Detecting compromised credentials in a credential stuffing attack
Techniques are provided for detecting compromised credentials in a credential stuffing attack. A set model is trained based on a first set of spilled credentials. The set model does not comprise any credential of the first set of spilled credentials. A first request is received from a client computer with a first candidate credential to login to a server computer. The first candidate credential is tested for membership in the first set of spilled credentials using the set model. In response to determining the first set of spilled credentials includes the first candidate credential using the set model, one or more negative actions is performed.
1. A security computing device, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
train a set model based on a first set of spilled credentials, wherein the trained set model is a probabilistic data structure representing the first set of spilled credentials without comprising any credential of the first set of spilled credentials;
receive from a client a first request with the first candidate credential to login to a server;
determine, with the trained set model, whether the first candidate credential is a member of the first set of spilled credentials; and
perform a negative action in response to the first candidate credential being determined as a member of the first set of spilled credentials.
2. The device of claim 1 , wherein for the perform the negative action, the processors are further configured to be capable of executing the stored programmed instructions to:
terminate the first request without forwarding the first request to the server.
3. The device of claim 1 , wherein for the perform the negative action, the processors are further configured to be capable of executing the stored programmed instructions to:
forward the first request to a website computer with at least one value indicating that the first request is an attack.
4. The device of claim 1 , wherein for the perform the negative action, the processors are further configured to be capable of executing the stored programmed instructions to:
forward the first request to a website computer with at least one value indicating that the first candidate credential in the first request is a spilled credential.
5. A method implemented by a network security system comprising one or more security computing devices, server devices, or client devices, the method comprising:
training a set model based on a first set of spilled credentials, wherein the trained set model is a probabilistic data structure representing the first set of spilled credentials without comprising any credential of the first set of spilled credentials;
receiving from a client a first request with the first candidate credential to login to a server;
determining, with the trained set model, whether the first candidate credential is a member of the first set of spilled credentials; and
performing a negative action in response to the first candidate credential being determined as a member of the first set of spilled credentials.
6. The method of claim 5 , wherein the performing the negative action further comprises:
terminating the first request without forwarding the first request to the server.
7. The method of claim 5 , wherein the performing the negative action further comprises:
forwarding the first request to a website computer with at least one value indicating that the first request is an attack.
8. The method of claim 5 , wherein the performing the negative action further comprises:
forwarding the first request to a website computer with at least one value indicating that the first candidate credential in the first request is a spilled credential.
9. A non-transitory computer readable medium having stored thereon instructions comprising executable code that, when executed by one or more processors, causes the processors to:
train a set model based on a first set of spilled credentials, wherein the trained set model is a probabilistic data structure representing the first set of spilled credentials without comprising any credential of the first set of spilled credentials;
receive from a client a first request with the first candidate credential to login to a server;
determine, with the trained set model, whether the first candidate credential is a member of the first set of spilled credentials; and
perform a negative action in response to the first candidate credential being determined as a member of the first set of spilled credentials.
10. The non-transitory computer readable medium of claim 9 , wherein for the perform the negative action, the executable code, when executed by the processors, further causes the processors to:
terminate the first request without forwarding the first request to the server.
11. The non-transitory computer readable medium of claim 9 , wherein for the perform the negative action, the executable code, when executed by the processors, further causes the processors to:
forward the first request to a website computer with at least one value indicating that the first request is an attack.
12. The non-transitory computer readable medium of claim 9 , wherein for the perform the negative action, the executable code, when executed by the processors, further causes the processors to:
forward the first request to a website computer with at least one value indicating that the first candidate credential in the first request is a spilled credential.
13. A network security system, comprising one or more security computing devices, server devices, or client devices with memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
train a set model based on a first set of spilled credentials, wherein the trained set model is a probabilistic data structure representing the first set of spilled credentials without comprising any credential of the first set of spilled credentials;
receive from a client a first request with the first candidate credential to login to a server;
determine, with the trained set model, whether the first candidate credential is a member of the first set of spilled credentials; and
perform a negative action in response to the first candidate credential being determined as a member of the first set of spilled credentials.
14. The system of claim 13 , wherein for the perform the negative action, the processors are further configured to be capable of executing the stored programmed instructions to:
terminate the first request without forwarding the first request to the server.
15. The system of claim 13 , wherein for the perform the negative action, the processors are further configured to be capable of executing the stored programmed instructions to:
forward the first request to a website computer with at least one value indicating that the first request is an attack.
16. The system of claim 13 , wherein for the perform the negative action, the processors are further configured to be capable of executing the stored programmed instructions to:
forward the first request to a website computer with at least one value indicating that the first candidate credential in the first request is a spilled credential.