| CPC H04L 63/0861 (2013.01) [H04L 43/04 (2013.01); H04L 63/083 (2013.01); H04L 63/0876 (2013.01); H04L 63/105 (2013.01); H04L 63/1433 (2013.01); H04L 63/1408 (2013.01); H04L 2463/082 (2013.01)] | 16 Claims |

|
1. A system for risk-based multi-factor authentication, comprising:
a computing device comprising a memory and a processor, the computing device being connected to a network; and
a plurality of programming instructions stored in the memory of, and operable on the processor of, the computing device, wherein the plurality of programming instructions, when operating on the processor, causes the computing device to:
establish a baseline network profile associated with a user from time series traffic data for the network;
maintain an evolving network profile associated with the user based on network traffic and activities of the user;
analyze the network traffic using machine learning techniques to identify a cybersecurity threat to the network;
when the user attempts to access a network resource, require a response to a first additional verification at a required verification level from the user, wherein the required verification level is determined, at least in part, on the evolving network profile associated with the user, a type of the network resource, the identified cybersecurity threat, and a location of the attempted access;
determine, based on receipt of the required response to the first additional verification, whether the required response meets the required verification level; and
if the required response meets the required verification level, grant the requested access to the network resource.
|