Patent ID: 11936668
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 15:
16. A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method comprising:
aggregating a number of authentication failures from a plurality of connection attempts for an application or a service that services a plurality of clients, wherein respective authentication failures are detected by evaluating encrypted packets of the plurality of connection attempts;
determining that the number of authentication failures is greater than an upper bound number of authentication failures, wherein the upper bound number of authentication failures is determined by an anomalous function using the plurality of connection attempts as input, wherein the anomalous function is defined, at least in part, by a Chebyshev's bound and a Chernoff bound; and
generating an alert indicating a potential credential attack against the application or the service.