Microsoft Technology Licensing, LLC

Andrew Numainville

Maria Puertas Calvo

Dana Scott Kaufman

Jingjing Zhang

Pui Yin Winfred Wong

Sergio Romero Zambrano

Abbinayaa Subramanian

Rohini Goyal

Eliza Kuzmenko

Embodiments detect identity attacks by comparing usage of compromised passphrases or other weak credentials in failed sign-in attempts to access restriction conditions. A restriction threshold amount of weak credential failed sign-ins (WCFSI) or a WCFSI increase indicates an identity attack, such as a password spray attack. Going beyond the mere number of failed sign-ins by also considering credential strength allows embodiments to detect attacks sooner than other approaches. An embodiment may also initiate or impose defenses by locking accounts, blocking IP addresses, or requiring additional authentication before access to an account is allowed. Weak credentials may include short passwords, simple passwords, compromised passwords, or wrong usernames, for instance. Password strength testing may be used for attack detection in addition to preventive use on passwords proposed by authorized users. Familiar and unfamiliar traffic source locations may be tracked, as sets or individually.

Identity attack detection and blocking

To detect identity spray attacks, a machine learning model classifies account access attempts as authorized or unauthorized, based on dozens of different pieces of information (machine learning model features). Boosted tree, neural net, and other machine learning model technologies may be employed. Model training data may include user agent reputation data, IP address reputation data, device or agent or location familiarity indications, protocol identifications, aggregate values, and other data. Account credential hash sets or hash lists may serve as model inputs. Hashes may be truncated to further protect user privacy. Classifying an access attempt as unauthorized may trigger application of multifactor authentication, password change requirements, account suspension, or other security enhancements. Statistical or heuristic detections may supplement the model. However, the model may adapt to changed attacker behavior through retraining with updated data, making the model-based approach more effective over time than rigid statistical or heuristic detection approaches.

Identity spray attack detection with adaptive classification

Growing community of inventors

Kent, WA, United States of America

Andrew Numainville