Risk-Based Authentication (RBA)

The central decisioning nucleus that ingests multiple signal streams and calculates a composite risk score in milliseconds. This engine applies weighted, configurable rules and machine learning models to determine the authentication level required.

• Input Signals: Device fingerprint, geolocation, behavioral biometrics, IP reputation, and time-of-day.
• Output: A numeric score (e.g., 0-100) mapped to policy actions: Allow, Step-Up MFA, or Deny.
• Latency Requirement: Must execute inference in under 50ms to avoid user-perceptible friction during login.

The ingestion layer that normalizes disparate telemetry from the user's environment into a unified feature vector for the scoring engine. This component handles the heterogeneity of browser attributes, network artifacts, and sensor data.

• Device Context: Operating system, browser version, screen resolution, installed fonts, and canvas fingerprint hash.
• Network Context: ASN, IP geolocation, proxy/VPN detection flags, and TLS fingerprint.
• Temporal Context: Login hour, day-of-week, and inter-event velocity compared to historical baselines.

A passive signal layer that verifies identity by analyzing how the user physically interacts with the input devices, not just what credentials they present. This component is critical for post-login continuous authentication.

• Keystroke Dynamics: Measures dwell time (key press duration) and flight time (interval between key releases and presses) to build a typing signature.
• Mouse Dynamics: Analyzes cursor trajectory, speed, acceleration, and click patterns. Low mouse entropy indicates scripted automation.
• Touchscreen Biometrics: Captures pressure, swipe velocity, and touch area on mobile devices.

The enforcement module that translates the risk score into a concrete authentication action. It manages the user experience of step-up challenges, ensuring security without unnecessary friction.

• Frictionless Path: Risk score below threshold; user proceeds transparently.
• Step-Up Challenges: Triggered for medium-risk scores. Options include TOTP codes, push notifications, WebAuthn/FIDO2 biometric prompts, or knowledge-based questions.
• Hard Block: High-risk scores or critical anomaly flags (e.g., impossible travel) result in session termination.

The analytical backend that identifies novel attack patterns and enriches signals with external threat data. This component moves beyond static rules to detect zero-day fraud techniques.

• Impossible Travel Logic: Calculates geovelocity between successive logins. If the required speed exceeds physical possibility (e.g., > 800 km/h), the event is flagged as an account takeover.
• Bot Signature Detection: Identifies headless browsers, emulators, and automation frameworks (Selenium, Puppeteer) by probing for missing rendering artifacts and WebDriver flags.
• IP Reputation Feeds: Cross-references source IPs against known TOR exit nodes, VPN concentrators, and bulletproof hosting providers.

Extends RBA beyond the initial login gate to monitor the entire authenticated session. This component detects session hijacking and post-authentication fraud in real time.

• Session Fingerprinting: Binds a unique identifier to the session using a composite of device and behavioral attributes. Any abrupt change signals a hijack attempt.
• Clickstream Analysis: Monitors the sequence of page views and in-app actions. Deviations from established navigation patterns trigger re-authentication.
• Inactivity & Timeout Logic: Dynamically adjusts session timeouts based on risk context, terminating idle high-risk sessions aggressively.

The passive measurement of unique, measurable patterns in human physical and cognitive actions. Unlike static credentials, behavioral biometrics provide a continuous identity signal throughout a session.

• Keystroke Dynamics: Analyzes typing rhythm, including dwell time (key hold duration) and flight time (interval between keys).
• Mouse Dynamics: Tracks cursor speed, acceleration, and click patterns to distinguish a human from a script.
• Touchscreen Pressure: On mobile devices, the force and area of a touch event create a unique user signature.

A passive identification technique that collects a multitude of attributes from a remote computing device to generate a unique, persistent identifier. This identifier is a critical input for calculating device trust in an RBA policy.

• Canvas Fingerprinting: Exploits subtle variations in graphics hardware and driver stacks by rendering a hidden graphic via the HTML5 Canvas API.
• TLS Fingerprinting: Identifies a client by analyzing the specific parameters and cipher suites advertised in the Transport Layer Security handshake, independent of the IP address.
• WebDriver Detection: Checks for specific JavaScript properties injected by automation frameworks like Selenium or Puppeteer to identify scripted traffic.

A geolocation-based security rule that flags an access attempt when the physical distance between two successive events cannot be traversed in the elapsed time. This is a high-fidelity signal for account takeover.

• Geovelocity Checks: A real-time calculation of the speed required to travel between two geolocated events. If the required speed exceeds the theoretical maximum for commercial flight, the event is flagged.
• VPN/TOR Detection: Cross-references IP addresses against known VPN exit node and TOR exit node databases to unmask anonymized connections, which are often associated with high-risk geolocation anomalies.

The identification of an attack where a valid user session is compromised, typically through stolen cookies or tokens. RBA engines detect this by monitoring for abrupt, anomalous changes in session context.

• Session Fingerprinting: Combines behavioral and device attributes collected during a single session to build a unique, time-bound identifier. A sudden change in this fingerprint triggers a high-risk score.
• Continuous Authentication: Persistently validates a user's identity throughout the entire session by passively analyzing behavioral signals, rather than relying on a single point-in-time login.
• Headless Browser Detection: Probes for missing rendering artifacts or JavaScript API inconsistencies to identify browsers running without a GUI, a common tool for automated session replay attacks.

The process of identifying automated traffic by analyzing non-human behavioral patterns. Distinguishing a sophisticated bot from a legitimate user is a primary function of the risk-scoring engine.

• Mouse Entropy: Measures the randomness of a cursor trajectory. Low entropy suggests a perfectly linear, scripted movement, while high entropy indicates genuine human interaction.
• Keystroke Entropy: Quantifies the timing variability within a typing stream. Human typists exhibit natural inconsistencies, whereas automated key injectors display highly regular, low-entropy patterns.
• Emulator/VM Detection: Identifies whether a mobile app is running on a simulated environment or if an OS is within a virtualized container by checking for hardware sensor absence or specific CPU instructions.

The identification of large-scale automated login attempts using lists of breached username/password pairs. RBA systems mitigate this by dynamically increasing authentication friction for high-velocity, high-failure-rate traffic.

• Velocity Checks: Counts the number of login attempts from a single device fingerprint or IP address within a short time window. A high velocity triggers a step-up authentication challenge.
• User Agent Spoofing Detection: Cross-references the claimed browser identity in the User-Agent header against the actual JavaScript engine behaviors to identify falsified clients used in attack scripts.
• Supercookie Detection: Identifies persistent tracking mechanisms that abuse browser features to respawn cleared identifiers, often used to link multiple fraudulent login attempts to a single source.