Intelligent account takeover detection in single sign-on systems using behavioral and device login analytics

With changing times and digitalization in the field of information technology, Single Sign-On (SSO) mechanisms have become an important feature of identity management systems. SSO enables users to access numerous services with one set of login credentials, but it can increase risks like account takeover (ATO), affecting security and privacy. The research aims to use advanced statistical analysis and Machine Learning (ML) to improve authentication mechanisms and identify predictive features for risk-based authentication. The behavioral changes demonstrated by users after account takeover (ATO) incidents are also examined to design risk indicators. To achieve these objectives, this research utilized a large dataset of 33 million login attempts from 3.3 million users in Norway from February 2020 to February 2021. Using machine learning models evaluated with an 80:20 train-test validation strategy and complementary performance metrics, we observed that ASN, city, Round-trip time (RTT), device type, and login success were the key features for accurately identifying attackers, achieving 93% prediction accuracy. In addition, the login attempts were found to be maximum during typical office hours (9 AM, 12 PM, 3 PM, and 6 PM), where attackers may be trying to imitate themselves as normal users. The research findings will aid in the implementation of secure, user-friendly, and dependable authentication schemes that strengthen all aspects of digital identity management.