Authentication System Attack Detection with Dynamic User Baselines

The patent transforms the detection approach by changing from fixed threshold parameters to dynamic baseline parameters. Instead of using static request count thresholds, the system establishes user-specific baseline patterns through monitoring normal activity over time, then detects anomalies by comparing current activity against these personalized baselines. This parameter transformation enables accurate detection of both high-volume and low-volume attacks without false positives.

The system performs preliminary monitoring and baseline establishment before actual attack detection begins. By collecting and analyzing normal user activity patterns during an initial period, the system prepares user-specific profiles that serve as reference points for future anomaly detection. This preliminary action ensures that when attacks occur, the system already has accurate expectations of normal behavior for comparison.

The patent extracts only the essential characteristics needed for anomaly detection from complete user activity data. Instead of analyzing every single request in detail, the system identifies and monitors key parameters such as request frequency, targeted resources, and temporal patterns. This extraction approach maintains comprehensive detection coverage while significantly reducing computational complexity by focusing only on the most discriminating features.

The monitoring system is segmented into distinct functional components: data collection, baseline establishment, anomaly detection, and response generation. Each component handles specific tasks independently, allowing the system to process user activity efficiently without requiring complex centralized analysis. This segmentation reduces overall system complexity while maintaining comprehensive monitoring capabilities.