Credential spray attack detection

An intrusion detection process for detecting credential spray attacks against a guarded computing system (GCS), the GCS having a plurality of user accounts which have respective user account identifiers, the intrusion detection process comprising:

• locating a digital bucket B which is one of a plurality of N buckets B1 . . . BN with N being at least 2;
• associating a failure count range R with the bucket B, R having at least one endpoint value, the buckets B1 . . . BN associated with respective failure count ranges R1 . . . RN wherein the ranges partition a numeric range from a lowest endpoint of R1 to a highest endpoint of RN, and
• wherein R is one of the ranges R1 . . . RN;
• getting an alert threshold T which is one of a plurality of alert thresholds T1 . . . TN, the alert threshold T representing an amount of user accounts;
• reading access failure event data from an access failure event set, the access failure event set including access failure events which represent failed attempts to use credentials to access user accounts of the GCS;
• inserting in B the identifiers of user accounts whose number of access failure events is in the range R;
• computing an extent E which is one of a plurality of computed extents E1 . . . EN corresponding to the buckets B1 . . . BN, the extent E based on the number of user account identifiers in B;
• and
• generating a spray attack alert when the computed extent E meets or exceeds the alert threshold T;
• whereby the intrusion detection process enhances cybersecurity of the GCS by analyzing GCS access attempt behavior on a per-bucket basis and generating the spray attack alert in response to detection of activity which is consistent with a credential spray attack against the GCS.

A non-transitory storage memory configured with code which upon execution by one or more processors performs an intrusion detection process for detecting credential spray attacks against a guarded computing system (GCS), the GCS having a plurality of user accounts which have respective user account identifiers, the intrusion detection process comprising:

• locating a plurality of N digital buckets B1 . . . BN, with N being at least 2;
• associating respective failure count ranges R1 . . . RN with the buckets B1 . . . BN, wherein the ranges partition a numeric range from a lowest endpoint of R1 to a highest endpoint of RN;
• getting respective alert thresholds T1 . . . TN which each represent an amount of user accounts;
• reading access failure event data from an access failure event set, the access failure event set including access failure events which represent failed attempts to use credentials to access user accounts of the GCS;
• inserting in each bucket Bi of the buckets B 1 . . . BN the identifiers, if any, of user accounts whose number of access failure events is in the corresponding range Ri of the ranges R1 . . . RN;
• computing an extent Ei based on the number of user account identifiers in each respective non-empty bucket Bi;
• and
• generating a spray attack alert when the computed extent Ei meets or exceeds the corresponding alert threshold Ti, for at least one Ti in T1 . . . TN;
• whereby the intrusion detection process enhances cybersecurity of the GCS by analyzing GCS access attempt behavior on a per-bucket basis and generating the spray attack alert in response to a credential spray attack against the GCS.