Device-based bot detection for sign-in threat detection
A method includes receiving information indicative of a sign-in request associated with an account registered on a service; determining whether the sign-in request comprises a fingerprint, wherein the fingerprint comprises one or more attributes associated with an interaction of a user during a sign-in on the account; dynamically generating a risk score based on a comparison of the one or more attributes of the fingerprint with one or more attributes of a set of attributes collected from a plurality of sign-in requests, wherein the risk score is based on a determination that the fingerprint correlates with attributes in a set of attributes identified as associated with behavior associated with a bot; and in response to the risk score being at or above a risk score threshold, issuing an indication of failure of the sign-in request.
1. A method, comprising:
receiving information indicative of a sign-in request associated with an account registered on a service;
determining whether the sign-in request comprises a fingerprint, wherein the fingerprint comprises one or more attributes associated with an interaction of a user with the service in conjunction with providing credentials during a sign-in attempt on the account;
dynamically generating a risk score based on a comparison of the one or more attributes of the fingerprint with one or more attributes of a set of attributes collected from a plurality of sign-in requests, wherein the set of attributes collected from the plurality of sign-in request are transferred from one or more log entries having a time-to-live value and wherein the risk score is based on a determination that the fingerprint correlates with attributes in a set of attributes identified as associated with behavior associated with a bot; and
in response to the risk score being at or above a risk score threshold, issuing an indication of failure of the sign-in request.
2. The method of claim 1 , wherein the set of attributes is stored in a short-term data store.
3. The method of claim 1 , wherein the dynamically generating step is in response to determining that the sign-in request comprises a fingerprint.
4. The method of claim 1 , wherein the fingerprint comprises one or more of a user credential, an IP address, a sign-in time, a user agent, a key press, a mouse click, or a time-on-page.
5. The method of claim 1 , wherein the dynamically generating step comprises:
generating the risk score based on a number of matched attributes between the fingerprint and the set of attributes from the comparison.
6. The method of claim 1 , wherein the dynamically generating step comprises:
generating the risk score based on a type of matched attributes between the fingerprint and the set of attributes from the comparison.
7. The method of claim 1 , further comprising:
saving, in a log database, at least one log entry comprising one or more attributes of the one or more of the sign-in request and the fingerprint.
8. The method of claim 7 , wherein:
the risk score threshold is based on log entries stored in the log database.
9. The method of claim 7 , further comprising:
assigning the time-to-live value to the one or more transferred log entries.
10. The method of claim 1 , wherein:
the indication of failure of the sign-in request comprises one or more of issuing a challenge, a suspension, or a ban.
11. A system, comprising:
a controller comprising a processor and a non-transitory memory device configured to perform operations comprising:
receiving information indicative of a sign-in request associated with an account associated with a service;
determining whether the sign-in request comprises a fingerprint, wherein the fingerprint comprises one or more attributes associated with an interaction of a user with the service in conjunction with providing credentials during a sign-in attempt;
generating a risk score based on a comparison of the one or more attributes of the fingerprint with one or more attributes of a set of attributes collected from a plurality of sign-in requests, wherein the set of attributes collected from the plurality of sign-in request are transferred from log entries having a time-to-live value and wherein the set of attributes comprises attributes identified as associated with malicious behavior; and
in response to the risk score being at or above a risk score threshold, issuing an indication of failure of the sign-in request.
12. The system of claim 11 , wherein the set of attributes is stored in a short-term data store.
13. The system of claim 11 , wherein the dynamically generating step is in response to determining that the sign-in request comprises a fingerprint.
14. The system of claim 11 , wherein the fingerprint comprises one or more of a user credential, an IP address, a sign-in time, a user agent, a key press, a mouse click, or a time-on-page.
15. The system of claim 11 , wherein the dynamically generating step comprises:
generating the risk score based on a number of matched attributes between the fingerprint and the set of attributes from the comparison.
16. The system of claim 11 , wherein the dynamically generating step comprises:
generating the risk score based on a type of matched attributes between the fingerprint and the set of attributes from the comparison.
17. The system of claim 11 , wherein the controller is configured to perform operations further comprising:
saving, in a log database, at least one log entry comprising one or more attributes of the one or more of the sign-in request and the fingerprint.
18. The system of claim 17 , wherein:
the risk score threshold is based on log entries stored in the log database.
19. The system of claim 17 , wherein the controller is configured to perform operations further comprising:
assigning the time-to-live value to the one or more transferred log entries.
20. A non-transitory computer-readable medium, comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving information indicative of a sign-in request associated with an account associated with a service;
determining whether the sign-in request comprises a fingerprint, wherein the fingerprint comprises one or more attributes associated with an interaction of a user with the service in conjunction with providing credentials during a sign-in attempt;
in response to determining that the sign-in request comprises a fingerprint, dynamically generating a risk score based on a comparison of the one or more attributes of the fingerprint with one or more attributes of a set of attributes collected from a plurality of sign-in requests, wherein the set of attributes collected from the plurality of sign-in request are transferred from log entries having a time-to-live value and wherein the set of attributes comprises attributes identified as associated with malicious behavior; and
in response to the risk score being at or above a risk score threshold, issuing an indication of failure of the sign-in request.