서브메뉴
검색
Characterizing and Detecting Password Guessing Attacks
Characterizing and Detecting Password Guessing Attacks
상세정보
- 자료유형
- 학위논문 서양
- 최종처리일시
- 20250211151352
- ISBN
- 9798382842486
- DDC
- 004
- 서명/저자
- Characterizing and Detecting Password Guessing Attacks
- 발행사항
- [Sl] : Cornell University, 2024
- 발행사항
- Ann Arbor : ProQuest Dissertations & Theses, 2024
- 형태사항
- 187 p
- 주기사항
- Source: Dissertations Abstracts International, Volume: 85-12, Section: B.
- 주기사항
- Advisor: Ristenpart, Thomas.
- 학위논문주기
- Thesis (Ph.D.)--Cornell University, 2024.
- 초록/해제
- 요약Modern authentication systems still mainly rely on passwords for authentication, but little is known about legitimate and malicious user behavior during the authentication process due to the difficulty of collecting information on such a sensitive field. Because passwords are hard to remember and often reused across websites, they are prone to remote guessing attacks in which an attacker iterates through a guess list of credentials, submitting them against a live login system; but existing defenses do not leverage password-based information because of the challenge of collecting such information in a secure way.We address this challenge first by developing a measurement framework called Gossamer for securely recording password-derived measurements, which we used to collect data on 34 million login requests at two universities. Then, we show how we used the data collected by Gossamer to develop a clustering approach called Arana that detects and groups login requests into attack campaigns. Finally, we explore existing timely attack detection mechanisms and evaluate them on Gossamer data along with three new detection methods based on Directed Anomaly Scoring. We also show that these detection methods are vulnerable to evasion attacks by an adaptive attacker.
- 일반주제명
- Computer science
- 일반주제명
- Computer engineering
- 일반주제명
- Information technology
- 키워드
- Authentication
- 키워드
- Passwords
- 키워드
- Privacy
- 키워드
- Security
- 키워드
- Arana
- 기타저자
- Cornell University Computer Science
- 기본자료저록
- Dissertations Abstracts International. 85-12B.
- 전자적 위치 및 접속
- 로그인 후 원문을 볼 수 있습니다.
MARC
008250123s2024 us c eng d■001000017161410
■00520250211151352
■006m o d
■007cr#unu||||||||
■020 ▼a9798382842486
■035 ▼a(MiAaPQ)AAI31243426
■040 ▼aMiAaPQ▼cMiAaPQ
■0820 ▼a004
■1001 ▼aBohuk, Marina Sanusi.▼0(orcid)0000-0003-0242-9575
■24510▼aCharacterizing and Detecting Password Guessing Attacks
■260 ▼a[Sl]▼bCornell University▼c2024
■260 1▼aAnn Arbor▼bProQuest Dissertations & Theses▼c2024
■300 ▼a187 p
■500 ▼aSource: Dissertations Abstracts International, Volume: 85-12, Section: B.
■500 ▼aAdvisor: Ristenpart, Thomas.
■5021 ▼aThesis (Ph.D.)--Cornell University, 2024.
■520 ▼aModern authentication systems still mainly rely on passwords for authentication, but little is known about legitimate and malicious user behavior during the authentication process due to the difficulty of collecting information on such a sensitive field. Because passwords are hard to remember and often reused across websites, they are prone to remote guessing attacks in which an attacker iterates through a guess list of credentials, submitting them against a live login system; but existing defenses do not leverage password-based information because of the challenge of collecting such information in a secure way.We address this challenge first by developing a measurement framework called Gossamer for securely recording password-derived measurements, which we used to collect data on 34 million login requests at two universities. Then, we show how we used the data collected by Gossamer to develop a clustering approach called Arana that detects and groups login requests into attack campaigns. Finally, we explore existing timely attack detection mechanisms and evaluate them on Gossamer data along with three new detection methods based on Directed Anomaly Scoring. We also show that these detection methods are vulnerable to evasion attacks by an adaptive attacker.
■590 ▼aSchool code: 0058.
■650 4▼aComputer science
■650 4▼aComputer engineering
■650 4▼aInformation technology
■653 ▼aAuthentication
■653 ▼aPasswords
■653 ▼aPrivacy
■653 ▼aSecurity
■653 ▼aArana
■690 ▼a0984
■690 ▼a0489
■690 ▼a0464
■71020▼aCornell University▼bComputer Science.
■7730 ▼tDissertations Abstracts International▼g85-12B.
■790 ▼a0058
■791 ▼aPh.D.
■792 ▼a2024
■793 ▼aEnglish
■85640▼uhttp://www.riss.kr/pdu/ddodLink.do?id=T17161410▼nKERIS▼z이 자료의 원문은 한국교육학술정보원에서 제공합니다.
