Detection of and defense against password spraying attacks

A computer system for detecting and defending against password spraying attacks on a network, the computer system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• receive information regarding failed attempts to login to user accounts located on a target system of the network;
• record each password used to attempt a failed login to any of the user accounts located on the target system;
• determine whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold;
• and
• send an alert regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system in response to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, disable those user accounts for which the common password resulted in the failed login attempt to the number of different user accounts located on the target system, and disable all other user accounts located on the target system having a same password as the common password that resulted in the failed login attempt to the number of different user accounts located on the target system.

A computer program product for detecting and defending against password spraying attacks on a network, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

• receiving information regarding failed attempts to login to user accounts located on a target system of the network;
• recording each password used to attempt a failed login to any of the user accounts located on the target system;
• determining whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold;
• and
• responsive to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, sending an alert regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system, disabling those user accounts for which the common password resulted in the failed login attempt to the number of different user accounts located on the target system, and disabling all other user accounts located on the target system having a same password as the common password that resulted in the failed login attempt to the number of different user accounts located on the target system.