Detection of anomalous authentication attempts in a client-server architecture
Computerized systems and methods facilitate detection of anomalous activity during the authentication of login attempts. When a login attempt is made, credentials (e.g., a username and password) are provided. A function call is made to check for anomalous activity. A count of unique usernames attempted during a given time period is compared against a unique username threshold. In some embodiments, a count of login attempts for the current username is also compared against a login attempt threshold. If either (or both) threshold is met or exceeded, an abnormal state is returned, and one or more enhanced authentication requirements are invoked. Alternatively, a normal state is returned, and the credentials are validated. If the login attempt is successful, the username is removed from consideration for anomalous activities checks for other login attempts.
1. One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:
maintaining a log to detect anomalous activity based on login activity of unique usernames including unique usernames that are legitimate or not legitimate, wherein a legitimate username is associated with a user account, wherein each login attempt of a unique username adds the unique username received in the login attempt to the log and increments a count of unique usernames, and wherein a legitimacy of the unique username is not considered when adding the unique username to the log;
receiving, at an authentication server, credentials including a username from a login attempt being made by a client device;
determining the count of unique usernames from a plurality of login attempts within a given time period by retrieving information from the log;
determining whether the count of unique usernames in the log from the plurality of login attempts within the given time period satisfies a unique username threshold;
in response to the count of unique usernames in the log satisfying the unique username threshold, invoking one or more enhanced authentication requirements for the login attempt;
in response to the count of unique usernames not satisfying the unique username threshold, validating the credentials without requiring the one or more enhanced authentication requirements;
determining whether the login attempt has been successfully authenticated;
in response to the login attempt having been successfully authenticated, decrementing the count of unique usernames by removing the unique username including unique usernames that are similar to the unique username received in the successfully authenticated login attempt from the log of unique usernames received from login attempts, wherein the unique usernames that are similar to the unique username include those with transposed letters, or having a similarity as determined by a matching algorithm; and
in response to the login attempt having not been successfully authenticated, maintaining the count of unique usernames by maintaining the unique username within the log of unique usernames received from login attempts.
2. The one or more computer storage media of claim 1 , wherein the count of unique usernames from the plurality of login attempts includes a single count per unique username.
3. The one or more computer storage media of claim 1 , wherein the count of unique usernames from the plurality of login attempts includes a sum of login attempts for each unique username.
4. The one or more computer storage media of claim 1 , wherein the given time period is a rolling time period.
5. The one or more computer storage media of claim 1 , wherein the username is removed by deleting tie a record of username from the log.
6. A system comprising:
one or more processors; and
one or more computer storage media storing computer-useable instructions that, when used by the one or more processors, cause the one or more processors to:
maintain a log to detect anomalous activity based on login activity of unique usernames, wherein each login attempt of a unique username increments a count of unique usernames;
receive at an authentication server, credentials including a username from a login attempt being made by a client device;
determine whether a count of unique usernames from a plurality of login attempts within a first time period satisfies a unique username threshold by retrieving information from the log and whether a count of login attempts for the username within a second time period satisfies a login attempt threshold;
in response to the count of unique usernames in the log satisfying the unique username threshold and/or the count of login attempts for the username satisfying the login attempt threshold, invoke one or more enhanced authentication requirements for the login attempt;
in response to the count of unique usernames in the log not satisfying the unique username threshold and the count of login attempts for the username not satisfying the login attempt threshold, validate the credentials without requiring the one or more enhanced authentication requirements;
determine whether the login attempt has been successfully authenticated;
in response to the login attempt having been successfully authenticated, decrement the count of unique usernames by removing a unique username including unique usernames that are similar to the unique username received in the successfully authenticated login attempt from the log of unique usernames received from login attempts, wherein the unique usernames that are similar to the unique username include those with transposed letters, or having a similarity as determined by a matching algorithm; and
in response to the login attempt having not been successfully authenticated, maintain the count of unique usernames by maintaining the unique username within the log of unique usernames received from login attempts.
7. The system of claim 6 , wherein the first time period and the second time period are the same.
8. The system of claim 6 , wherein the count of unique usernames from the plurality of login attempts within the first time period includes a single count per unique username.
9. The system of claim 6 , wherein the count of unique usernames from the plurality of login attempts within the first time period includes a sum of login attempts for each unique username.
10. The system of claim 6 , wherein the count of unique usernames is decreased by removing a record for the username from the log of unique usernames.
11. The system of claim 6 , wherein the instructions further cause the one or more processors to: reset the count of login attempts for the username to zero based on determining that the login attempt has been successfully authenticated.
12. A computer-implemented method performed by an authentication server in a server-client environment, the method comprising:
maintaining a log to detect anomalous activity based on login activity of unique usernames, wherein each login attempt of a unique username increments a count of unique usernames;
receiving, at the authentication server, credentials including a username from a login attempt submitted by a client device;
determining whether a previous login attempt with the username has occurred during a time period;
in response to determining a previous login attempt with the username has not occurred during the time period, adding the username to the log of unique usernames;
in response to determining a previous login attempt with the username has occurred during the time period, incrementing a count of login attempts for the username;
determining whether the count of unique usernames from the log satisfies a unique username threshold and whether the count of login attempts for the username satisfies a login attempt threshold;
in response to the count of unique usernames from the log satisfying the unique username threshold and/or the count of login attempts for the username satisfying the login attempt threshold, invoking one or more enhanced authentication requirements; and
in response to the count of unique usernames from the log not satisfying the unique username threshold and the count of login attempts for the username not satisfying the login attempt threshold, validating the credentials for the login attempt;
determining whether the login attempt has been successfully authenticated;
in response to the login attempt having been successfully authenticated, decrementing the count of unique usernames by removing the unique username including unique usernames that are similar to the unique username received in the successfully authenticated login attempt from the log of unique usernames received from login attempts, wherein the unique usernames that are similar to the unique username include those with transposed letters, or having a similarity as determined by a matching algorithm; and
in response to the login attempt having not been successfully authenticated, maintaining the count of unique usernames by maintaining the unique username within the log of unique usernames received from login attempts.
13. The method of claim 12 , wherein the log comprises a database, and wherein adding the username to the log comprises adding a new database record for the username to the database.
14. The method of claim 12 , wherein the count of unique usernames from the log includes a single count per unique username.
15. The method of claim 12 , wherein the count of unique usernames from the log includes a sum of login attempts for each unique username.
16. The method of claim 12 , wherein removing the username from the log comprises deleting a record for the username from the log.
17. The method of claim 12 , wherein removing the username from the log comprises unflagging a record for the username from the log.