CPC H04L 63/1425 (2013.01) [G06N 20/00 (2019.01); H04L 63/083 (2013.01); H04L 63/1433 (2013.01)] | 20 Claims |
1. A computer-implemented method comprising:
receiving, by one or more processors, a plurality of user login attempts, each user login attempt associated with a user of a client device and a login source;
randomly sampling a portion of the plurality of user login attempts for each of the randomly sampled user login attempts:
generating a login feature vector associated with the user login attempt, the login feature vector comprising a plurality of user-context features that represent a probability of malicious software attacks;
associating the plurality of user-context features with a plurality of respective risk values;
determining a risk score associated with the user login attempt based on the plurality of respective risk values using a trained machine learning model;
determining that the risk score exceeds a predetermined threshold value;
in response to the determination that the risk score exceeds the predetermined threshold value, issuing an authentication challenge to the user; and
associating a challenge response label with the login feature vector based on a user response to the authentication challenge.
|