PassREfinder-FL: Privacy-Preserving Credential Stuffing Risk Prediction via Graph-Based Federated Learning for Representing Password Reuse between Websites

TL;DR

This paper addresses credential stuffing risk by predicting cross-website password reuse relations using a graph-based representation of websites and a graph neural network trained via federated learning to preserve user privacy. The PassREfinder-FL framework constructs local graphs per administrator, extracts multi-modal public features, and learns cross-admin edge representations without sharing raw data, achieving an FL F1-score of 0.9153 on a large real-world breach dataset. Key contributions include removing the privacy-sensitive hidden relations of the original PassREfinder, demonstrating strong performance across ablations and federation sizes, and providing actionable risk scores for proactive risk mitigation. The work offers a scalable, privacy-preserving pathway for administrators to identify and mitigate credential stuffing risks across many websites.

Abstract

Credential stuffing attacks have caused significant harm to online users who frequently reuse passwords across multiple websites. While prior research has attempted to detect users with reused passwords or identify malicious login attempts, existing methods often compromise usability by restricting password creation or website access, and their reliance on complex account-sharing mechanisms hinders real-world deployment. To address these limitations, we propose PassREfinder-FL, a novel framework that predicts credential stuffing risks across websites. We introduce the concept of password reuse relations -- defined as the likelihood of users reusing passwords between websites -- and represent them as edges in a website graph. Using graph neural networks (GNNs), we perform a link prediction task to assess credential reuse risk between sites. Our approach scales to a large number of arbitrary websites by incorporating public website information and linking newly observed websites as nodes in the graph. To preserve user privacy, we extend PassREfinder-FL with a federated learning (FL) approach that eliminates the need to share user sensitive information across administrators. Evaluation on a real-world dataset of 360 million breached accounts from 22,378 websites shows that PassREfinder-FL achieves an F1-score of 0.9153 in the FL setting. We further validate that our FL-based GNN achieves a 4-11% performance improvement over other state-of-the-art GNN models through an ablation study. Finally, we demonstrate that the predicted results can be used to quantify password reuse likelihood as actionable risk scores.

Figures (8)

• Figure 1: Graph representation of password reuse relations.
• Figure 2: Overview of PassREfinder-FL.
• Figure 3: The distributions of the number of shared users and password reuse rate between websites.
• Figure 4: Prediction performance with varying numbers of administrators participating in federated learning.
• Figure 5: Training dynamics across federation sizes. The shaded regions indicate standard errors across participating administrators.