Suspicious Login Detection via Device History Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively identify suspicious logins, particularly in cases where fraudsters spoof device configurations, leading to security breaches in internet and web-based applications, necessitating a unique device fingerprint that cannot be mimicked and aggregation of device history to modify security settings.
Innovation Solution
A system that receives user logins, analyzes device history characteristics, including last financial transactions, to determine if logins originate from different devices, identifies suspicious logins, sends notifications, and modifies security settings accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If device history analysis is implemented to identify suspicious logins, then security detection capability is improved, but system complexity increases
Solution Approach 1:
The system pre-establishes device fingerprints and maintains device history databases before login events occur. Device characteristics are captured and stored in advance, enabling rapid comparison during login authentication without real-time analysis complexity
Solution Approach 2:
A device fingerprinting module acts as an intermediary between the login system and device characteristics. This module abstracts complex device analysis into simplified fingerprint identifiers, reducing system complexity while maintaining detection capability
2Reliability
If multiple device characteristics are analyzed to create unique fingerprints, then spoofing resistance is improved, but processing time increases
Solution Approach 1:
The system creates simplified device fingerprint copies that represent complex device characteristics. Instead of analyzing all raw device data during login, pre-generated fingerprint copies are compared, maintaining spoofing resistance while reducing processing time
Solution Approach 2:
The system transforms multiple device parameters into a condensed fingerprint representation. By changing the parameter format from detailed device characteristics to aggregated fingerprint identifiers, the system maintains uniqueness for spoofing resistance while enabling faster comparison operations
3Reliability
If automated security modifications are implemented based on login analysis, then account protection is improved, but false positive rate increases
Solution Approach 1:
The system implements feedback loops where security modifications are monitored and adjusted based on their outcomes. User confirmations and security event follow-ups provide feedback to refine detection thresholds, reducing false positives while maintaining protection effectiveness
Solution Approach 2:
The system applies partial security modifications rather than immediate full restrictions. Instead of automatically blocking accounts, it implements graduated responses such as additional verification steps or temporary restrictions, reducing false positive impact while maintaining account protection
Data Source
AI summary
A system for identifying suspicious logins. The system may include a memory storing executable instructions, and at least one processor configured to execute the instructions to perform operations. The operations may include receiving a first user login from an electronic device, the first user login comprising login credentials; receiving a second user login from an electronic device, the second user login comprising login credentials; analyzing a plurality of device history characteristics, wherein at least one device history characteristic comprises a determination of a last financial transaction performed by an electronic device; determining, based on the analysis, that the first and second user logins originate from different electronic devices; identifying, based on the determination and the analysis, the second user login as a suspicious login; sending, to a user, a notification of the identified suspicious login; and modifying, based on the notification, security settings on an account of the user.