Credential Hash Injection Attack Detection Using the Hash Ownership Verification Framework (HOVF)

Most production authentication systems depend on cryptographic hashing algorithms such as bcrypt to protect stored credentials. These algorithms hold up well against brute-force and dictionary attacks, but they rest on one assumption: that the hash database stays confidential. In practice, that assumption breaks regularly. When it does, intrusion detection systems, database monitors, and behavioral anomaly engines all share the same blind spot — none of them check whether the hash presented at login was actually registered by the person claiming to own it. This paper introduces the Hash Ownership Verification Framework (HOVF), a three-layer detection architecture designed to close that gap. HOVF intercepts each authentication attempt before a session is created, validates a cryptographic ownership binding stored in a dedicated identity registry, and applies a behavioral anomaly scoring model tuned to the individual user. In controlled simulation across 500 accounts and 50,500 authentication events — including 500 injected attack samples spanning three difficulty levels — HOVF achieved 96.7% detection accuracy, a 3.1% false positive rate, and an added latency of only 1.4 to 2.8 milliseconds. To the best of our knowledge, this is the first framework designed specifically to detect credential hash injection at the authentication layer, and it lays the foundation for a research direction we term Authentication-Layer Intrusion Detection.