Detecting compromised credentials in a credential stuffing attack

A method implemented by a network security system comprising one or more security computing devices, server devices, or client devices, the method comprising:

• training a set model based on a first set of spilled credentials, wherein the set model does not comprise any credential of the first set of spilled credentials;
• receiving from a client a first request with a first candidate credential to login to a server;
• testing the first candidate credential for membership in the first set of spilled credentials using the set model;
• and
• performing a negative action when the test indicates membership of the first candidate credential in the first set of spilled credentials.

A non-transitory computer readable medium having stored thereon instructions comprising executable code that, when executed by one or more processors, causes the processors to:

• train a set model based on a first set of spilled credentials, wherein the set model does not comprise any credential of the first set of spilled credentials;
• receive from a client a first request with a first candidate credential to login to a server;
• test the first candidate credential for membership in the first set of spilled credentials using the set model;
• and
• perform a negative action when the test indicates membership of the first candidate credential in the first set of spilled credentials.

A network security system, comprising one or more security computing devices, server devices, or client devices with memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

• train a set model based on a first set of spilled credentials, wherein the set model does not comprise any credential of the first set of spilled credentials;
• receive from a client a first request with a first candidate credential to login to a server;
• test the first candidate credential for membership in the first set of spilled credentials using the set model;
• and
• perform a negative action when the test indicates membership of the first candidate credential in the first set of spilled credentials.