A method for distinguishing malicious brute force attacks from benign errors in a series of login attempts, comprising: collecting a plurality of messages from the series of login attempts, wherein each message of the plurality of messages includes an encrypted portion; generating a key array comprising a plurality of keys derived from a password dictionary; applying the keys of the key array to the encrypted portion of a message from the plurality of messages; determining whether the encrypted portion of the message was decrypted to provide a decrypted message and noting a given key of the key array used to decrypt the message; when it is determined that the encrypted portion of the message was not decrypted with any of the keys of the key array: applying the keys of the key array to a subsequent message; determining whether the encrypted portion of the subsequent message was decrypted to provide the decrypted message and noting the given key of the key array used to decrypt the subsequent message; and when the decrypted message has been provided: applying the given key to the encrypted portion of a different message from the plurality of messages; determining whether the encrypted portion of the different message was decrypted with the given key of the key array; when it is determined that the different message was decrypted with the given key, deeming the series of login attempts as benign; and when it is determined that the different message was not decrypted with the given key, deeming the series of login attempts as malicious. collecting a plurality of messages from the series of login attempts, wherein each message of the plurality of messages includes an encrypted portion; generating a key array comprising a plurality of keys derived from a password dictionary; applying the keys of the key array to the encrypted portion of a message from the plurality of messages; determining whether the encrypted portion of the message was decrypted to provide a decrypted message and noting a given key of the key array used to decrypt the message; when it is determined that the encrypted portion of the message was not decrypted with any of the keys of the key array: applying the keys of the key array to a subsequent message; determining whether the encrypted portion of the subsequent message was decrypted to provide the decrypted message and noting the given key of the key array used to decrypt the subsequent message; and when the decrypted message has been provided: applying the given key to the encrypted portion of a different message from the plurality of messages; determining whether the encrypted portion of the different message was decrypted with the given key of the key array; when it is determined that the different message was decrypted with the given key, deeming the series of login attempts as benign; and when it is determined that the different message was not decrypted with the given key, deeming the series of login attempts as malicious. applying the keys of the key array to a subsequent message; determining whether the encrypted portion of the subsequent message was decrypted to provide the decrypted message and noting the given key of the key array used to decrypt the subsequent message; and when the decrypted message has been provided: applying the given key to the encrypted portion of a different message from the plurality of messages; determining whether the encrypted portion of the different message was decrypted with the given key of the key array; when it is determined that the different message was decrypted with the given key, deeming the series of login attempts as benign; and when it is determined that the different message was not decrypted with the given key, deeming the series of login attempts as malicious. applying the given key to the encrypted portion of a different message from the plurality of messages; determining whether the encrypted portion of the different message was decrypted with the given key of the key array; when it is determined that the different message was decrypted with the given key, deeming the series of login attempts as benign; and when it is determined that the different message was not decrypted with the given key, deeming the series of login attempts as malicious.