Abstract: An MFA fatigue attack detector has been created that correlates MFA failure events for evaluation against a MFA fatigue attack detection rule to determine whether a user is likely a target of a MFA fatigue attack. The MFA fatigue attack detection rule is defined based on correlation of failure events for a MFA implementation and a determination of a threshold that can be considered a boundary marking the transition of behavior, as represented by the MFA failure events, from non-suspicious to suspicious. To determine what events to correlate and the thresholds for different MFA implementations, network traffic and/or API calls for different IdPs are analyzed. Based on the analysis, failure events are identified and thresholds of correlated failure events (e.g., a time window and number of failure events within the time window) are determined for the implementations that avoid false positives while still protecting users against MFA fatigue attacks.

Abstract: An MFA fatigue attack detector has been created that correlates MFA failure events for evaluation against a MFA fatigue attack detection rule to determine whether a user is likely a target of a MFA fatigue attack. The MFA fatigue attack detection rule is defined based on correlation of failure events for a MFA implementation and a determination of a threshold that can be considered a boundary marking the transition of behavior, as represented by the MFA failure events, from non-suspicious to suspicious. To determine what events to correlate and the thresholds for different MFA implementations, network traffic and/or API calls for different IdPs are analyzed. Based on the analysis, failure events are identified and thresholds of correlated failure events (e.g., a time window and number of failure events within the time window) are determined for the implementations that avoid false positives while still protecting users against MFA fatigue attacks.