System and method for protecting online resources against guided username guessing attacks
The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.
1. A method for detecting a username guessing attack, comprising:
receiving a stream of multiple authentication events, wherein each authentication event in the stream represents an authentication attempt directed to a computing resource;
attempting to detect a formation of authentication events in the stream of multiple authentication events, wherein the formation comprises a time window of authentication events that satisfy formation criteria that include a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for the computing resource to which the authentication attempt was directed;
when the formation is detected, determining a number of valid usernames in the formation; and
when the number of valid usernames is one or less:
computing a username similarity score for authentication events in the formation, wherein the username similarity score is a function of a string distance between usernames in the formation, and when the username similarity score exceeds a threshold value, reporting a potential username guessing attack.
2. The method of claim 1 , wherein the formation criteria further include one or more of the following:
a number of authentication events in the formation originate from a new IP address, and are associated with different usernames; and
a number of authentication events in the formation are directed to a common computing resource.
3. The method of claim 1 , wherein when the username similarity score exceeds the threshold value, in addition to reporting the potential username guessing attack, the method additionally comprises enforcing a second authentication factor for an account associated with the formation.
4. The method of claim 1 , wherein each authentication event in the multiple stream of authentication events is represented by a data structure, which includes at least one or more of the following attributes:
the username for the authentication attempt;
the IP address from which the authentication attempt originated;
the resource identifier for the computing resource that the authentication attempt was directed to;
a status of the authentication attempt; and
a time of the authentication attempt.
5. The method of claim 1 , wherein when the number of valid usernames is greater than one, the method further comprises:
performing a clustering operation to divide the formation into two or more clusters containing authentication events having similar usernames; and
for each of the two or more clusters, computing a second username similarity score for authentication events in the cluster, and when the second username similarity score exceeds a second threshold value, reporting the potential username guessing attack.
6. The method of claim 5 , wherein performing the clustering operation involves using tri-point clustering.
7. The method of claim 1 , wherein the method is performed by an authentication mechanism in a single sign-on system, which facilitates authentication for multiple computational resources.
8. The method of claim 1 , wherein receiving the stream of multiple authentication events involves converting each authentication event in the stream into a rule comprising attribute-value pairs.
9. The method of claim 8 , wherein after each authentication event is converted into the rule, the rule is stored in a rules database.
10. The method of claim 1 , wherein the method uses one or more formation detectors that execute in parallel while attempting to detect the formation of authentication events, and performing other operations to detect a username guessing attack.
11. A non-transitory, computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for detecting a username guessing attack, the method comprising:
receiving a stream of multiple authentication events, wherein each authentication event in the stream represents an authentication attempt directed to a computing resource;
attempting to detect a formation of authentication events in the stream of multiple authentication events, wherein the formation comprises a time window of authentication events that satisfy formation criteria that include a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for the computing resource to which the authentication attempt was directed;
when the formation is detected, determining a number of valid usernames in the formation; and
when the number of valid usernames is one or less:
computing a username similarity score for authentication events in the formation, wherein the username similarity score is a function of a string distance between usernames in the formation, and when the username similarity score exceeds a threshold value, reporting a potential username guessing attack.
12. The non-transitory, computer-readable storage medium of claim 11 , wherein the formation criteria further include one or more of the following:
a number of authentication events in the formation originate from a new IP address, and are associated with different usernames; and
a number of authentication events in the formation are directed to a common computing resource.
13. The non-transitory, computer-readable storage medium of claim 11 , wherein when the username similarity score exceeds the threshold value, in addition to reporting the potential username guessing attack, the method additionally comprises enforcing a second authentication factor for an account associated with the formation.
14. The non-transitory, computer-readable storage medium of claim 11 , wherein each authentication event in the multiple stream of authentication events is represented by a data structure, which includes at least one or more of the following attributes:
the username for the authentication attempt;
the IP address from which the authentication attempt originated;
the resource identifier for the computing resource that the authentication attempt was directed to;
a status of the authentication attempt; and
a time of the authentication attempt.
15. The non-transitory, computer-readable storage medium of claim 11 , wherein when the number of valid usernames is greater than one, the method further comprises:
performing a clustering operation to divide the formation into two or more clusters containing authentication events having similar usernames; and
for each of the two or more clusters, computing a second username similarity score for authentication events in the cluster, and when the second username similarity score exceeds a second threshold value, reporting the potential username guessing attack.
16. The non-transitory, computer-readable storage medium of claim 11 , wherein the method is performed by an authentication mechanism in a single sign-on system, which facilitates authentication for multiple computational resources.
17. The non-transitory, computer-readable storage medium of claim 11 , wherein receiving the stream of multiple authentication events involves converting each authentication event in the stream into a rule comprising attribute-value pairs.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein after each authentication event is converted into the rule, the rule is stored in a rules database.
19. The non-transitory, computer-readable storage medium of claim 11 , wherein the method uses one or more formation detectors that execute in parallel while attempting to detect the formation of authentication events, and performing other operations to detect a username guessing attack.
20. A system that detects a username guessing attack, comprising:
at least one processor and at least one associated memory; and
a detection program that executes on the at least one processor, wherein during operation, the detection program:
receives a stream of multiple authentication events, wherein each authentication event in the stream represents an authentication attempt directed to a computing resource;
attempts to detect a formation of authentication events in the stream of multiple authentication events, wherein the formation comprises a Urns window of authentication events that satisfy formation criteria that include a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for the computing resource to which the authentication attempt was directed;
when the formation is detected, determines a number of valid usernames in the formation; and
when the number of valid usernames is one or less, the detection program additionally:
computes a username similarity score for authentication events in the formation, wherein the username similarity score is a function of a string distance between usernames in the formation, and when the username similarity score exceeds a threshold 26 value, reports a potential username guessing attack.