No matching documentation found
AI & Machine Learning Anomaly Detection
A comprehensive guide to understanding and leveraging the automatic Ensemble Machine Learning engine in Login AlertX.
Overview
In modern security environments, receiving an alert for every single login can lead to alert fatigue. Login AlertX solves this by employing a state-of-the-art Ensemble Machine Learning engine that actively analyzes every login attempt in real-time to determine its actual threat level.
Available automatically to all Premium and Trial users, the AI builds a personalized behavioral baseline for every user on your network. By leveraging a dual-algorithm approach—combining Principal Component Analysis (PCA) with Gradient Boosted Trees (FastTree)—the engine accurately distinguishes between a routine morning login and a compromised credential, ensuring you only pay attention to the alerts that matter.
How AI Scoring Works
The ML engine operates 100% locally on your machine with zero cloud dependency, ensuring total privacy. When a login occurs, the engine extracts exactly 8 distinct data points and evaluates them in milliseconds against your historical baseline.
Key Data Points Analyzed
| Data Point | Category | Why It Matters |
|---|---|---|
| Time & Day of Week | Behavioral | Detects “off-hours” access. A login at 3:00 AM on a Sunday is inherently riskier than 9:00 AM on a Monday. |
| IP & Network Hash | Contextual | Flags logins originating from unknown subnets or entirely new geographic locations. |
| Authentication Package | Technical | Detects unusual authentication methods (e.g., NTLM vs Kerberos) that attackers often use during lateral movement. |
| Speed Ratios | Behavioral | Monitors the time gap between sessions to flag “Impossible Travel” scenarios. |
| Session Context | Contextual | Differentiates the risk weight between local physical console logins (Type 2) and Remote Desktop (Type 10). |
Hybrid Architecture: Alongside the AI, a blazing-fast in-memory frequency monitor tracks rolling 1-hour login bursts. If the service is ever restarted, a stateless “smart hydration” system instantly reconstructs this memory from your Windows Event Logs, guaranteeing zero data loss.
Anatomy of an AI Alert
When the AI engine processes a login, it injects highly contextual intelligence directly into your standard email, Slack, or Teams alert payloads.
-
Risk Level
Categorized cleanly as
Low,Medium, orHigh. High Risk alerts are often highlighted in red within your communication channels for immediate attention. -
Anomaly Score
A precise mathematical score (e.g., 0.87) generated by the FastTree algorithm representing the exact probability that the event is anomalous.
-
Predictive Reason
A plain-English explanation of why the AI flagged the event (e.g., “Unusual authentication package combined with off-hours RDP access”).
-
Frequency Context
If brute-forcing is suspected, the alert will include context such as “5th login attempt in the last 60 minutes.”
Getting Started
The AI Engine is designed to be entirely frictionless. There are no toggles, sliders, or complex configurations to manage.
Step 1: Ensure Premium Status
The AI engine is an always-on exclusive feature for Premium and Trial accounts. As long as your license key is active, the engine is running. No toggles required!
Step 2: Let the Baseline Train
The AI requires a small amount of historical data to understand what “normal” looks like for your specific environment. Simply use your PC normally for the first 3-5 days. During this brief training period, you may see slightly more Medium risk alerts as the engine learns your habits.
Advanced Threat Use Cases
Ghost Account Dormancy
Inactive accounts are prime targets for lateral movement. The AI automatically tracks dormancy; if an account logs in after 14+ days of inactivity, the Risk Level instantly spikes to High, exposing compromised dormant credentials.
Credential Stuffing
By utilizing the 1-hour rolling time-series frequency monitor, the engine immediately flags sudden bursts of logins from automated scripts, elevating the threat score even if the logins technically originate from a “known” IP address.
Impossible Travel
If a user logs in locally from New York, and 10 minutes later an RDP session authenticates from an IP address in Europe, the AI’s speed ratio algorithms will flag this physical impossibility as a critical anomaly.