Credential-stuffing anomaly detection
AssigneeTruist Bank
InventorsMichael Brantley Lewis, Jonathan Zeederberg, Jordan Berry
Life of this patent
Estimating the term…
Abstract
A computer-implemented method includes accessing data associated with log-in attempts of an interactive computing environment from attempt logs. The method further includes detecting a success percentage of log-in attempts by an entity. Additionally, the method includes identifying the entity as a credential-stuffing attacker based at least in part on the success percentage of log-in attempts by the entity. Moreover, the method includes restricting access to the interactive computing environment by the entity.
Claims20
A computing device comprising:
- a processor;
- and
- a non-transitory computer-readable medium comprising instructions that are executable by the processor to cause the processor to:
- detect a first success percentage of a first subset of log-in attempts by a first entity;
- detect a second success percentage of a second subset of the log-in attempts by a second entity;
- identify a first region associated with the first subset of log-in attempts and a second region associated with the second subset of log-in attempts;
- identify the first entity as a credential-stuffing attacker based at least in part on the first success percentage of the first subset of the log-in attempts by the first entity not exceeding a first threshold associated with the first region;
- identify the second entity as performing legitimate bot activities based at least in part on the second success percentage of the second subset of the log-in attempts by the second entity exceeding a second threshold associated with the second region, wherein the first threshold is lower than the second threshold;
- and
- restrict access to an interactive computing environment by the first entity.
A computer-implemented method comprising:
- detecting a first success percentage of a first subset of log-in attempts by a first entity;
- detecting a second success percentage of a second subset of the log-in attempts by a second entity;
- identifying a first region associated with the first subset of log-in attempts and a second region associated with the second subset of log-in attempts;
- identifying the first entity as a credential-stuffing attacker based at least in part on the first success percentage of the first subset of the log-in attempts by the first entity not exceeding a first threshold associated with the first region;
- identifying the second entity as performing legitimate bot activities based at least in part on the second success percentage of the second subset of the log-in attempts by the second entity exceeding a second threshold associated with the second region, wherein the first threshold is lower than the second threshold;
- and
- restricting access to an interactive computing environment by the first entity.
A non-transitory computer-readable medium comprising instructions that are executable by a processing device for causing the processing device to:
- detect a first success percentage of a first subset of log-in attempts by a first entity;
- detect a second success percentage of a second subset of the log-in attempts by a second entity;
- identify a first region associated with the first subset of log-in attempts and a second region associated with the second subset of log-in attempts;
- identify the first entity as a credential-stuffing attacker based at least in part on the first success percentage of the first subset of the log-in attempts by the first entity not exceeding a first threshold associated with the first region;
- identify the second entity as performing legitimate bot activities based at least in part on the second success percentage of the second subset of the log-in attempts by the second entity exceeding a second threshold associated with the second region, wherein the first threshold is lower than the second threshold;
- and
- restrict access to an interactive computing environment by the first entity.
Dependencies are inferred from the claim text.