PassREfinder: Credential Stuffing Risk Prediction by Representing Password Reuse between Websites on a Graph

• Published in: 2024 IEEE Symposium on Security and Privacy (SP) pp. 1385 - 1404
• Main Authors: Kim, Jaehan, Song, Minkyoo, Seo, Minjae, Jin, Youngjin, Shin, Seungwon
• Format: Conference Proceeding
• Language: English
• Published: IEEE 19.05.2024
• Subjects: Credential stuffing; Feature extraction; Graph neural network; Graph neural networks; Image edge detection; Password authentication; Passwords; Predictive models; Privacy; Security
• ISSN: 2375-1207
• DOI: 10.1109/SP54263.2024.00020

The prevalence of credential stuffing has caused devastating harm to online users who tend to reuse passwords across websites. In response, researchers have made efforts to detect users who set the same passwords or malicious logins. However, existing detection methods sacrifice the usability of passwords by inhibiting password creation or website access. Moreover, the complicated mechanisms for sharing account information hinder their deployment in practice. In this work, we propose a risk prediction framework to prevent credential stuffing attacks before disrupting user behaviors rather than relying on detection. To this end, we newly define the relationship between websites in which users are highly likely to reuse passwords and represent it as an edge on a website graph using graph neural networks. We then perform a link prediction task to identify the risk of credential stuffing between websites. Our framework is applicable to a large number of arbitrary websites by utilizing public website information and linking newly observed website nodes to the graph. The evaluation on a real-world credential dataset consisting of 360 million accounts breached from 22,378 websites shows that our model successfully predicts credential stuffing risk among websites by achieving F1-scores of 0.9559 and 0.9100 in two different graph learning settings, respectively. In addition, we demonstrate the effectiveness of each design strategy and validate that the prediction results can be utilized to quantify the expected rates of password reuse as risk scores.