Detection of suspicious access attempts based on access signature

A method, comprising:

• obtaining, by a suspicious access attempt detector, access attempt information corresponding to a plurality of access attempts, wherein access attempt information for each respective access attempt comprises an access signature corresponding to the respective access attempt, and wherein each respective access attempt corresponds to a user device communicating with a network device over a communication network;
• analyzing, by the suspicious access attempt detector, the access attempt information corresponding to the plurality of access attempts to detect suspicious access attempts out of the plurality of access attempts, wherein analyzing the access attempt information is based on respective access signatures corresponding to the plurality of access attempts;
• and
• outputting, by the suspicious access attempt detector, a result of the detection;
• wherein analyzing the access attempt information comprises:
• determining respective numbers of unique access attempts corresponding to respective access signatures;
• and
• applying a filter based on the respective numbers of unique access attempts corresponding to respective access signatures, wherein access attempts corresponding to access signatures for which there are a number of unique access attempts less than a threshold number are not detected as suspicious access attempts.

One or more non-transitory computer-readable mediums having processor-executable instructions stored thereon, wherein the processor-executable instructions, when executed, facilitate:

• obtaining access attempt information corresponding to a plurality of access attempts, wherein access attempt information for each respective access attempt comprises an access signature corresponding to the respective access attempt and an IP address corresponding to the respective access attempt, and wherein each respective access attempt corresponds to a user device communicating with a network device over a communication network;
• analyzing the access attempt information corresponding to the plurality of access attempts to detect suspicious access attempts out of the plurality of access attempts, wherein analyzing the access attempt information is based on respective access signatures corresponding to the plurality of access attempts;
• and
• outputting a result of the detection;
• wherein analyzing the access attempt information comprises:
• determining respective numbers of unique access attempts corresponding to respective access signatures and determining the respective numbers of times respective IP addresses appear in the unique access attempts corresponding to respective access signatures;
• and
• applying a filter based on the respective numbers of unique access attempts corresponding to respective access signatures and the respective numbers of IP addresses corresponding to respective access signatures, wherein based on applying the filter, access attempts corresponding to access signatures for which a respective number of unique access attempts is greater than or equal to a threshold number of unique access attempts and for which a respective IP address appears in unique access attempts for the respective access signature more than a threshold number of times are detected as being suspicious access attempts.