Systems and methods for verifying authentication requests using internet protocol addresses

1. A computer-implemented method for verifying authentication requests using IP addresses, at least a portion of the method being performed by a computing system comprising at least one processor, the method comprising:

collecting, by the computing system, data on IP address changes from a set of endpoint devices;

creating, by the computing system using a machine learning method on the data on IP address changes, a virtual IP address distance map based on a likelihood of change from at least one origin IP address to at least one destination IP address and a timing of the change from the at least one origin IP address to the at least one destination IP address, wherein the virtual IP address distance map comprises logical connections that represent virtual distances between IP addresses instead of physical locations;

automatically detecting, by the computing system, a change in an IP address of a client device;

determining, by the computing system and based on the virtual IP address distance map, that the change in the IP address of the client device indicates that an authentication request from the client device to gain access to an online account is suspicious by:

detecting a timing of the authentication request; and

correlating the timing of the authentication request with the change in the IP address of the client device; and

performing, by the computing system, a security action by rejecting the suspicious authentication request to secure the client device and the online account against attacks resulting from the suspicious authentication request.

2. The method of claim 1 , wherein the data on the IP address changes comprises at least one of:

a description of the origin IP address;

a description of the destination IP address; and

a timing of an IP address change.

3. The method of claim 2 , wherein creating the virtual IP address distance map comprises:

using the machine learning method to determine the likelihood of change from the origin IP address to the destination IP address; and

adjusting the likelihood of change based on the timing of the IP address change for an endpoint device.

4. The method of claim 1 , wherein automatically detecting the change in the IP address of the client device comprises at least one of:

monitoring the IP address of the client device;

receiving a client origin IP address;

receiving a client destination IP address; and

detecting a timing of the change in the IP address of the client device.

5. The method of claim 4 , wherein determining that the change in the IP address of the client device indicates that the authentication request is suspicious comprises at least one of:

comparing the change in the IP address of the client device to the virtual IP address distance map; and

determining that the likelihood of change from the client origin IP address to the client destination IP address is below a threshold.

6. The method of claim 4 , wherein correlating the timing of the authentication request with the change in the IP address of the client device comprises at least one of:

identifying an old authentication request from the client origin IP address;

determining that the authentication request is a new authentication request from the client destination IP address; and

detecting a cookie for the old authentication request from the client destination IP address.

7. The method of claim 1 , wherein performing the security action comprises at least one of:

sending an authentication challenge to the client device; and

alerting an administrator about the change in the IP address of the client device.

8. A system for verifying authentication requests using IP addresses, the system comprising:

a collection module, stored in memory, that collects, by a computing system, data on IP address changes from a set of endpoint devices;

a creation module, stored in memory, that creates, by the computing system using a machine learning method on the data on IP address changes, a virtual IP address distance map based on a likelihood of change from at least one origin IP address to at least one destination IP address and a timing of the change from the at least one origin IP address to the at least one destination IP address, wherein the virtual IP address distance map comprises logical connections that represent virtual distances between IP addresses instead of physical locations;

a detection module, stored in memory, that automatically detects, by the computing system, a change in an IP address of a client device;

a determination module, stored in memory, that determines, by the computing system and based on the virtual IP address distance map, that the change in the IP address of the client device indicates that an authentication request from the client device to gain access to an online account is suspicious by:

detecting a timing of the authentication request; and

correlating the timing of the authentication request with the change in the IP address of the client device;

a performance module, stored in memory, that performs, by the computing system, a security action by rejecting the suspicious authentication request to secure the client device and the online account against attacks resulting from the suspicious authentication request; and

at least one processor that executes the collection module, the creation module, the detection module, the determination module, and the performance module.

9. The system of claim 8 , wherein the data on the IP address changes comprises at least one of:

a description of the origin IP address;

a description of the destination IP address; and

a timing of an IP address change.

10. The system of claim 9 , wherein the creation module creates the virtual IP address distance map by:

using the machine learning method to determine the likelihood of change from the origin IP address to the destination IP address; and

adjusting the likelihood of change based on the timing of the IP address change for an endpoint device.

11. The system of claim 8 , wherein the detection module automatically detects the change in the IP address of the client device by at least one of:

monitoring the IP address of the client device;

receiving a client origin IP address;

receiving a client destination IP address; and

detecting a timing of the change in the IP address of the client device.

12. The system of claim 11 , wherein the determination module determines that the change in the IP address of the client device indicates that the authentication request is suspicious by at least one of:

comparing the change in the IP address of the client device to the virtual IP address distance map; and

determining that the likelihood of change from the client origin IP address to the client destination IP address is below a threshold.

13. The system of claim 11 , wherein correlating the timing of the authentication request with the change in the IP address of the client device comprises at least one of:

identifying an old authentication request from the client origin IP address;

determining that the authentication request is a new authentication request from the client destination IP address; and

detecting a cookie for the old authentication request from the client destination IP address.

14. The system of claim 8 , wherein the performance module performs the security action by at least one of:

sending an authentication challenge to the client device; and

alerting an administrator about the change in the IP address of the client device.

15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing system, cause the computing system to:

collect, by the computing system, data on IP address changes from a set of endpoint devices;

create, by the computing system using a machine learning method on the data on IP address changes, a virtual IP address distance map based on a likelihood of change from at least one origin IP address to at least one destination IP address and a timing of the change from the at least one origin IP address to the at least one destination IP address, wherein the virtual IP address distance map comprises logical connections that represent virtual distances between IP addresses instead of physical locations;

automatically detect, by the computing system, a change in an IP address of a client device;

determine, by the computing system and based on the virtual IP address distance map, that the change in the IP address of the client device indicates that an authentication request from the client device to gain access to an online account is suspicious by:

detecting a timing of the authentication request; and

correlating the timing of the authentication request with the change in the IP address of the client device; and

perform, by the computing system, a security action by rejecting the suspicious authentication request to secure the client device and the online account against attacks resulting from the suspicious authentication request.

16. The non-transitory computer-readable medium of claim 15 , wherein the data on the IP address changes comprises at least one of:

a description of the origin IP address;

a description of the destination IP address; and

a timing of an IP address change.

17. The non-transitory computer-readable medium of claim 16 , wherein the computer-executable instructions cause the computing system to create the virtual IP address distance map by:

using the machine learning method to determine the likelihood of change from the origin IP address to the destination IP address; and

adjusting the likelihood of change based on the timing of the IP address change for an endpoint device.

18. The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions cause the computing system to automatically detect the change in the IP address of the client device by at least one of:

monitoring the IP address of the client device;

receiving a client origin IP address;

receiving a client destination IP address; and

detecting a timing of the change in the IP address of the client device.

19. The non-transitory computer-readable medium of claim 18 , wherein the computer-executable instructions cause the computing system to determine that the change in the IP address of the client device indicates that the authentication request is suspicious by at least one of:

comparing the change in the IP address of the client device to the virtual IP address distance map; and

determining that the likelihood of change from the client origin IP address to the client destination IP address is below a threshold.

20. The non-transitory computer-readable medium of claim 18 , wherein correlating the timing of the authentication request with the change in the IP address of the client device comprises at least one of:

identifying an old authentication request from the client origin IP address;

determining that the authentication request is a new authentication request from the client destination IP address; and

detecting a cookie for the old authentication request from the client destination IP address.