Risk assessment modeling

A computer system for risk assessment, comprising:

• one or more processor;
• and
• one or more storage devices having stored thereon computer-executable instructions, which are executable by the one or more processors to cause the computer system to:
• evaluate historical authentication data to identify a set of authentication context properties associated with user authentication sessions;
• evaluate compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events;
• annotate the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set that includes at least two of a user browsing history property, a geolocation property, a target service accessed by a compromised user, a social network profile property, an application execution context property, a client device property, a device interaction property, an authentication challenge history property, a user contact list property, or a user activity property;
• train a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property;
• identify a current user account event of a current user;
• evaluate a first current user context property of the current user using a first risk assessment model;
• based on a first result from the first risk assessment model, evaluate a second current user context property of the current user using a second risk assessment model;
• aggregate results from the first and the second risk assessment models to generate a risk analysis metric;
• moderate the current user account event based upon the risk analysis metric;
• applying the aggregated results from the first and the second risk assessment models to prior user account events of a user to generate an evaluation metric;
• and
• retroactively banning or unbanning the current user account based upon the evaluation metric.

A computer readable hardware storage device having stored thereon computer-executable instructions that are executable by one or more processor of a computer system and that configure the computer system to perform a method for maintaining a risk assessment model, that includes the computer system performing at least the following:

• evaluating historical authentication data to identify a set of authentication context properties associated with user authentication sessions;
• evaluating compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events;
• annotating the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set that includes at least two of a user browsing history property, a geolocation property, a target service accessed by a compromised user, a social network profile property, an application execution context property, a client device property, a device interaction property, an authentication challenge history property, a user contact list property, or a user activity property;
• training a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property;
• identifying a current user account event of a current user;
• evaluating a first current user context property of the current user using a first risk assessment model;
• based on a first result from the first risk assessment model, evaluating a second current user context property of the current user using a second risk assessment model;
• aggregating results from the first and the second risk assessment models to generate a risk analysis metric;
• moderating the current user account event based upon the risk analysis metric;
• applying the aggregated results from the first and the second risk assessment models to prior user account events of a user to generate an evaluation metric;
• and
• retroactively banning or unbanning the current user account based upon the evaluation metric.