Detecting Brute-Force Attacks

During a Saturday stay at a coffee house, and after my provider OVH informed me that a DDoS attack was currently hitting my vServer, I gave some thought to how one could detect a similar kind of brute-force attack.

1. How does a normal user behave:

• By monitoring patterns such as login times, IP addresses and geographic locations, anomalies that point to a brute-force attack could be detected.

1. IP monitoring:

• Monitor the number of login attempts from a single IP address. An unusually high volume of attempts could indicate a brute-force attack.

1. Time pattern analysis:

• Analyze the time patterns of login attempts to identify sudden spikes at unusual times. If a user normally takes 3 - 8 seconds on average to log in (entering username and password) and suddenly logins are attempted repeatedly in the sub-second range, you can assume something is wrong.

1. CAPTCHA or reCAPTCHA:

• Implement CAPTCHA or reCAPTCHA mechanisms to prevent automated attacks.

1. IP blacklisting:

• Implement an IP blacklist and update it based on suspicious activity. Spamhaus is a good place to get a continuously updated list.

1. User agent analysis:

• Monitor the user agent information in requests. A conspicuous pattern of user agents could point to an automated attack. Keep in mind, though, that it's easy to spoof the user agent.

1. GeoIP filtering:

• Check the geographic origin of login attempts. Sudden login attempts from unusual locations could indicate an attack.

1. Password policies:

• Monitor compliance with password policies. A large number of login attempts with obviously weak passwords could indicate a brute-force attack.

1. Log file monitoring:

• Analyze log files in real time to identify suspicious patterns. This could detect patterns that conventional monitoring tools might miss.