Dynamically blocking credential attacks using identity intelligence
View Patent ↗A computer-implemented apparatus and related method prevent credential attacks. The method receives authentication transactions (ATs) comprising AT features (ATFs). The method then performs clustering, to produce clustered ATFs (CATFs) from the ATFs utilizing rule-based clustering. The clustering may operate by assigning user credentials: 1) from a same source IP to a common CATF; 2) targeting a same username to a common CATF; and/or with a same password to a common CATF. Upon determining a CATF is malicious, the method may classify the CATFs as malicious, and otherwise, classify the CATF as non-malicious. The method may further block an activity using a feature included in a malicious CATF.
1 . A computer-implemented method for preventing credential attacks, comprising:
receiving information that represents authentication transactions (ATs) comprising authentication transaction features (ATFs);
clustering via analyzing the ATFs via machine learning that includes applying a clustering algorithm to the ATFs such that, in response, clustered ATFs (CATFs) are produced, wherein the clustering comprises assigning user credentials with a same password to a common CATF and the CATFs track sequencing of multiple username-password pairs in a first sequence forming a first list applied as login attempts to a first target computer;
inputting the CATFs into a convolutional neural network such that, in response, the convolutional neural network produces as output a classification that a respective CATF of the CATFs is malicious or non-malicious;
in response to the convolutional neural network recognizing the multiple username-password pairs of the first list being applied in the first sequence as login attempts to a second target computer, classifying a first CATF of the CATFs as malicious and generating a blocklist based on one or more features including the multiple username-password pairs of the first sequence of the first list; and
blocking, based on the blocklist, a new activity based on a new sequence matching the first list, wherein the blocking of the new activity comprises blocking access to an account based on attempted logins that include the first sequence of the first list.
2 . The method of claim 1 , further comprising, using a parser:
extracting the ATFs from the ATs; and
labeling the extracted ATFs.
3 . The method of claim 1 , wherein the one or more features of the first CATF further include a user credential.
4 . The method of claim 1 , wherein the password is a hashed password.
5 . The method of claim 1 , further comprising augmenting the CATFs by an external anomaly detection system.
6 . The method of claim 1 , wherein the ATFs are selected from the group consisting of: 1) timestamp; 2) time interval; 3) username; 4) password hash; 5) plaintext password; 6) semantics of password; 7) source IP address; 8) destination IP address; 9) IP reputation: automatic system lookup (ASN), Geo, and categories; and 10) timeseries data.
7 . The method of claim 1 , wherein the clustering is an unsupervised clustering and uses the convolutional neural network (CNN) in the producing of the CATFs.
8 . The method of claim 1 , wherein the ATs are from an authentication service, a web service, and a database service.
9 . The method of claim 1 , wherein the clustering groups the ATFs by source internet protocol address, username, password, and geo information.
10 . The method of claim 1 , further comprising classifying, via a random forest algorithm, the CATFs as malicious or non-malicious.
11 . The method of claim 2 , further comprising aggregating at least one of the ATs and the ATFs to provide further AT context information.
12 . The method of claim 6 , wherein the ATFs comprise all of: 1) timestamp; 2) time interval; 3) username; 4) password hash; 5) plaintext password; 6) semantics of password; 7) source IP address; 8) destination IP address; 9) IP reputation: automatic system lookup (ASN), Geo, and categories; and 10) timeseries data.
13 . The method of claim 6 , wherein the timeseries data comprise at least one of a number of login attempts per time period and a pattern in login attempts.
14 . An apparatus for preventing credential attacks, comprising:
a memory;
a processor; and
program instructions stored in the memory, wherein the program instructions, when executed by the processor, cause the processor to:
receive information that represents authentication transactions (ATs) comprising authentication transaction features (ATFs);
cluster via analyzing the ATFs via machine learning that includes applying a clustering algorithm to the ATFs such that, in response, clustered ATFs (CATFs) are produced, wherein the clustering comprises assigning user credentials with a same password to a common CATF and the CATFs track sequencing of multiple username-password pairs in a first sequence forming a first list applied as login attempts to a first target computer;
inputting the CATFs into a convolutional neural network such that, in response, the convolutional neural network produces as output a classification that a respective CATF of the CATFs is malicious or non-malicious;
in response to the convolutional neural network recognizing the multiple username-password pairs of the first list being applied in the first sequence as login attempts to a second target computer, classifying a first CATF of the CATFs as malicious and generating a blocklist based on one or more features including the multiple username-password pairs of the first sequence of the first list; and
blocking, based on the blocklist, a new activity based on a new sequence matching the first list, wherein the blocking of the new activity comprises blocking access to an account based on attempted logins that include the first sequence of the first list.
15 . The apparatus of claim 14 , wherein the program instructions when executed by the processor further cause the processor to:
extract the ATFs from the ATs via a parser;
label the ATFs via the parser; and
aggregate at least one of the ATs and the ATFs to provide further AT context information.
16 . The apparatus of claim 14 , wherein the one or more features of the first CATF further include a user credential and the password is a hashed password.
17 . The apparatus of claim 14 , wherein the ATFs are selected from the group consisting of: 1) timestamp; 2) time interval; 3) username; 4) password hash; 5) plaintext password; 6) semantics of password; 7) source IP address; 8) destination IP address; 9) IP reputation: automatic system lookup (ASN), Geo, and categories; and 10) timeseries data.
18 . A computer program product for a credential attack prevention apparatus, the computer program product comprising:
one or more computer readable storage media that are non-transitory, and program instructions collectively stored on the one or more computer readable storage media that are non-transitory, the program instructions comprising program instructions to:
receive information that represents authentication transactions (ATs) comprising authentication transaction features (ATFs);
cluster via analyzing the ATFs via machine learning that includes applying a clustering algorithm to the ATFs such that, in response, clustered ATFs (CATFs) are produced, wherein the clustering comprises assigning user credentials with a same password to a common CATF and the CATFs track sequencing of multiple username-password pairs in a first sequence forming a first list applied as login attempts to a first target computer;
inputting the CATFs into a convolutional neural network such that, in response, the convolutional neural network produces as output a classification that a respective CATF of the CATFs is malicious or non-malicious;
in response to the convolutional neural network recognizing the multiple username-password pairs of the first list being applied in the first sequence as login attempts to a second target computer, classifying a first CATF of the CATFs as malicious and generating a blocklist based on one or more features including the multiple username-password pairs of the first sequence of the first list; and
blocking, based on the blocklist, a new activity based on a new sequence matching the first list, wherein the blocking of the new activity comprises blocking access to an account based on attempted logins that include the first sequence of the first list.
19 . The computer program product of claim 18 , wherein the program instructions further comprise program instructions to classify, via a random forest algorithm, the CATFs as malicious or non-malicious.