Unauthorized authentication event detection

1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a processor of a system to:

detect that a given authentication event occurred at a particular time from a source device to a destination device in a network;

in response to detecting the given authentication event, identify a context for the given authentication event comprising failed authentication events that occurred at the source device during a first predetermined time interval before the particular time of the given authentication event and failed authentication events that occurred at the destination device during a second predetermined time interval after the particular time of the given authentication event;

apply a classifier on features derived from the context for the given authentication event, wherein the features derived from the context for the given authentication event comprise a total number of the failed authentication events that occurred at the source device during the first predetermined time interval and a total number of the failed authentication events that occurred at the destination device during the second predetermined time interval;

determine, based on an output of the classifier, whether the given authentication event is an unauthorized authentication event; and

cause, in response to determining that the given authentication event is an unauthorized authentication event, a halt of an activity at one or more of the source device and the destination device.

2. The non-transitory machine-readable storage medium of claim 1 , wherein the failed authentication events occurred during the first predetermined time interval and the failed authentication events occurred during the second predetermined time interval are identified from authentication logs stored in a logging system.

3. The non-transitory machine-readable storage medium of claim 1 , wherein a length of the first predetermined time interval is equal to a length of the second predetermined time interval.

4. The non-transitory machine-readable storage medium of claim 1 , wherein a length of the first predetermined time interval and a length of the second predetermined time interval are based on historical data.

5. The non-transitory machine-readable storage medium of claim 1 , wherein the given authentication event comprises a user credential submitted from the source device to the destination device, and wherein the features derived from the context for the given authentication event further comprise a count of a number of plural users that initiated authentications from the destination device to other devices, and a count of a number of plural users that are authenticated at the destination device in response to authentications initiated at the other devices.

6. The non-transitory machine-readable storage medium of claim 1 , wherein the context for the given authentication event further comprises:

a count of a number of plural users that initiated authentications from the source device to other devices and a count of a number of plural users that are authenticated at the source device in response to authentications initiated at the other devices during the first predetermined time interval before the particular time of the given authentication event, and

a count of a number of plural users that initiated authentications from the destination device to the other devices, and a count of a number of plural users authenticated at the destination device in response to authentications initiated at the other devices during the second predetermined time interval after the particular time of the given authentication event.

7. The non-transitory machine-readable storage medium of claim 1 , wherein the features derived from the context for the given authentication event further comprise a count of a number of plural machines attempting to login to the source device, and a count of a number of plural machines to which the source device attempted to login.

8. The non-transitory machine-readable storage medium of claim 1 , wherein the given authentication event comprises a user credential submitted from the source device to the destination device, and wherein the features derived from the context for the given authentication event further comprise a count of a number of plural machines attempting to login to the destination device, and a count of a number of plural machines to which the destination device attempted to login.

9. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions that cause the processor to apply the classifier on the features derived from the context for the given authentication event include instructions that cause the processor to apply an ensemble of classifiers on the features derived from the context for the given authentication event.

10. The non-transitory machine-readable storage medium of claim 9 , wherein the ensemble of classifiers comprise classifiers derived according to different machine learning techniques.

11. The non-transitory machine-readable storage medium of claim 9 , wherein the ensemble of classifiers comprise classifiers trained using respective different samples of a labeled data set.

12. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the processor of the system to:

build a training data set including extracted features that are extracted from a plurality of authentication events stored in a logging system and associated authentication events of the plurality of authentication events; and

train the classifier using the extracted features in the training data set.

13. A system comprising:

a processor; and

a non-transitory storage medium storing instructions that are executable to cause the processor to:

detect an authentication event that includes a user credential submitted at a particular time from a source device to a destination device in a network;

in response to the detected authentication event, identify other authentication events that occurred at the source device and the destination device within a time window including the particular time of the detected authentication event, the identified other authentication events comprising failed authentication events that occurred at the source device during a first predetermined time interval before the particular time of the detected authentication event and failed authentication events occurred at the destination device during a second predetermined time interval after the particular time of the detected authentication event;

detect occurrence of a stolen credential by an entity in the network based on applying a classifier on features derived from the identified other authentication events, wherein the features derived from the identified other authentication events comprise a total number of the failed authentication events that occurred at the source device during the first predetermined time interval and a total number of the failed authentication events that occurred at the destination device during the second predetermined time interval; and

cause, in response to detecting the occurrence of the stolen credential, a halt of an activity at one or more of the source device and the destination device.

14. The system of claim 13 , wherein the classifier is part of an ensemble of classifiers, and wherein the instructions are executable to cause the processor to:

train the classifiers of the ensemble of classifiers using different samples from a labeled data set.

15. The system of claim 14 , wherein the instructions that cause the processor to apply the classifier comprise instructions that cause the processor to apply the ensemble of classifiers on the identified other authentication events to detect the occurrence of the stolen credential.

16. The system of claim 13 , wherein the instructions that cause the processor to identify the other authentication events that occurred at the source device and the destination device during the time window comprise instructions that cause the processor to:

determine a count of a number of plural machines attempting to login to the source device and a count of a number of plural machines to which the source device attempted to login during the first predetermined time interval, and

determine a count of a number of plural machines attempting to login to the destination device and a count of a number of plural machines to which the destination device attempted to login during the second predetermined time interval.

17. A method comprising:

detecting, by a system comprising a hardware processor, an authentication event that includes a user credential submitted at a particular time from a source device to a destination device in a network;

in response to the detected authentication event, identifying, by the system, other authentication events that occurred at the source device and the destination device within a time window including the particular time of the detected authentication event, the identified other authentication events comprising failed authentication events that occurred at the source device during a first predetermined time interval before the particular time of the detected authentication event and failed authentication events that occurred at the destination device during a second predetermined time interval after the particular time of the detected authentication event;

executing, by the system, a classifier that is applied on features derived from the identified other authentication events, wherein the features derived from the identified other authentication events comprise a total number of the failed authentication events that occurred at the source device during the first predetermined time interval and a total number of the failed authentication events that occurred at the destination device during the second predetermined time interval;

determining, by the system based on an output of the classifier, whether the detected authentication event is an unauthorized authentication event; and

cause, by the system in response to determining that the detected authentication event is an unauthorized authentication event, a halt of an activity at one or more of the source device and the destination device.

18. The method of claim 17 , wherein identifying the other authentication events that occurred at the source device and the destination device within the time window further comprises:

determining a count of a number of plural machines attempting to login to the source device and a count of a number of plural machines to which the source device attempted to login during the first predetermined time interval, and

determining a count of a number of plural machines attempting to login to the destination device and a count of a number of plural machines to which the destination device attempted to login during the second predetermined time interval.