Inline detection of hardcoded credentials attack

Abstract

A hardcoded credential attack detection and prevention system as disclosed herein distinguishes between legitimate uses and malicious uses to prevent attacks using hardcoded credentials without obstructing legitimate uses that still rely on hardcoded credentials. The system collects publicly disclosed hardcoded credentials and creates network traffic based signatures to detect login attempts corresponding to the publicly disclosed hardcoded credentials. The system then uses the created 'login signatures' to detect login attempts corresponding to the hardcoded credentials. While detection with the login signatures occurs inline at individual network devices with visibility of the network traffic, the system obtains relevant network traffic from other network devices to analyze login behavior on a wider scale. This more informed analysis can be profiling, reputation scoring, and/or behavior analysis with the aggregate network traffic to detect malicious use of hardcoded credentials that would go undetected or result in a false positive.