Patent ID: 7523499

Claim:
A method of detecting an attack on an authentication service, said method comprising: storing data relating to a plurality of authentication requests communicated to an authentication service from a plurality of user agents via a data communication network, said requests each including a login identifier, a network address from which the request was communicated, and a password, and wherein storing the data relating to the requests comprises storing the login identifier and network address and storing the password of each of the requests in a database of the authentication service only if the request is unsuccessful; searching the stored data based on a query variable to identify a plurality of the requests communicated from at least one of the plurality of the user agents, comparing the stored data associated with the identified requests with a predefined pattern characterizing an attack based on the stored data of the identified requests to determine when the identified requests indicate the characterized attack on the authentication service; and detecting the attack in response to determining that the identified requests indicate the characterized attack.