US 11,722,459 B1
Cumulative sum model for IP deny lists
Bryan D. Hall, Charlotte, NC (US); Richard Joseph Schroeder, Charlotte, NC (US); and Nicola A. Maiorana, Charlotte, NC (US)
Assigned to Wells Fargo Bank, N.A., San Francisco, CA (US)
Filed by Wells Fargo Bank, N.A., San Francisco, CA (US)
Filed on Jun. 7, 2021, as Appl. No. 17/303,776.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/0236 (2013.01) [H04L 63/083 (2013.01); H04L 63/1416 (2013.01); H04L 63/20 (2013.01)] 11 Claims
OG exemplary drawing
 
1. A method comprising:
receiving a plurality of login attempts from a network address over a set length of time;
querying log data to determine, for the network address, an average number of login failures of a first login error type of a plurality of error types of the plurality of login attempts over the set length of time;
calculating a first failure rate metric based on the average number of login failures of the first login error type over the set length of time;
first determining that the first failure rate metric exceeds a first reference number of login failures for the set length of time, the first reference number of login failures based on a historical average number of login failures for the set length of time associated with other network addresses for the first login error type;
querying the log data to determine an average number of login failures, for the network address, of a second login error type of the plurality of error types over the set length of time;
calculating a second failure rate metric based on the average number of login failures of the second login error type over the set length of time;
second determining that the second failure rate metric exceeds a second reference number of login failures of the second login error type for the set length of time, the second reference number of login failures of the second login error type based on a historical number of login failures of the second login error type for the set length of time; and
based in part on the first determining and second determining, adding the network address to a system deny list.