Mitigating against malicious login attempts

Patent metadata

Field	Value
Publication number	US-11606372-B2
Application number	US-201715847388-A
Country	US
Kind code	B2
Filing date	Dec 19, 2017
Priority date	Dec 19, 2017
Publication date	Mar 14, 2023
Grant date	Mar 14, 2023

Abstract

Techniques are disclosed for mitigating against malicious login attempts. In some examples, a computer system receives a plurality of login attempts to the system, the plurality of login attempts being originated from an Internet Protocol (IP) subnet. The computer system determines a ratio of successful login attempts to unsuccessful login attempts of the plurality of login attempts. Then, in response to determining that the ratio of a number of successful login attempts to total login attempts is below a predetermined threshold, the computer system denies a future login attempt to the system that is associated with the IP subnet for a first time period.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a front-end server, a plurality of login attempts to a computer system;
segmenting collectively the plurality of login attempts into a plurality of segmentation types of login attempts, including segmenting one login attempt of the plurality of login attempts into more than one segmentation type of the plurality of segmentation types, one of the more than one segmentation type including a known IP address, wherein the plurality of segmentation types are associated with respective levels of access permission to access system resources, the levels ranging from lowest level to highest level corresponding to least right to access the system resources to greatest right to access the system resources;
determining the lowest level of access permission for the one login attempt of the respective access permissions associated with the segmentation types into which the one login attempt is segmented; and
implementing, at the front-end server, processing of the one login attempt according to a blacklist, whitelist, or greylist in accordance with its determined level of access permission.

2. The method of claim 1 , wherein:
the plurality of login attempts to the computer system are received across a plurality of front-end servers of the computer system including the front-end server.

3. The method of claim 2 , further comprising:
determining a ratio of a number of successful login attempts to total login attempts of the plurality of login attempts for each segmentation type individually;
wherein the determining the ratio of the number of successful login attempts to total login attempts for each segmentation type individually is performed by a computing device that includes a base data loader that is separate from the plurality of front-end servers.

4. The method of claim 1 ,
wherein the plurality of segmentation types include a geographical location from which the one login attempt originated that corresponds to a particular geographical location; and the method further comprises:
determining that the geographical location corresponds to the particular geographical location;
wherein the implementing, at the front-end server, processing of the one login attempt includes adding the segmentation type having the lowest level of access permission to the greylist in accordance with the determination that the geographical location corresponds to the particular geographical location.

5. The method of claim 1 ,
wherein the plurality of segmentation types include a telecommunications network associated with a mobile device from which the one login attempt originated that corresponds to a particular telecommunication network; and the method further comprises:
determining that the telecommunications network corresponds to the particular telecommunications network;
wherein the implementing, at the front-end server, processing of the one login attempt includes adding the segmentation type having the lowest level of access permission to the greylist in accordance with the determination that the telecommunications network corresponds to the particular telecommunication network.

6. The method of claim 1 :
wherein the segmentation types include an internet service provider (ISP) associated with an IP address from which the one login attempt originated that corresponds to a particular ISP; and the method further comprises:
determining that the ISP corresponds to the particular ISP;
wherein the implementing, at the front-end server, processing of the one login attempt includes adding the segmentation type having the lowest level of access permission to the greylist in accordance with the determination that the ISP corresponds to the particular ISP.

7. The method of claim 1 ,
wherein the segmentation type is login attempts that are associated with a historical bad actor, and the method further comprises:
determining that the login attempts are associated with the historical bad actor;
wherein the implementing, at the front-end server, processing of the one login attempt includes adding the segmentation type having the lowest level of access permission to the greylist in accordance with the determination that the login attempts are associated with the historical bad actor.

8. The method of claim 1 , further comprising:
deciding, at the front end server, whether to blacklist the one login attempt, greylist the one login attempt, or allow the one login attempt to undergo further processing.

9. The method of claim 1 , wherein one of the plurality of segmentation types into which the one login attempt is segmented includes whether or not the login attempt is associated with a historically bad actor.

10. The method of claim 9 , wherein the historically bad actor is an entity that has been previously greylisted.

11. One or more non-transitory computer-readable media bearing instructions that are executable to perform operations comprising:
receiving, at a front-end server, a plurality of login attempts to a computer system;
segmenting collectively the plurality of login attempts into a plurality of segmentation types of alternate classifiers, including segmenting one login attempt of the plurality of login attempts into more than one segmentation type of the plurality of segmentation types, one of the more than one segmentation type including a known IP address, wherein the plurality of segmentation types are associated with respective levels of access permission to access system resources, the levels ranging from lowest level to highest level corresponding to least right to access the system resources to greatest right to access the system resources;
determining lowest level of access permission of the respective access permissions associated with the segmentation types into which the one login attempt is segmented; and
implementing, at the front-end server, processing of the one login attempt according to a blacklist, whitelist, or greylist in accordance with its determined level of access permission.

12. The one or more non-transitory computer-readable media of claim 11 ,
wherein the segmentation type is login attempts that are associated with a historical bad actor, and the operations further comprising:
determining that the login attempts are associated with the historical bad actor;
wherein implementing, at the front-end server, processing of the one login attempt includes adding the segmentation type having the lowest level of access permission to the greylist in accordance with the determination that the login attempts are associated with the historical bad actor.

13. The one or more non-transitory computer-readable media of claim 11 , wherein one of the plurality of segmentation types into which the one login attempt is segmented includes whether or not the login attempt is associated with a historically bad actor.

14. The one or more non-transitory computer-readable media of claim 13 , wherein the historically bad actor is an entity that has been previously greylisted.

Assignees

• T Mobile Usa Inc

Inventors

• Peppe Brett C

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title