Detection of multi-factor authentication and non-multi-factor authentication for risk assessment

A computer program product for determining a risk score of a communication network, wherein the computer program product comprises:

• receiving network traffic metadata from user interactions on a user device, the network traffic metadata associated with user logins to an entity via the communication network;
• constructing a plurality of digital signatures of the network traffic metadata associated with the user device, wherein the plurality of digital signatures are adjusted using a signature calculation process;
• determining a first reference model for the network traffic metadata, wherein a first subset of the user logins to the entity via the communication network are associated with multi-factor authentication;
• determining a second reference model for the network traffic metadata, wherein a second subset of the user logins to the entity via the communication network are associated with non-multi-factor authentication;
• and
• calculating a risk score based on a comparison of the first subset of the user logins to the entity network and the second subset of the user logins to the entity via the communication network found in the network data.

A computer system for determining a risk score of a communication network, wherein the computer system comprises:

• one or more computer processors;
• one or more computer readable storage media for storing computer-implemented instructions, wherein the one or more computer processors are configured to execute the computer-implemented instructions to cause the computer system to:
• receive network traffic metadata from user interactions on a user device, the network traffic metadata associated with user logins to an entity via the communication network;
• construct a plurality of digital signatures of the network traffic metadata associated with the user device, wherein the plurality of digital signatures are adjusted using a signature calculation process;
• determine a first reference model for the network traffic metadata, wherein a first subset of the user logins to the entity via the communication network are associated with multi-factor authentication;
• determine a second reference model for the network traffic metadata, wherein a second subset of the user logins to the entity via the communication network are associated with non-multi-factor authentication;
• and
• calculate a risk score based on a comparison of the first subset of the user logins to the entity network and the second subset of the user logins to the entity via the communication network found in the network data.