Unauthorized authentication event detection

A system comprising:

• a processor;
• and
• a non-transitory storage medium storing instructions that are executable to cause the processor to:
• detect an authentication event that includes a user credential submitted at a particular time from a source device to a destination device in a network;
• in response to the detected authentication event, identify other authentication events that occurred at the source device and the destination device within a time window including the particular time of the detected authentication event, the identified other authentication events comprising failed authentication events that occurred at the source device during a first predetermined time interval before the particular time of the detected authentication event and failed authentication events occurred at the destination device during a second predetermined time interval after the particular time of the detected authentication event;
• detect occurrence of a stolen credential by an entity in the network based on applying a classifier on features derived from the identified other authentication events, wherein the features derived from the identified other authentication events comprise a total number of the failed authentication events that occurred at the source device during the first predetermined time interval and a total number of the failed authentication events that occurred at the destination device during the second predetermined time interval;
• and
• cause, in response to detecting the occurrence of the stolen credential, a halt of an activity at one or more of the source device and the destination device.

A method comprising:

• detecting, by a system comprising a hardware processor, an authentication event that includes a user credential submitted at a particular time from a source device to a destination device in a network;
• in response to the detected authentication event, identifying, by the system, other authentication events that occurred at the source device and the destination device within a time window including the particular time of the detected authentication event, the identified other authentication events comprising failed authentication events that occurred at the source device during a first predetermined time interval before the particular time of the detected authentication event and failed authentication events that occurred at the destination device during a second predetermined time interval after the particular time of the detected authentication event;
• executing, by the system, a classifier that is applied on features derived from the identified other authentication events, wherein the features derived from the identified other authentication events comprise a total number of the failed authentication events that occurred at the source device during the first predetermined time interval and a total number of the failed authentication events that occurred at the destination device during the second predetermined time interval;
• determining, by the system based on an output of the classifier, whether the detected authentication event is an unauthorized authentication event;
• and
• cause, by the system in response to determining that the detected authentication event is an unauthorized authentication event, a halt of an activity at one or more of the source device and the destination device.