# US 11,444,962 B2 · Detection of and defense against password spraying attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,962 B2 - Document ID: US11444962B2 - Status: Granted - Kind: B2 - Application number: 16/782,606 - Filed: 2020-02-05 - Published: 2021-08-05 - Granted: 2022-09-13 - Earliest claimed: 2020-02-05 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Jeffery Lake Crume - Web page: https://patentgrep.com/patent/US11444962B2 ## CPC - G06F 21/31: User authentication - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/2255: {Hash tables} - G06F 21/46: by designing passwords or checking the strength of passwords - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Detecting and defending against password spraying attacks is provided. Information is received regarding failed attempts to login to user accounts located on a target system of a network. Each password used to attempt a failed login to any of the user accounts located on the target system is recorded. It is determined whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold. In response to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, an alert is sent regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system. ## Claims ### Claim 1 A method for detecting and defending against password spraying attacks on a network, the method comprising: receiving information regarding failed attempts to login to user accounts located on a target system of the network; recording each password used to attempt a failed login to any of the user accounts located on the target system; determining whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold; and responsive to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, sending an alert regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system, disabling those user accounts for which the common password resulted in the failed login attempt to the number of different user accounts located on the target system, and disabling all other user accounts located on the target system having a same password as the common password that resulted in the failed login attempt to the number of different user accounts located on the target system. ### Claim 2 (depends on 1) The method of claim 1 further comprising: responsive to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, blocking future login attempts from a source system attempting to login to any of the user accounts located on the target system. ### Claim 3 (depends on 1) The method of claim 1, wherein the recording of each password used to login to any of the user accounts located on the target system further includes: maintaining a count of failed login attempts using the common password across any of the user accounts located on the target system; generating a timestamp for a most recent login attempt to a user account using the common password; recording an IP address of a source system that attempted the most recent login attempt to the user account using the common password; and maintaining a list of unique user account names associated with each failed password. ### Claim 4 (depends on 1) The method of claim 1 further comprising: saving each password used to attempt the failed login to any of the user accounts located on the target system in a list of failed passwords along with a timestamp corresponding to each respective failed login; incrementing a password instance counter by one for each same password used to attempt the failed login to any of the user accounts located on the target system; determining whether a most recent use of the common password used in the failed login attempt to the number of different user accounts was within a defined period of time; and responsive to determining that the most recent use of the common password used in the failed login attempt to the number of different user accounts was not within the defined period of time, resetting the password instance counter to zero for that common password. ### Claim 5 (depends on 4) The method of claim 4, wherein each password is saved as a hash in the list of failed passwords to increase password security. ### Claim 6 (depends on 4) The method of claim 4 further comprising: removing a recorded password from the list of failed passwords based on a predetermined period of time elapsing since the recorded password was last used in a corresponding failed login attempt to any of the user accounts located on the target system. ### Claim 7 (depends on 1) The method of claim 1, wherein the predetermined threshold is a predetermined threshold number of different user accounts within a specified period of time. ### Claim 8 A computer system for detecting and defending against password spraying attacks on a network, the computer system comprising: a bus system; a storage device connected to the bus system, wherein the storage device stores program instructions; and a processor connected to the bus system, wherein the processor executes the program instructions to: receive information regarding failed attempts to login to user accounts located on a target system of the network; record each password used to attempt a failed login to any of the user accounts located on the target system; determine whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold; and send an alert regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system in response to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, disable those user accounts for which the common password resulted in the failed login attempt to the number of different user accounts located on the target system, and disable all other user accounts located on the target system having a same password as the common password that resulted in the failed login attempt to the number of different user accounts located on the target system. ### Claim 9 (depends on 8) The computer system of claim 8, wherein the processor further executes the program instructions to: block future login attempts from a source system attempting to login to any of the user accounts located on the target system in response to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold. ### Claim 10 A computer program product for detecting and defending against password spraying attacks on a network, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising: receiving information regarding failed attempts to login to user accounts located on a target system of the network; recording each password used to attempt a failed login to any of the user accounts located on the target system; determining whether a common password is used in a failed login attempt to a number of different user accounts located on the target system greater than or equal to a predetermined threshold; and responsive to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, sending an alert regarding a password spraying attack corresponding to the common password that resulted in the failed login attempt to the number of different user accounts located on the target system, disabling those user accounts for which the common password resulted in the failed login attempt to the number of different user accounts located on the target system, and disabling all other user accounts located on the target system having a same password as the common password that resulted in the failed login attempt to the number of different user accounts located on the target system. ### Claim 11 (depends on 10) The computer program product of claim 10 further comprising: responsive to determining that the common password was used in the failed login attempt to the number of different user accounts on the target system greater than or equal to the predetermined threshold, blocking future login attempts from a source system attempting to login to any of the user accounts located on the target system. ### Claim 12 (depends on 10) The computer program product of claim 10, wherein the recording of each password used to login to any of the user accounts located on the target system further includes: maintaining a count of failed login attempts using the common password across any of the user accounts located on the target system; generating a timestamp for a most recent login attempt to a user account using the common password; recording an IP address of a source system that attempted the most recent login attempt to the user account using the common password; and maintaining a list of unique user account names associated with each failed password. ### Claim 13 (depends on 10) The computer program product of claim 10 further comprising: saving each password used to attempt the failed login to any of the user accounts located on the target system in a list of failed passwords along with a timestamp corresponding to each respective failed login; incrementing a password instance counter by one for each same password used to attempt the failed login to any of the user accounts located on the target system; determining whether a most recent use of the common password used in the failed login attempt to the number of different user accounts was within a defined period of time; and responsive to determining that the most recent use of the common password used in the failed login attempt to the number of different user accounts was not within the defined period of time, resetting the password instance counter to zero for that common password. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein each password is saved as a hash in the list of failed passwords to increase password security.