User-Level Time-Series Detection for Slow Brute-Force Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to detect slow brute force attacks, as attackers spread password attempts across multiple time windows to evade detection, making traditional threshold-based methods ineffective.
Innovation Solution
A user-level time series analysis is employed to identify anomalous failed login events and post-login activities, combined with security alerts and investigation priorities, to detect and distinguish between successful and unsuccessful attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional threshold-based detection methods are used, then simple implementation is maintained, but detection accuracy for slow brute force attacks deteriorates
Solution Approach 1:
The patent segments the detection problem by analyzing login events at the user level across multiple time windows, dividing the detection task into discrete time-based segments. This allows the system to track patterns across time without requiring complex global analysis, improving detection accuracy while maintaining manageable system complexity through structured time-windowed processing
Solution Approach 2:
The system dynamically adjusts detection parameters based on user-specific behavior patterns and time-windowed analysis. By making the detection thresholds and parameters adaptive rather than static, the system can accurately detect slow brute force attacks without requiring overly complex fixed-rule systems, resolving the contradiction between precision and complexity
2Object-affected harmful factors
If password attempts are spread across multiple time windows, then attack detection difficulty increases, but attacker evasion capability improves
Solution Approach 1:
The system performs preliminary analysis by establishing baseline user behavior patterns and pre-defining time-windowed detection rules. This preliminary preparation enables the system to detect distributed attack patterns without requiring complex real-time analysis during the attack itself, making detection feasible despite the attacker's distribution strategy
Solution Approach 2:
The patent implements continuous monitoring and analysis across multiple time windows, maintaining detection action throughout the attack duration rather than relying on single-point-in-time detection. This continuous action allows the system to aggregate evidence from distributed time windows, overcoming the attacker's evasion strategy while maintaining practical detection complexity
3Measurement precision
If user-level time series analysis is performed, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent segments the time series data into discrete time windows and processes them in batches rather than performing continuous real-time analysis. This segmentation allows the system to maintain high detection accuracy through comprehensive user-level analysis while reducing processing time by working with discrete, manageable data segments rather than continuous streams
Solution Approach 2:
The system performs analysis at the user level rather than attempting comprehensive system-wide analysis, applying partial action focused on individual user behavior patterns. This partial approach maintains high detection accuracy for the target problem while significantly reducing overall processing time and computational resources compared to system-wide analysis
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Methods, systems and computer program products are provided for detection of slow brute force attacks based on user-level time series analysis. A slow brute force attack may be detected based on one or more anomalous failed login events associated with a user, alone or in combination with one or more post-login anomalous activities associated with the user, security alerts associated with the user, investigation priority determined for the user and/or successful logon events associated with the user. An alert may indicate a user is the target of a successful or unsuccessful slow brute force attack. Time-series data (e.g., accounted for in configurable time intervals) may be analyzed on a user-by-user basis to identify localized anomalies and global anomalies, which may be scored and evaluated (e.g., alone or combined with other information) to determine an investigation priority and whether and what alert to issue for a user.