Credential-stuffing anomaly detection
A computer-implemented method includes accessing data associated with log-in attempts of an interactive computing environment from attempt logs. The method further includes detecting a success percentage of log-in attempts by an entity. Additionally, the method includes identifying the entity as a credential-stuffing attacker based at least in part on the success percentage of log-in attempts by the entity. Moreover, the method includes restricting access to the interactive computing environment by the entity.
1 . A computing device comprising:
a processor; and
a non-transitory computer-readable medium comprising instructions that are executable by the processor to cause the processor to:
access data associated with log-in attempts of an interactive computing environment from attempt logs;
generate an exclusion list comprising a list of entities that have previously been determined to be legitimate;
compare the data associated with the log-in attempts with the exclusion list;
determine that an entity associated with the log-in attempts is not on the exclusion list;
detect a first success percentage of a first subset of the log-in attempts by a first entity;
detect a second success percentage of a second subset of the log-in attempts by a second entity;
identify the first entity as a credential-stuffing attacker based at least in part on the first success percentage of the first subset of the log-in attempts by the first entity not exceeding a first threshold associated with a first country-of-origin of the first subset of the log-in attempts;
identify the second entity as performing legitimate bot activities based at least in part on the second success percentage of the second subset of the log-in attempts by the second entity exceeding a second threshold associated with a second country-of-origin of the second subset of the log-in attempts, wherein the first threshold is lower than the second threshold; and
restrict access to the interactive computing environment by the first entity.
2 . The computing device of claim 1 , wherein the non-transitory computer-readable medium further comprises instructions that are executable by the processor to cause the processor to:
allow access to the interactive computing environment by the second entity.
3 . The computing device of claim 1 , wherein the non-transitory computer-readable medium further comprises instructions that are executable by the processor to cause the processor to:
determine a number of usernames attempted by the first entity in the first subset of the log-in attempts; and
determine a geographical location of the first entity during the first subset of the log-in attempts, wherein identifying the first entity as the credential-stuffing attacker is further based on the number of usernames attempted and the geographical location of the first entity.
4 . The computing device of claim 3 , wherein using the first success percentage to identify the first entity as the credential-stuffing attacker comprises using a sliding-threshold success percentage, and wherein a threshold success percentage of the sliding-threshold success percentage is adjusted using the number of usernames attempted and the geographical location of the first entity.
5 . The computing device of claim 1 , wherein using the first success percentage to identify the first entity as the credential-stuffing attacker comprises determining that the success percentage is 95 percent when the attempts originate in a first country or is 97 percent when the attempts originate in a second country.
6 . The computing device of claim 1 , wherein identifying the credential-stuffing attacker comprises identifying that the first entity is performing invalid bot traffic.
7 . A computer-implemented method comprising:
accessing, by a processor, data associated with log-in attempts of an interactive computing environment from attempt logs;
generating, by the processor, an exclusion list comprising a list of entities that have previously been determined to be legitimate;
comparing, by the processor, the data associated with the log-in attempts with the exclusion list;
determining, by the processor, that an entity associated with the log-in attempts is not on the exclusion list;
detecting, by the processor, a first success percentage of a first subset of the log-in attempts by a first entity;
detecting, by the processor, a second success percentage of a second subset of the log-in attempts by a second entity
identifying, by the processor, the first entity as a credential-stuffing attacker based at least in part on the first success percentage of the first subset of the log-in attempts by the first entity not exceeding a first threshold associated with a first country-of-origin of the first subset of the log-in attempts;
identifying, by the processor, the second entity as performing legitimate bot activities based at least in part on the second success percentage of the second subset of the log-in attempts by the second entity exceeding a second threshold associated with a second country-of-origin of the second subset of the log-in attempts, wherein the first threshold is lower than the second threshold; and
restricting, by the processor, access to the interactive computing environment by the first entity.
8 . The computer-implemented method of claim 7 , further comprising:
allowing, by the processor, access to the interactive computing environment by the second entity.
9 . The computer-implemented method of claim 7 , further comprising:
determining, by the processor, a number of usernames attempted by the first entity in the first subset of the log-in attempts; and
determining, by the processor, a geographical location of the first entity during the first subset of the log-in attempts, wherein identifying the first entity as the credential-stuffing attacker is further based on the number of usernames attempted and the geographical location of the first entity.
10 . The computer-implemented method of claim 9 , wherein using the first success percentage to identify the first entity as the credential-stuffing attacker comprises using a sliding-threshold success percentage, and wherein a threshold success percentage of the sliding-threshold success percentage is adjusted using the number of usernames attempted and the geographical location of the first entity.
11 . The computer-implemented method of claim 7 , wherein using the first success percentage to identify the first entity as the credential-stuffing attacker comprises determining that the success percentage is 95 percent when the attempts originate in a first country or is 97 percent when the attempts originate in a second country.
12 . The computer-implemented method of claim 7 , wherein identifying the credential-stuffing attacker comprises identifying that the first entity is performing invalid bot traffic.
13 . A non-transitory computer-readable medium comprising instructions that are executable by a processing device for causing the processing device to:
access data associated with log-in attempts of an interactive computing environment from attempt logs;
generate an exclusion list comprising a list of entities that have previously been determined to be legitimate;
compare the data associated with the log-in attempts with the exclusion list;
determine that an entity associated with the log-in attempts is not on the exclusion list;
detect a first success percentage of a first subset of the log-in attempts by a first entity;
detect a second success percentage of a second subset of the log-in attempts by a second entity;
identify the first entity as a credential-stuffing attacker based at least in part on the first success percentage of the first subset of the log-in attempts by the first entity not exceeding a first threshold associated with a first country-of-origin of the first subset of the log-in attempts;
identify the second entity as performing legitimate bot activities based at least in part on the second success percentage of the second subset of the log-in attempts by the second entity exceeding a second threshold associated with a second country-of-origin of the second subset of the log-in attempts, wherein the first threshold is lower than the second threshold; and
restrict access to the interactive computing environment by the first entity.
14 . The non-transitory computer-readable medium of claim 13 , further comprising instructions that are executable by the processing device to cause the processing device to:
allow access to the interactive computing environment by the second entity.
15 . The non-transitory computer-readable medium of claim 13 , further comprising instructions that are executable by the processing device to:
determine a number of usernames attempted by the first entity in the first subset of the log-in attempts; and
determine a geographical location of the first entity during the first subset of the log-in attempts, wherein identifying the first entity as the credential-stuffing attacker is further based on the number of usernames attempted and the geographical location of the first entity.
16 . The non-transitory computer-readable medium of claim 15 , wherein using the first success percentage to identify the first entity as the credential-stuffing attacker comprises using a sliding-threshold success percentage, and wherein a threshold success percentage of the sliding-threshold success percentage is adjusted using the number of usernames attempted and the geographical location of the first entity.
17 . The non-transitory computer-readable medium of claim 13 , wherein identifying the credential-stuffing attacker comprises identifying that the first entity is performing invalid bot traffic.