Machine Learning-Based Account Takeover Detection System Using Behavioral Login Analysis and Risk-Adaptive Authentication

Abstract

Account Takeover (ATO) is a major cybersecurity threat in which attackers gain unauthorized access to legitimate user accounts. This paper proposes a Machine Learning-Based Account Takeover Detection System that analyzes login activities such as IP address, device details, location, login time and failed login attempts to identify suspicious behavior. Logistic Regression and Random Forest algorithms are used to predict login risk and to generate a risk score between 0 and 1. Based on the risk level, the system takes one of three actions: Allow, Multi-Factor Authentication (MFA) or Block. The trained model is served through a FastAPI backend for real-time prediction, a Streamlit interface lets users submit login attributes and view the decision, and every prediction is logged in an SQLite database. The proposed system aims to improve account security, detect suspicious login attempts and prevent unauthorized access.

Introduction

The text presents a Machine Learning-Based Account Takeover (ATO) Detection System designed to identify suspicious login attempts and prevent unauthorized access to online accounts. The system uses machine learning algorithms and risk-based authentication to improve account security while maintaining a convenient login experience.

Online services such as banking, e-commerce, email, and social media are vulnerable to Account Takeover attacks. These attacks occur when cybercriminals gain access to legitimate user accounts through stolen passwords, phishing, credential stuffing, brute-force attacks, or malware. Since a correct password does not always guarantee that the legitimate user is logging in, additional behavioural information is needed to detect suspicious activity.

1. Objectives of the Study

The main objectives are to:

• Identify suspicious login behaviour using different security-related features.

• Train and compare Logistic Regression and Random Forest machine learning models.

• Generate a risk score for every login attempt.

• Classify login attempts into Allow, MFA, or Block categories.

• Develop a real-time detection system with a user interface and prediction logging.

2. System Architecture

The proposed system is developed using Python and several supporting technologies.

The system collects login information, processes it into numerical features, and sends it to the trained machine learning model. The model generates a risk score, which is converted into an appropriate authentication decision.

3. Dataset and Feature Engineering

The system uses six behavioural features to identify potentially suspicious login attempts:

1. Device Novelty: Identifies whether the login is coming from a previously unseen device.

2. Location Risk: Measures whether the login location differs from the user's usual locations.

3. Failed Login Attempts: Considers the number of unsuccessful login attempts before successful access.

4. Login Time Deviation: Identifies unusual login times compared with the user's normal activity.

5. IP Reputation Risk: Evaluates the reputation and potential risk associated with the source IP address.

6. Account Age Risk: Assigns higher risk to newly created accounts.

The dataset contains login records labelled as either normal or risky. It is cleaned, processed, and divided into training and testing datasets for model development and evaluation.

4. Machine Learning Models

Two machine learning algorithms are used:

• Logistic Regression: Predicts the probability of a login being risky based on weighted input features. It is relatively simple and provides interpretable results.

• Random Forest: Combines multiple decision trees to predict login risk. It can identify complex relationships between behavioural features and reduce overfitting.

Both models generate a probability score between 0 and 1, representing the estimated risk of an account takeover.

5. Risk-Based Authentication and Decision Logic

The predicted risk score is converted into three authentication actions using predefined thresholds.

This approach provides stronger security while avoiding unnecessary authentication challenges for normal users.

6. Implementation

The implementation consists of three major components:

• Model Training: Login data are processed, features are extracted, and both machine learning models are trained and evaluated. The selected model is saved using Joblib.

• FastAPI Backend: Receives login information through a prediction API, calculates the risk score, and returns the recommended authentication action.

• Streamlit Frontend: Provides an interactive interface where users can enter login details and view the predicted risk score and authentication decision.

SQLite is used to store prediction requests and their corresponding results for monitoring and future analysis.

7. Results and Performance Evaluation

The system demonstrates three possible outcomes:

• Allow for low-risk login attempts.

• MFA for suspicious login attempts.

• Block for high-risk login attempts.

The performance of Logistic Regression and Random Forest is evaluated using five important metrics:

1. Accuracy.

2. Precision.

3. Recall.

4. F1-score.

5. ROC-AUC.

Recall is particularly important because failing to detect an actual account takeover can result in serious security consequences.

Conclusion

This paper described a Machine Learning-Based Account Takeover Detection System that scores login attempts from behavioral features and converts the score into Allow, MFA or Block decisions. Logistic Regression and Random Forest models were used to predict login risk, a FastAPI service provides real-time predictions, a Streamlit interface supports interaction, and SQLite logging supports monitoring. The system shows that risk-adaptive authentication can improve account security and detect suspicious logins while keeping genuine logins smooth. Further work on richer features, adaptive thresholds and large-scale evaluation can make the approach suitable for production use.

References

[1] K. Thomas et al., “Data breaches, phishing, or malware? Understanding the risks of stolen credentials,” in Proc. ACM SIGSAC Conf. Computer and Communications Security (CCS), 2017, pp. 1421–1434. [2] J. Bonneau, C. Herley, P. C. van Oorschot, and F. Stajano, “The quest to replace passwords: A framework for comparative evaluation of web authentication schemes,” in Proc. IEEE Symp. Security and Privacy, 2012, pp. 553–567. [3] D. Freeman, S. Jain, M. Dürmuth, B. Biggio, and G. Giacinto, “Who are you? A statistical approach to measuring user authenticity,” in Proc. Network and Distributed System Security Symp. (NDSS), 2016. [4] S. Wiefling, L. Lo Iacono, and M. Dürmuth, “Is this really you? An empirical study on risk-based authentication applied in the wild,” in ICT Systems Security and Privacy Protection (IFIP SEC), 2019, pp. 134–148. [5] D. W. Hosmer, S. Lemeshow, and R. X. Sturdivant, Applied Logistic Regression, 3rd ed. Hoboken, NJ, USA: Wiley, 2013. [6] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001. [7] F. Pedregosa et al., “Scikit-learn: Machine learning in Python,” Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2011. [8] S. Ramírez, “FastAPI documentation.” [Online]. Available: https://fastapi.tiangolo.com [9] Streamlit Inc., “Streamlit documentation.” [Online]. Available: https://docs.streamlit.io [10] SQLite, “SQLite documentation.” [Online]. Available: https://www.sqlite.org/docs.html [11] P. A. Grassi et al., “Digital identity guidelines: Authentication and lifecycle management,” NIST Special Publication 800-63B, 2017.

Copyright

Copyright © 2026 Nidha ., Satya Kalpana, Kunta Likhita, Mr. Raghavendra Gupta. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.