Truist Bank

Michael Brantley Lewis

David Stone

Joseph Aguayo

Yasmin Martinez

Jordan Berry

Doyoung Park

Jonathan Zeederberg

A computer-implemented method includes accessing data associated with log-in attempts of an interactive computing environment from attempt logs. The method further includes detecting a success percentage of log-in attempts by an entity. Additionally, the method includes identifying the entity as a credential-stuffing attacker based at least in part on the success percentage of log-in attempts by the entity. Moreover, the method includes restricting access to the interactive computing environment by the entity.

Credential-stuffing anomaly detection

A system can be used to detect compromised user credential theft via artificial accounts. The system can receive an indication of a compromised user account. The system may generate an artificial user account based on the compromised user account. The system can detect a login to the artificial user account and receive information about one or more actions performed while logged into the artificial user account. Subsequently, the system may generate a profile associated with the artificial user account using the information about the one or more actions performed while logged into the artificial user account and use the profile to prevent a subsequent access to a user account of a plurality of user accounts by a user with a matching profile to the profile.

Detailed compromised user credential theft with artificial accounts

A source of a login attempt to a user account can be classified using machine learning. For example, a computing system can input user activity observations associated with one or more login attempts to one or more user accounts into a trained machine learning model. One or more distinguishing factors for the one or more login attempts can be received from the trained machine learning model. The computing system can determine a source of a current login attempt by applying a clustering algorithm to current values of the one or more distinguishing factors. The current values may be derived from current user activity observations associated with the current login attempt. The computing system can determine an authentication level for the current login attempt to the user account based on the source of the current login attempt.

Growing community of inventors

Nashville, NC, United States of America

Michael Brantley Lewis