detection approach by creating multiple independent counters for different time periods (hourly, daily, weekly, monthly) and different authentication outcomes. This segmentation allows the system to analyze attack patterns at granular levels without blocking legitimate users, as each counter operates independently to build a comprehensive reputation score.
Solution Approach 2:
The system performs preliminary actions by pre-incrementing counters for each time period and authentication outcome before making a final determination. This preliminary tracking of authentication patterns over time allows the system to identify replay attacks based on accumulated evidence rather than single-point failures, reducing false positives.
2Measurement precision
If multiple counters per time period are used to improve detection accuracy, then system complexity increases, but detection precision improves
Solution Approach 1:
The system adds temporal dimensions to the detection process by implementing counters for multiple time periods (hourly, daily, weekly, monthly) alongside authentication outcome dimensions. This multi-dimensional approach enables precise detection of replay attacks by analyzing patterns across time and outcome types, while the structured organization of counters by period and outcome keeps management complexity manageable.
Data Source
AI summary
A system and method detects and handles replay attacks using counters maintained for each of several different periods for various values of IP addresses and browser description attributes encountered.