In a six-month deployment, the system analyzed login behavior on users’ devices and reported high detection accuracy with a 1.2% false-positive rate.
The system examined detailed login behavior, including the timing and sequence of interactions, rather than relying only on server-side records such as failed-login counts or IP addresses. Its designers say this helped identify both rapid bursts and slower attacks that spread activity across sessions to resemble normal users.
In testing, the system analyzed 2.5 million authentication sessions, including 1 million labeled as attacks. It ran an 8-billion-parameter LLaMA-3 model in a compressed format without task-specific fine-tuning, and produced an average response in 180 milliseconds. During live use, it reportedly blocked more than 1.2 million malicious logins and protected more than 850,000 user accounts.
What the system detected
The framework reported 98.4% accuracy in detecting attacks and a 1.2% false-positive rate across 2.5 million authentication sessions. The evaluation included 1 million sessions marked as attacks. Its average response time was 180 milliseconds.
In a six-month live deployment, the system blocked more than 1.2 million malicious login attempts and safeguarded more than 850,000 user accounts. The researchers verified blocked activity using security and enterprise monitoring logs, threat-intelligence records, timing and credential-pattern analysis, controlled attack scenarios, and comparisons with live blocks. They report that the system performed better than rate-limiting, statistical machine-learning, and cloud-based language-model baselines.
Why local detection matters
Server-side defenses typically see coarse information such as login outcomes, IP addresses, and failure counts. By operating at the authentication endpoint, this system was designed to examine finer details of how a login unfolded, including interaction timing and other behavioral signals.
That local approach could help detect distributed or deliberately slow attacks that avoid fixed server-side thresholds, while reducing the need to send detailed behavioral data to a central service. The results suggest that a lightweight language model can perform this analysis with a response time the researchers describe as near real time.
Evidence and open questions
The evidence combines an empirical evaluation of 2.5 million enterprise email-authentication sessions with a six-month live deployment. The reported labels were not based solely on whether the system blocked an event; the researchers cross-checked activity with multiple security data sources and controlled attack tests.
The evaluation covered enterprise email authentication, so the findings may not apply to OAuth 2.0, single sign-on portals, or step-up multi-factor authentication without further testing. The study did not systematically assess performance across different client hardware, including low-end mobile browsers and low-power devices. The authors also acknowledge that attackers who understand the system’s behavioral features might imitate ordinary logins and evade detection.
// Source
Future Technology · 2026 · DOI: 10.55670/fpll.futech.5.4.5
Authors: Israa Ahmed Abbas, Taha Mohammed Hasan, Ruaa Azzah Suhail
Institutions: University of Diyala
