Platform for detecting bypass of an authentication system

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for detecting bypass of an authentication system of a web application, the operations comprising:

• receiving one or more webpage logs comprising web traffic associated with a web application during a defined time period;
• receiving one or more authentication logs associated with one or more authentication appliances providing authentication services for the web application, the one or more authentication logs comprising one or more time-stamped authentication factor entries for the one or more authentication appliances;
• determining, based on the one or more webpage logs, one or more webpage log entries corresponding to a user and the defined time period;
• determining, based on the one or more authentication logs, a total number of correct authentication factors provided by the user during the defined time period;
• and
• determining, based on the one or more webpage log entries corresponding to the user and the defined time period and the total number of correct authentication factors provided by the user, that the user bypassed an authentication system of the web application, wherein determining that the user bypassed the authentication system of the web application comprises:
• determining an expected number of authentication factors for the user for the defined time period;
• and
• determining that the total number of correct authentication factors provided by the user during the defined time period is less than the expected number of authentication factors for the user for the defined time period.

A system, comprising:

• one or more processors;
• and
• a computer-readable storage device coupled to the one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for detecting bypass of an authentication system of a web application, the operations comprising:
• receiving one or more webpage logs comprising web traffic associated with a web application during a defined time period;
• receiving one or more authentication logs associated with one or more authentication appliances providing authentication services for the web application, the one or more authentication logs comprising one or more time-stamped authentication factor entries for the one or more authentication appliances;
• determining, based on the one or more webpage logs, one or more webpage log entries corresponding to a user and the defined time period;
• determining, based on the one or more authentication logs, a total number of correct authentication factors provided by the user during the defined time period;
• and
• determining, based on the one or more webpage log entries corresponding to the user and the defined time period and the total number of correct authentication factors provided by the user, that the user bypassed an authentication system of the web application, wherein determining that the user bypassed the authentication system of the web application comprises:
• determining an expected number of authentication factors for the user for the defined time period;
• and
• determining that the total number of correct authentication factors provided by the user during the defined time period is less than the expected number of authentication factors for the user for the defined time period.