Beyond Rules: Behavioral Models for Credential Abuse Detection

The Static Rule Trap

Static rules are comfortable. They're simple to write, easy to understand, and immediately deployable. A rule like "block login if geolocation change > 500 miles in 1 hour" seems reasonable. But attackers know exactly how to bypass it: they wait 61 minutes, or they route through a VPN that matches the user's city. The rule becomes a speed bump, not a wall.

Consider MFA fatigue. A static rule counting "more than 5 MFA denials in 10 minutes" is trivial to bypass. Attackers send push notifications at 4 AM, spaced 12 minutes apart. The user, half-asleep, finally accepts. The rule never fires. This is not a failure of vigilance—it's a failure of model design.

Behavioral Models: The Paradigm Shift

Behavioral models learn what 'normal' looks like for each user, device, and application. Instead of a global threshold, they build a probabilistic profile. Every authentication event is scored against that profile. Anomalies are not binary—they are continuous deviations that accumulate evidence over time.

At Ethereon, we model credential abuse across four dimensions: spatial-temporal behavior, authentication friction patterns, token usage graphs, and OAuth scope evolution. Each dimension produces a likelihood score. Combined, they form a unified risk vector.

Spatial-Temporal Behavior Modeling

Impossible-travel detection is the poster child of credential abuse. But static rules fail because they ignore context. A user who frequently travels between New York and London might have a legitimate login from London 4 hours after a New York login. A static rule would flag this as impossible. A behavioral model knows that this user's travel history makes it likely.

Our model uses a Gaussian mixture model over login location and time deltas. For each user, we maintain a set of clusters representing typical travel corridors. A new login is scored against these clusters. If the login falls outside all clusters with low probability, it's flagged.

# Simplified behavioral scoring for impossible-travel
from sklearn.mixture import GaussianMixture
import numpy as np

# Historical login data: [lat, lon, timestamp_delta_hours]
user_data = np.array([[40.7128, -74.0060, 0],
                      [51.5074, -0.1278, 7],
                      [40.7128, -74.0060, 48]])

model = GaussianMixture(n_components=2)
model.fit(user_data)

new_login = np.array([[51.5074, -0.1278, 6.5]])
score = model.score_samples(new_login)
print(f"Log likelihood: {score[0]:.2f}")
# Threshold: -10. Low score indicates anomaly

This approach catches attackers who try to mimic user travel patterns but fail to match the exact timing distribution. It also reduces false positives for frequent travelers.

MFA Fatigue Detection via Friction Modeling

MFA fatigue attacks exploit human psychology. The attacker bombards the user with push notifications until they accept. Static rules based on count alone miss attacks that are slow or spread across hours. Behavioral models look at the friction history of each user.

We model a user's typical MFA interaction sequence: time of day, device used, network location, and response speed. A sudden increase in MFA prompts from a previously unseen application or at an unusual hour is a red flag. But the real power is in modeling the acceptance pattern. If a user who always denies MFA prompts at 3 AM suddenly accepts one, the model assigns a high anomaly score.

# Pseudo-code for MFA friction model
class MFABehavioralModel:
    def __init__(self):
        self.user_profiles = {}  # user_id -> {hour_histogram, device_fingerprint, acceptance_rate}
    
    def score(self, user_id, event):
        profile = self.user_profiles[user_id]
        hour_score = self.hour_anomaly(profile.hour_histogram, event.hour)
        device_score = self.device_anomaly(profile.devices, event.device_hash)
        acceptance_anomaly = self.acceptance_rate_deviation(profile.acceptance_rate, event.accepted)
        return weighted_combination(hour_score, device_score, acceptance_anomaly)

By weighting recent behavior more heavily, the model adapts to gradual changes in user habits while still catching abrupt shifts that indicate compromise.

Token Replay and OAuth Scope Abuse

Token replay is a favorite technique in OAuth-based attacks. An attacker steals a refresh token or access token and reuses it from a different client or IP. Static token validation checks issuer, audience, and expiry—but not behavioral context. A behavioral model asks: Is this token being used in a way consistent with its initial grant?

Token Usage Graphs

We build a directed graph for each token: nodes are devices, IPs, and resource servers; edges are token usage events. The graph captures the typical flow of a token. A token that was granted on a mobile device in Chicago should not suddenly appear from a datacenter IP in Singapore accessing a sensitive admin API. The model computes a graph edit distance between the current usage and the historical pattern.

# Simplified token graph anomaly scoring
class TokenGraph:
    def __init__(self):
        self.token_history = {}  # token_id -> list of (device, ip, resource, timestamp)
    
    def score_usage(self, token_id, device, ip, resource):
        history = self.token_history.get(token_id, [])
        if not history:
            return 0.0  # first usage, no baseline
        # Compute similarity to historical usage
        last_usage = history[-1]
        # Example: same device, different IP but same /24 subnet -> low anomaly
        # Different device, different continent -> high anomaly
        anomaly = 0.0
        if device != last_usage[0]:
            anomaly += 0.5
        if ip.split('.')[:3] != last_usage[1].split('.')[:3]:
            anomaly += 0.3
        if resource not in [r for _,_,r,_ in history]:
            anomaly += 0.2
        return anomaly

This catches attackers who exfiltrate tokens and replay them from their own infrastructure. Even if the token is valid, the behavioral signature is wrong.

OAuth Scope Escalation Detection

OAuth scope abuse occurs when an attacker uses a token with limited scopes (e.g., profile.read) to access a resource requiring broader scopes (e.g., admin.write). This can happen through scope injection or token manipulation. Behavioral models monitor the scope transition matrix for each client application. Most apps request a stable set of scopes. A sudden request for a new, more privileged scope is anomalous.

We model scope sequences as a Markov chain. For each client_id, we compute the probability of transitioning from the current scope set to the requested scope set. A low-probability transition triggers an alert.

# Scope transition probability model
scope_transitions = {
    'client_abc': {
        ('profile.read',): {'profile.read': 0.95, 'profile.write': 0.05},
        ('profile.write',): {'profile.write': 0.90, 'admin.read': 0.10},
    }
}

def scope_anomaly(client_id, current_scopes, requested_scopes):
    transitions = scope_transitions.get(client_id, {})
    prob = transitions.get(tuple(sorted(current_scopes)), {}).get(tuple(sorted(requested_scopes)), 0.0)
    return 1.0 - prob  # higher = more anomalous

This model detects scope escalation even when the token is valid and not expired. It's a behavioral layer on top of standard OAuth validation.

The Ethereon Difference: Unified Behavioral AI

Ethereon integrates these behavioral models into a single, real-time detection pipeline. Our platform ingests authentication logs, token events, MFA responses, and OAuth flows from any identity provider (Okta, Azure AD, Keycloak, etc.). Each event is scored by multiple models, and the scores are fused using a Bayesian network that accounts for correlations between signals.

For example, an impossible-travel anomaly combined with a token replay anomaly is far more suspicious than either alone. The Bayesian network learns these dependencies from historical attack data and benign traffic, reducing false positives.

Our models are continuously retrained on fresh data, adapting to new attack patterns. When a novel credential abuse technique emerges—like token theft via malicious OAuth consent—the behavioral models detect it because the deviation from normal is extreme, even if no rule exists for that specific attack.

Zero-Day Credential Abuse: The Invisible Threat

Zero-day credential abuse attacks are those that have never been seen before. They don't match any known signature or rule. Behavioral models are uniquely suited to detect them because they don't rely on predefined patterns. They detect deviation from normal behavior, not match to known bad.

Consider a hypothetical attack: an attacker compromises a service account's OAuth client secret and uses it to generate tokens for a custom API that the service account never used. The token is valid, the IP is from a known datacenter, the time is during business hours. Static rules would miss this. But the behavioral model sees that this service account has never requested a token for that API, and the scope set is unusual. The anomaly score spikes, and the security team is alerted before any damage is done.

Ethereon's platform has detected such attacks in production environments, where attackers used stolen OAuth tokens to access internal APIs that were not monitored by any rule set. The behavioral models caught the anomaly because the token usage pattern was inconsistent with the historical behavior of the legitimate client.

Implementation Considerations

Deploying behavioral models for credential abuse requires careful planning. Here are key considerations for enterprise security teams:

• Data Quality: Behavioral models are only as good as the data they ingest. Ensure authentication logs include rich context: device fingerprint, IP geolocation, user agent, MFA method, and OAuth scopes. Incomplete data leads to weak models.
• Model Drift: User behavior changes over time. Models must be retrained regularly (e.g., daily or weekly) to avoid false positives. Ethereon automates this retraining with a feedback loop that incorporates analyst confirmations.
• Privacy: Behavioral models require storing historical user data. Ensure compliance with GDPR, CCPA, and other regulations. Use anonymization techniques where possible, and provide data retention policies.
• Latency: Scoring must happen in real-time (sub-100ms) to avoid impacting user experience. Ethereon's inference engine uses optimized C++ and GPU acceleration for low-latency scoring.

Key Takeaways

Credential abuse is evolving faster than static rules can keep up. Attackers exploit the gaps between rule thresholds, using techniques like MFA fatigue, token replay, and OAuth scope abuse that are invisible to traditional detection. Behavioral models offer a way out: they learn what normal looks like and flag deviations, catching both known and unknown attacks.

• Static rules are brittle and easily bypassed by low-and-slow attacks.
• Behavioral models for impossible-travel, MFA friction, token graphs, and OAuth scope transitions provide robust detection.
• Ethereon's unified platform fuses multiple behavioral signals using Bayesian networks for high-fidelity alerts.
• Zero-day credential abuse attacks are detectable only through behavioral deviation, not signature matching.
• Successful implementation requires high-quality data, regular model retraining, privacy compliance, and low-latency inference.

Security teams must move beyond static rules and embrace behavioral AI. The attackers already have.