Invariant detection using distributed ledgers

A system, comprising:

• a first computing device, of a local network of computing devices, having a processor having access to memory media storing operations executable by the processor for:
• identifying a first user access event that failed authentication at the first computing device;
• creating a transaction block of a distributed ledger based on the first user access event;
• determining that data indicating the first user access event is not included by the distributed ledger, and in response, adding the transaction block to a temporal vector space of the distributed ledger;
• sharing, to each other computing device of the local network, the transaction block, wherein each of the others computing devices of the local network updates a local copy of the distributed ledger to include the transaction block in the temporal vector space;
• a second computing device, of the local network of computing devices, having a processor having access to memory media storing operations executable by the processor for:
• identifying a second user access event that failed authentication at the second computing device;
• in response to identifying the second user access event, matching data indicating the second user access event with data indicating the first user access event of the distributed ledger;
• and
• in response to matching the data indicating the second user access event with the data indicating the first user access event, updating the distributed ledger to include the transaction block in an established vector space of the distributed ledger.

A non-transitory computer-readable medium comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

• identifying, by a first computing device of a local network of computing devices, a first user access event that failed authentication at the first computing device;
• creating, by the first computing device, a transaction block of a distributed ledger based on the first user access event;
• determining, by the first computing device, that data indicating the first user access event is not included by the distributed ledger, and in response, adding the transaction block to a temporal vector space of the distributed ledger;
• sharing, by the first computing device and to each other computing device of the local network, the transaction block, wherein each of the others computing devices of the local network updates a local copy of the distributed ledger to include the transaction block in the temporal vector space;
• identifying, by a second computing device of the local network of computing devices, a second user access event that failed authentication at the second computing device;
• in response to identifying the second user access event, matching, by the second computing device, data indicating the second user access event with data indicating the first user access event of the distributed ledger;
• and
• in response to matching the data indicating the second user access event with the data indicating the first user access event, updating, by the second computing device, the distributed ledger to include the transaction block in an established vector space of the distributed ledger.