Set Model Credential Stuffing Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods fail to effectively detect and mitigate credential stuffing attacks, particularly when attackers use unpublished or reused credentials, and hashed credentials are vulnerable to brute force attacks due to differences in salt values across websites.

Innovation Solution

Implementing a set model that represents a set of credentials using hashing functions and salts, where a superset model is trained to determine credential membership without storing actual credentials, and using a network topology with an attack detection computer to identify and neutralize spilled credentials across multiple websites.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If hashed credentials are used to protect accounts, then security is improved, but brute force attacks become more effective due to differences in salt values across websites

Engineering Contradiction:

Improvecredential securityVSAvoidbrute force attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a credential stuffing detection system as an intermediary layer between attackers and website credentials. This system uses a set model trained on spilled credentials to detect and block credential stuffing attacks, preventing brute force attacks from succeeding without exposing actual credentials stored by websites

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If administrators manually detect credential stuffing attacks, then detection accuracy is improved, but response time and operational efficiency deteriorate

Engineering Contradiction:

Improveattack detection accuracyVSAvoidresponse time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system enables automatic self-service detection by implementing a set model that autonomously identifies spilled credentials and detects credential stuffing attacks. The model continuously learns from new spilled credentials and automatically blocks attacks without requiring manual administrator intervention, achieving both high accuracy and rapid response

Inventive Principle:

Principle #25Self-service

3Reliability

If actual credentials are stored for authentication, then authentication reliability is improved, but security deteriorates due to exposure of credentials in case of breaches

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidcredential exposure risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the detection function from the credential storage function. Instead of storing actual credentials for authentication, the system stores only hashed credentials and uses a separate set model for detecting spilled credentials. This separation ensures that even if credentials are exposed, the actual authentication mechanism remains secure and functional

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12126631B2Detecting compromised credentials in a credential stuffing attack

Publication Date: 2024.10.22 SHAPE SECURITY INC

AI summary

Techniques are provided for detecting compromised credentials in a credential stuffing attack. A set model is trained based on a first set of spilled credentials. The set model does not comprise any credential of the first set of spilled credentials. A first request is received from a client computer with a first candidate credential to login to a server computer. The first candidate credential is tested for membership in the first set of spilled credentials using the set model. In response to determining the first set of spilled credentials includes the first candidate credential using the set model, one or more negative actions is performed.