BACKGROUND

Data breach of computing systems is a growing dilemma, one that can expose a wide range of personally identifiable information and/or account credentials. Hackers are becoming increasingly proficient at leveraging stolen account credentials on other systems where users may have adopted the same account credentials. Stolen account credentials can be valid on other systems, particularly in instances where users adopt the same email address and password combination across systems. Hackers will make numerous requests to login to various systems using the stolen account credentials in an attempt to determine if any of the stolen account credentials are valid on these systems. When account credentials are not valid on other systems, hackers patiently hold onto the stolen information, waiting for the possibility that users re-adopt the same account credentials stolen from the initial data breach. In this regard, if owners of the stolen identities set or reset their passwords on these systems to match the stolen passwords, they will unknowingly open their accounts to unlawful access by the hackers.

Computing systems regularly employ password blacklists designed to prevent users from adopting certain passwords in association with their accounts. While traditional methods for blacklisting passwords are generally limited to the user's password history, a system or method that can automatically supplement password blacklists with passwords associated with detected suspicious activities would be highly beneficial.

SUMMARY

Embodiments described herein are directed to improving account security based on identified suspicious patterns of activity. More specifically, records corresponding to a number of failed login attempts are obtained. The records include, among other things, the password, or a variation thereof, used in each failed login attempt. The records also include failed login data that references a location and/or a timestamp associated with each failed login attempt. A suspicious pattern of activity that corresponds to a group of the records is identified. In one embodiment, the suspicious pattern is identified when, among other things, every record in the group of records reveals that the same password was utilized in every failed login attempt. In another embodiment, the suspicious pattern is identified when, among other things, every record in the group reveals that the same piece of failed login data was associated with every failed login attempt. After identifying the suspicious pattern of activity, the password(s) from the group of records that correspond to the suspicious pattern of activity are stored into a password blacklist.

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

