Article Sidebar

Download
PDF
Statistic
Read Counter : 0 Download : 0

Main Article Content

Abstract

For email authentication systems, the last mile of authentication poses a critical security challenge, as attackers leverage known, real logins to bypass established server-side protections against brute-force attacks and credential stuffing. Traditional methods like rate limiting and threshold anomaly detection are ineffective against distributed, stealthy attacks that mimic normal user activity. This paper proposes a novel framework for detecting authentication sequences on the client side by leveraging lightweight Large Language Models (LLMs) in real time. Unlike signature-based approaches, the proposed framework can "explain" the temporal and contextual characteristics of login behavior and detect anomalous sequences, such as high-frequency bursts and low-and-slow last-mile reassembly attacks, without the need for predefined signatures or centralized log aggregation. The framework was tested with 2.5 million authentication sessions, 1 million of which were marked as attacks, and achieved 98.4% attack-detection accuracy with a false-positive rate of 1.2%. With an average response time of 180 ms, it achieves near real-time inference without impacting the user experience. The system was live-deployed for six months and succeeded in blocking more than 1.2 million malicious logon attempts and safeguarding more than 850,000 user accounts against traditional baselines in both scale and precision. The results demonstrate the promise of lightweight, client-side LLMs as a privacy-safe, low-resource, and robust solution for last-mile email authentication security against current and future brute force attack vectors.

Keywords

Client-side security Brute force attacks Large language models Web authentication Behavioral analysis Last-mile detection

Article Details

How to Cite
Abbas, I., Hasan, T., & Suhail, R. (2026). Client-side brute force attack detection leveraging large language models . Future Technology, 5(4), 49–62. Retrieved from https://fupubco.com/futech/article/view/1091
Download Citation
Endnote/Zotero/Mendeley (RIS)
BibTeX
Bookmark and Share

References

  1. Zhang Q. Detecting Credential Stuffing Between Servers. In: Wang G, Chen B, Li W, Di Pietro R, Yan X, Han H, editors. Secur. Privacy, Anonymity Comput. Commun. Storage, Cham: Springer International Publishing; 2021, p. 454–64.
  2. Thomas K, Pullman J, Yeo K, Raghunathan A, Kelley PG, Invernizzi L, Benko B, Pietraszek T, Patel S, Boneh D, Bursztein E. Protecting accounts from credential stuffing with password breach alerting. In: 28th USENIX Security Symposium (USENIX Security 19). Santa Clara, CA: USENIX Association; 2019, p. 1556–71. ISBN: 978-1-939133-06-9. https://doi.org/10.5555/3361338.3361446. Available: https://www.usenix.org/conference/usenixsecurity19/presentation/thomas
  3. Ferrag MA, Member S, Ndhlovu M. Revolutionizing Cyber Threat Detection With Large Language Models : A Privacy-Preserving BERT-Based Lightweight Model for IoT / IIoT Devices. IEEE Access 2024;12:23733–50. https://doi.org/10.1109/ACCESS.2024.3363469.
  4. Nassif ALIBOU, Talib MABU, Nasir Q, Dakalbab FM. Machine Learning for Anomaly Detection : A Systematic Review 2021;9. https://doi.org/10.1109/ACCESS.2021.3083060.
  5. Ferrag MA, Maglaras LA, Janicke H, Jiang J, Shu L. Authentication Protocols for Internet of Things: A Comprehensive Survey. Security and Communication Networks 2017;2017:6562953. https://doi.org/10.1155/2017/6562953.
  6. Abuhamad M, Abusnaina A, Nyang D, Mohaisen D. Sensor-Based Continuous Authentication of Smartphones’ Users Using Behavioral Biometrics: A Contemporary Survey. IEEE Internet of Things Journal 2021;8(1):65–84. https://doi.org/10.1109/JIOT.2020.3020076.
  7. Miczek D, Gabbireddy D, Saha S. Leveraging LLM to Strengthen ML-Based Cross-Site Scripting Detection. In: Proceedings of the 2025 ACM Workshop on Wireless Security and Machine Learning (WiseML '25). New York, NY: Association for Computing Machinery; 2025, p. 14–19. https://doi.org/10.1145/3733965.3733969.
  8. Hancock J, Khoshgoftaar TM, Leevy JL. Detecting SSH and FTP Brute Force Attacks in Big Data. 2021 20th IEEE Int. Conf. Mach. Learn. Appl., 2021, p. 760–5. https://doi.org/10.1109/ICMLA52953.2021.00126.
  9. Roy SS, Nilizadeh S. PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT. arXiv preprint arXiv:2408.05667, 2024. https://doi.org/10.48550/arXiv.2408.05667.
  10. Portnoy A, Azikri E, Kels S. Towards Automatic Hands-on-Keyboard Attack Detection Using LLMs in Endpoint Detection and Remediation (EDR) Solutions. arXiv preprint arXiv:2408.01993, 2024. https://doi.org/10.48550/arXiv.2408.01993.
  11. Al-Karaki J, Khan MA, Omar M. Exploring LLMs for Malware Detection: Review, Framework Design, and Countermeasure Approaches. arXiv preprint arXiv:2409.07587, 2024. https://doi.org/10.48550/arXiv.2409.07587.
  12. Wang KC, Reiter MK. Detecting Stuffing of a User's Credentials at Her Own Accounts. In: 29th USENIX Security Symposium (USENIX Security 20). Boston, MA: USENIX Association; 2020, p. 2201–18. ISBN: 978-1-939133-17-5. https://doi.org/10.5555/3489212.3489336. Available: https://www.usenix.org/conference/usenixsecurity20/presentation/wang
  13. Barbosa M, Barthe G, Fan X, Grégoire B, Hung S-H, Katz J, et al. EasyPQC: Verifying Post-Quantum Cryptography. Proc. 2021 ACM SIGSAC Conf. Comput. Commun. Secur., New York, NY, USA: Association for Computing Machinery; 2021, p. 2564–2586. https://doi.org/10.1145/3460120.3484567.
  14. Ousat B, Shariatnasab M, Schafir E, Shirani Chaharsooghi F, Kharraz A. In-Application Defense Against Evasive Web Scans through Behavioral Analysis. arXiv preprint arXiv:2412.07005, 2024. https://doi.org/10.48550/arXiv.2412.07005.
  15. Salahdine F. Social Engineering Attacks : A Survey as 2019. https://doi.org/10.3390/fi11040089.
  16. Cui Y, Wang G, Vu K, Wei K, Shen K, Jiang Z, Han X, Wang N, Lu Z, Liu Y. A Comprehensive Survey of Website Fingerprinting Attacks and Defenses in Tor: Advances and Open Challenges. arXiv preprint arXiv:2510.11804, 2025. https://doi.org/10.48550/arXiv.2510.11804.
  17. Cohen A. Client-Side Zero-Shot LLM Inference for Comprehensive In-Browser URL Analysis. arXiv preprint arXiv:2506.03656, 2025. https://doi.org/10.48550/arXiv.2506.03656.
  18. Chan A, Kharkar A, Zilouchian Moghaddam R, Mohylevskyy Y, Helyar A, Kamal E, Elkamhawy M, Sundaresan N. Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning? arXiv preprint arXiv:2306.01754, 2023. https://doi.org/10.48550/arXiv.2306.01754.
  19. Xu P, Eckert C, Zarras A. Detecting and categorizing Android malware with graph neural networks. Proc. 36th Annu. ACM Symp. Appl. Comput., New York, NY, USA: Association for Computing Machinery; 2021, p. 409–412. https://doi.org/10.1145/3412841.3442080.
  20. Kim E, Lee S. SQL Injection in LLM-Generated Queries: Systematic Analysis of Detection Gaps and Security Risks. IEEE Access 2026;PP:1. https://doi.org/10.1109/ACCESS.2026.3654822.
  21. Zhou Y, Wang E, Yang W, Ge W, Yang S, Zhang Y, et al. XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding. Appl Sci 2025;15. https://doi.org/10.3390/app15063348.
  22. Pasini S, Kim J, Aiello T, Cabrera Lozoya R, Sabetta A, Tonella P. Evaluating and Improving the Robustness of Security Attack Detectors Generated by LLMs. Empirical Software Engineering 2026;31(2):35. https://doi.org/10.1007/s10664-025-10743-w.
  23. Sirinam P, Imani M, Juarez M, Wright M. Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS '18). New York, NY: Association for Computing Machinery; 2018, p. 1928–43. https://doi.org/10.1145/3243734.3243768.
  24. Rashid F, Ranaweera N, Doyle B, Seneviratne S. LLMs are One-Shot URL Classifiers and Explainers. Computer Networks 2025;258:111004. https://doi.org/10.1016/j.comnet.2024.111004.
  25. Saini A, Gaur MS, Laxmi V, Conti M. Colluding browser extension attack on user privacy and its implication for web browsers. Comput Secur 2016;63:14–28. https://doi.org/https://doi.org/10.1016/j.cose.2016.09.003.
  26. Wang H, Hooi B. Automated Phishing Detection Using URLs and Webpages. arXiv preprint arXiv:2408.01667, 2024. https://doi.org/10.48550/arXiv.2408.01667.
  27. Shahriar H, Weldemariam K, Zulkernine M, Lutellier T. Effective detection of vulnerable and malicious browser extensions. Comput Secur 2014;47:66–84. https://doi.org/https://doi.org/10.1016/j.cose.2014.06.005.
  28. Singh S, Varshney G, Singh TK, Mishra V, Verma K. A Study on Malicious Browser Extensions in 2025. arXiv preprint arXiv:2503.04292, 2025. https://doi.org/10.48550/arXiv.2503.04292.