Real-time adjustments to authentication conditions

1. A method for adjusting authentication conditions in real-time, the method comprising:

dynamically constructing within a device coupled to a physical system a graph-theoretic data structure, the graph-theoretic data structure having nodes corresponding to received valid and invalid authentication credentials used in attempts to access the system, wherein the dynamically constructing comprises:

if a newly received credential has no corresponding node in the data structure, adding in real-time a new node to the data structure corresponding to the newly received credential and, if a last received preceding credential was an invalid credential, adding a directed edge from a last node corresponding to the last received preceding credentials to the new node, and

computing in real-time a weight for a directed edge between nodes corresponding to consecutively received credentials;

in response to receipt of an invalid credential, computing based on the graph-theoretic data structure a probability of the invalid credential being an authentication attempt by a particular type of user; and

if the probability is beyond a threshold probability, triggering a security event to adjust an authentication condition of the system.

2. The method of claim 1 , wherein each authentication credential is a cryptographic hash value.

3. The method of claim 1 , wherein computing in a real-time weight for a directed edge between nodes corresponding to consecutively received credentials comprises:

incrementing a usage count for an edge being traversed between the nodes corresponding to the consecutively received credentials.

4. The method of claim 1 , wherein computing based on the graph-theoretic data structure a probability of the invalid credential being an authentication attempt by a particular type of user comprises:

computing based on the graph-theoretic data structure a probability of the invalid credential being an authentication attempt by a legitimate user.

5. The method of claim 4 , wherein, if the probability of the invalid credential being an authentication attempt by a legitimate user is above the threshold probability, triggering a security event to adjust an authentication condition of the system comprises:

triggering a security event to exclude the invalid credential as a count against a permissible number of invalid access attempts.

6. The method of claim 4 , wherein, if the probability of the invalid credential being an authentication attempt by a legitimate user is below the threshold probability, triggering a security event to adjust an authentication condition of the system comprises:

triggering a security event to lock-out additional attempts to access the system.

7. The method of claim 1 , wherein computing based on the graph-theoretic data structure a probability of the invalid credential being an authentication attempt by a particular type of user comprises:

computing based on the graph-theoretic data structure a probability of the invalid credential being an authentication attempt by a malicious user.

8. The method of claim 7 , wherein, if the probability of the invalid credential being an authentication attempt by a malicious user is below the threshold probability, triggering a security event to adjust an authentication condition of the system comprises:

triggering a security event to allow additional attempts above a default permissible number of invalid access attempts.

9. The method of claim 4 , wherein computing the probability of the invalid credential being an authentication attempt by a legitimate user comprises:

computing, based on the graph-theoretic data structure, a probability of subsequently receiving a valid credential based on receipt of the invalid credential.

10. The method of claim 9 , wherein computing, based on the graph-theoretic data structure, a probability of subsequently receiving a valid credential based on receipt of the invalid credential comprises:

identifying all n-hop paths out from a node corresponding to the invalid credential; and

determining what ratio of said all n-hop paths terminate at a valid credential node.

11. The method of claim 10 , further comprising:

determining a probability of traversing an n-hop path terminating at the valid credential node; and

scaling the ratio by said probability of traversing.

12. The method of claim 11 , wherein determining the probability of traversing is based on a factor selected from the group consisting of: a sum of weights of edges in the n-hop path, a magnitude of n, and a last traversal time of the n-hop path.

13. The method of claim 9 , wherein computing, based on the graph-theoretic data structure, a probability of subsequently receiving a valid credential based on receipt of the invalid credential comprises:

computing a historical ratio, wherein the ratio's numerator is a number of times an n-hop path from a node corresponding to the invalid credential to a valid credential node has been historically traversed and the ratio's denominator is a number of times the invalid credential has been historically received.

14. The method of claim 13 , further comprising:

scaling the ratio by a factor selected from the group consisting of:

a probability of receiving a valid credential from an originating IP address of the invalid credential,

a probability of receiving a valid credential from an originating geographical location of the invalid credential,

a probability of the system being a security attack target, and

a probability of receiving a valid credential at approximately a time the invalid credential was received.

15. The method of claim 1 , wherein dynamically constructing the graph-theoretic data structure further comprises:

pruning the graph-theoretic data structure to remove a node having a property selected from the group consisting of the following:

outgoing edges having a value within a threshold range, and

a shortest n-hop path terminating at a valid credential node, wherein n is at or above a threshold magnitude.

16. A non-transitory computer-readable data storage medium storing computer-readable and code for implementing a security module for triggering real-time adjustments to authentication conditions of a physical system, the security module comprising:

a non-static graph-theoretic data structure comprising:

dynamically constructed nodes corresponding to received valid and invalid authentication credentials used in attempts to access the system, and

dynamically weighted directed edges between nodes corresponding to consecutively received credentials; and

a graph analysis module coupled to the non-static graph-theoretic data structure, wherein the graph analysis module comprising logic components configured to compute, based on the non-static graph-theoretic data structure, a probability of the invalid credential being an authentication attempt by a particular type of user in response to receipt of an invalid credential, and if the probability is beyond a threshold probability, trigger a security event to adjust an authentication condition of the system.

17. The non-transitory-computer readable data storage medium of claim 16 , wherein each authentication credential is a cryptographic hash value.

18. The non-transitory-computer readable data storage medium of claim 16 , wherein the graph analysis module comprises:

a user probability calculator module, the user probability calculator module being configured to compute, based on the graph-theoretic data structure, a probability of the invalid credential being an authentication attempt by a legitimate user; and

a security event transmitter coupled to the user probability calculator module, the security event transmitter configured to transmit a security event to adjust an authentication condition of the physical system if the probability of the invalid credential being an authentication attempt by a legitimate user is above the threshold probability.

19. A system for adjusting authentication conditions in real-time, the system comprising:

a server coupled, via a network, to a client device, the server to require valid authentication credentials from the client device prior to providing the client device access to items in the server;

a backend authorization system coupled to the server, the backend authorization system to establish authentication conditions for access to the server; and

a security module coupled to the server and the backend authorization system, the security module comprising:

a non-static graph-theoretic data structure comprising:

dynamically constructed nodes corresponding to received valid and invalid authentication credentials used in attempts to access the server, and

dynamically weighted directed edges between nodes corresponding to consecutively received credentials; and

a graph analysis module coupled to the non-static graph-theoretic data structure, wherein the graph analysis module comprising logic components configured to compute, based on the non-static graph-theoretic data structure, a probability of the invalid credential being an authentication attempt by a particular type of user in response to receipt of an invalid credential, and if the probability is beyond a threshold probability, trigger transmission of a security event to the backend authorization system to adjust an authentication condition for access to the server.

20. The system of claim 19 , wherein the security module is located in a geographically remote location from the server.