Classifying a source of a login attempt to a user account using machine learning

A method comprising:

• inputting, by one or more processors into a trained machine learning model, current user activity observations associated with a current login attempt to a user account;
• receiving, by the one or more processors and from the trained machine learning model, one or more distinguishing factors for the current login attempt;
• providing, by the one or more processors, values of the one or more distinguishing factors as input to a clustering algorithm that is separate from the trained machine learning model, wherein the clustering algorithm is configured to generate an output classifying a source of the current login attempt into one of at least three clusters based on the input, wherein each cluster of the at least three clusters indicates a different source than other clusters in the at least three clusters;
• receiving, by the one or more processors and from the clustering algorithm, the output indicating a classification of the source of the current login attempt into a particular cluster of the at least three clusters;
• determining, by the one or more processors and from among a plurality of authentication levels, an authentication level to assign to the current login attempt based on the classification of the source of the current login attempt, wherein each authentication level of the plurality of authentication levels is associated with a respective cluster of the at least three clusters, and wherein each authentication level of the plurality of authentication levels confers a respective level of access to the user account that is different than other authentication levels of the plurality of authentication levels;
• and
• re-training, by the one or more processors, the trained machine learning model using the output classification of the source of the current login attempt, the authentication level for the current login attempt, and the current user activity observations.

A non-transitory computer-readable medium comprising program code that is executable by a processor for causing the processor to:

• input, into a trained machine learning model, current user activity observations associated with a current login attempt to a user account;
• receive, from the trained machine learning model, one or more distinguishing factors for the current login attempt;
• provide values of the one or more distinguishing factors as input to a clustering algorithm that is separate from the trained machine learning model, wherein the clustering algorithm is configured to generate an output classifying a source of the current login attempt into one of at least three clusters based on the input, wherein each cluster of the at least three clusters indicates a different source than other clusters in the at least three clusters;
• receive, from the clustering algorithm, the output indicating a classification of the source of the current login attempt into a particular cluster of the at least three clusters;
• determine, from among a plurality of authentication levels, an authentication level to assign to the current login attempt based on the classification of the source of the current login attempt, wherein each authentication level of the plurality of authentication level is associated with a respective cluster of the at least three clusters, and wherein each authentication level of the plurality of authentication levels confers a respective level of access to the user account that is different than other authentication levels of the plurality of authentication levels;
• and
• re-train the trained machine learning model using the output classification of the source of the current login attempt, the authentication level for the current login attempt, and the current user activity observations.