Skip to content

Anomaly Detection & Risk Engine

AuthForge includes a sophisticated anomaly detection engine that evaluates every login attempt for potential security risks.

How it Works

The engine runs a series of heuristic rules to calculate a Risk Score (0-100). This score determines the Risk Level:

  • LOW (1-39): Minimal risk identified.
  • MEDIUM (40-79): Significant departures from normal behavior.
  • HIGH (80+): Critical security matches (e.g., impossible travel).

Built-in Rules

  1. New Device Detection: Detects logins from browsers or OSs never seen before for this user. (+40 points)
  2. Impossible Travel: Detects logins from a country different from the last login. (+80 points)
  3. Unusual Hour: Compares the current login time with the user's historical login patterns. (+25 points)
  4. Untrusted Device: Increases risk if the login occurs from a device not explicitly trusted by the user while other trusted devices exist. (+30 points)

Actionable Recommendations

Every anomaly report includes actionable recommendations based on the risk level:

HIGH Risk

  • Recommendation: "Require immediate force password reset."
  • Recommendation: "Suspend account until identity is verified."

MEDIUM Risk

  • Recommendation: "Require MFA step-up verification for this session."
  • Recommendation: "Suggest user to review recent security activity."

LOW Risk

  • Recommendation: "Monitor ongoing activity for further anomalies."

Customizing the Engine

You can customize the rules or the weight of each rule via the AuthForgeConfig.

config = AuthForgeConfig(
    anomaly_rules=["new_device", "impossible_travel"],
    # More customization coming in future releases
)