System and method for recognizing malicious credential guessing attacks

A system, comprising:

• one or more processors;
• and
• memory including instructions that, as a result of execution by the one or more processors, cause the system to:
• obtain a set of user credentials associated with a user account and at least one counter of a plurality of counters;
• store the set of user credentials and the at least one counter of the plurality of counters;
• as a result of determining that a first attempted set of credentials is distinct from the set of user credentials based at least in part on a use of a filter associated with the counter:
• update the at least one counter;
• and
• store a hash representation of the first attempted set of credentials;
• as a result of determining that a second attempted set of credentials is distinct from the set of user credentials based at least in part on the second attempted set of credentials matching the first attempted set of credentials, maintain a current state of the at least one counter of the plurality of counters;
• as a result of determining that a third attempted set of credentials is distinct from the set of user credentials based at least in part on the third attempted set of credentials being distinct from the second attempted set of credentials and being distinct from the first attempted set of credentials, update the at least one counter of the plurality of counters;
• and
• in response to a determination that the at least one counter of the plurality of counters has reached a predetermined value relative to a security policy threshold, initiate a remediation response in accordance with an applicable security policy.

A non-transitory computer-readable storage medium comprising executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

• store a set of distinct identities and a set of passwords, individual passwords of the set of passwords corresponding to identities in the set of distinct identities;
• as a result of determining that a first attempt to prove password possession is a match to a password in the set of passwords, but that a first identity claim is a mismatch to an identity of the set of distinct identities that corresponds to the password, update at least one counter of the plurality of counters associated with the password;
• as a result of determining that the first identity claim of the first attempt is distinct based at least in part on a use of a filter associated with the at least one counter, store a hash representation of the password and the first identity claim of the first attempt;
• as a result of determining that a second attempt to prove password possession is a match to the password and that a second identity claim, received in association with the second attempt to prove password possession, is a mismatch to the first identity claim based at least in part on information indicated in the stored hash representation, update the at least one counter of the plurality of counters associated with the password;
• and
• in response to determining that the at least one counter of the plurality of counters has reached a predetermined value relative to a threshold, cause a remediation action to be performed.