Implementing Risk-Based Authentication
1. Understanding Risk Scoring
| Concept | Detail |
|---|
| Risk score | Numeric (0-100) reflecting login risk |
| Inputs | Device, location, behavior, threat intel |
| Output | Allow / step-up / deny |
2. Implementing Login Context Analysis
| Signal | Detail |
|---|
| New device | + risk |
| New country | + risk |
| Impossible travel | + + risk (e.g., NYC → Tokyo in 1h) |
| Anonymous network | + risk |
3. Using Anomaly Detection
| Approach | Detail |
|---|
| Statistical | Z-score from user's baseline |
| Clustering | DBSCAN/Isolation Forest |
| Time series | Compare login pattern to history |
4. Implementing Machine Learning Risk Models
| Model | Detail |
|---|
| Gradient boosting | XGBoost/LightGBM on tabular features |
| Neural | Sequence models for behavioral patterns |
| Training | Labels from fraud confirmations |
| Drift | Monitor + retrain |
5. Using Adaptive Authentication
| Risk Level | Auth Required |
|---|
| Low | Password only |
| Medium | + device-bound prompt |
| High | + phishing-resistant MFA (passkey/FIDO2) |
| Critical | Block + manual review |
6. Implementing Risk Thresholds
Example: Decision table
function decide(score) {
if (score < 20) return "allow";
if (score < 50) return "step_up_otp";
if (score < 80) return "step_up_webauthn";
return "deny";
}
7. Handling Step-Up Authentication Triggers
| Trigger | Action |
|---|
| Sensitive action | Prompt MFA before allowing |
| Risk rise mid-session | Re-auth within timeout |
| amr / acr claim | Required for action |
8. Using Continuous Authentication
Background risk reassessment during session; trigger step-up on suspicious activity. See section 50.
9. Implementing Threat Intelligence Integration
| Feed | Detail |
|---|
| HIBP | Have I Been Pwned credential check |
| Stolen sessions | Botnet IP feeds |
| Phishing kits | Indicator sharing (STIX/TAXII) |
| SSF | Shared Signals Framework — RISC/CAEP events |
10. Logging Risk Events
| Field | Detail |
|---|
| user_id, score | Always |
| factors | List of contributing signals |
| decision | allow / step_up / deny |
| outcome | Success / failure feedback |