\documentclass[conference]{IEEEtran}
% For journal papers, use:
% \documentclass[journal]{IEEEtran}

% -----------------------------
% Packages commonly allowed by IEEE
% -----------------------------
\usepackage{cite}
\usepackage{amsmath,amssymb,amsfonts}
\usepackage{graphicx}
\usepackage{textcomp}
\usepackage{xcolor}

\begin{document}

% -----------------------------
% Title and Author Block
% -----------------------------
\title{
    \title{A Context-Aware Risk-Based Authentication Scheme: A Simulation Study}

}

\author{
\IEEEauthorblockN{Author Name}
\IEEEauthorblockA{
Affiliation\\
City, Country\\
email@example.com
}
}

\maketitle

% -----------------------------
% Abstract
% -----------------------------
\begin{abstract}
This paper proposes a context-aware framework for risk-based authentication that leverages anomaly detection to strengthen login security while minimising user friction. As traditional authentication methods grow increasingly vulnerable to threats such as credential theft and account takeover, adaptive mechanisms are essential. The proposed scheme analyses contextual data—including user location, device information, and login timing—to generate a real-time risk score for each login attempt. Based on this score, the system dynamically adjusts its response, allowing seamless access for low-risk behaviour while requiring secondary verification for high-risk attempts. To evaluate the framework’s effectiveness, we developed a simulation environment and executed 1,000 login attempts across 200 randomly generated users under diverse scenarios. Results demonstrate that the system consistently identifies fraudulent activity, assigning high-risk scores to anomalous attempts while permitting legitimate logins without disruption. The simulation dataset supporting this study is openly available in Mendeley Data (Siddiqui, 2026, Simulation Data of User Authentication (context-based risk aware authentication), V2, doi:10.17632/3rk32x7g8t.2). These findings confirm the viability of a data-driven, risk-based approach to fortifying user accounts against sophisticated threats, offering a balance between enhanced security and improved usability.\end{abstract}

\end{abstract}

% -----------------------------
% IEEE Keywords
% -----------------------------
\begin{IEEEkeywords}
    %/--<keywords

    %/-->keywords
\end{IEEEkeywords}

% -----------------------------
% Sections
% -----------------------------
\section{Introduction}
\label{sec:introduction}

The digital landscape is increasingly defined by the security of personal and corporate data, with user authentication serving as the primary line of defence. However, the reliance on static authentication methods—such as passwords and one-time codes—has proven to be a significant vulnerability \cite{morris1979,blonder1996,tari2016,tsiakis2005economic}. Studies have shown that these traditional methods are susceptible to attacks such as credential theft, replay, and shoulder-surfing \cite{umar2012,juned2012,nizamani2021,misbah2024}. Sophisticated attacks, including credential stuffing, phishing, and malware, often bypass these measures, resulting in widespread data breaches and significant financial losses. The challenge lies in creating an authentication system that is robust enough to repel these threats without introducing excessive friction that frustrates users and diminishes the overall user experience. This trade-off between security and usability has long been a central dilemma in cybersecurity \cite{DeCristofaro13,schneier2013carryon,misbah2018}.

To address this challenge, the field is shifting from static, binary authentication to a dynamic, risk-based approach. A risk-based authentication (RBA) system moves beyond simply verifying a user's credentials; it evaluates the context of each login attempt to determine its level of risk \cite{Hwang02,asosheh2009risk_assesment,lv2010risk_assesment}. This involves analysing a range of contextual factors, such as the user's location, the device being used, and the timing of the login. By continuously assessing these signals, an RBA system can make intelligent, real-time decisions on whether to grant access, request secondary verification, or deny the attempt altogether \cite{misbah2025}.

This paper proposes a comprehensive risk-based authentication framework that leverages contextual anomaly detection. Our approach focuses on establishing a "baseline" of normal user behaviour and then identifying deviations from that baseline as potential anomalies. These anomalies are then scored based on the severity of the deviation. The system's response is adaptive, applying the minimum necessary friction for low-risk logins while escalating security measures for high-risk scenarios. This work outlines the architectural design of our framework and presents the results of a simulation that demonstrates its effectiveness in identifying and mitigating security risks, thereby offering a more secure and user-friendly alternative to conventional authentication methods.


\section{Related Work}
\label{sec:related}
The foundational problem of securing user authentication has been extensively explored, with early efforts focusing on strengthening static credentials. Research provides a comprehensive survey of traditional methods and their inherent security challenges, highlighting the need for more adaptive defences \cite{morris1979,blonder1996,tari2016}. This has led to the emergence of risk-based authentication (RBA) as a key solution \cite{eastwood2014a,eastwood2014,misbahuddin2017,bijon2013riskaware}. Misbahuddin et al. (2017) advanced this field by designing a risk-based authentication system that integrates a risk engine with machine learning algorithms, demonstrating how contextual parameters, such as IP address, location, time zone, and failed login attempts, can be leveraged to dynamically adjust authentication challenges and strengthen security.

A significant body of work has also explored the use of behavioural biometrics to enhance RBA systems. Our framework complements these approaches by focusing on contextual data—such as location, time of day, and device information—to identify anomalies, which represent a distinct and equally critical component of a comprehensive RBA system \cite{chu2020,li2021,mhamed2013contextaware}. 

The concept of context-aware security is closely related, as researchers have long sought to integrate situational factors into security decision-making \cite{por2019,kawamura2021}. Multi-factor authentication (MFA) has been further proposed to strengthen login security by combining multiple signals \cite{nag2015mfa}. Building on these principles, our work introduces a novel risk-scoring model that synthesises predefined contextual variables into a single actionable score, enabling an adaptive response that balances usability with robust protection.


\section{methodology}
\label{sec:methodology}
Our proposed risk-based authentication framework is a dynamic, data-driven system comprising three core phases: data collection and baseline establishment, real-time risk scoring, and adaptive response.

\subsection{The Risk-Scoring Model}
The central component of our scheme is a quantitative risk-scoring model that assesses the likelihood that a login attempt is fraudulent. This model assigns a numerical score, $S_{risk}$, to each authentication request by aggregating weighted values from multiple contextual factors. The generalised score calculation is shown in the following formula:
\begin{equation}
    S_{R} = \sum_{i=1}^{n} w_i \cdot F_i
    \label{eq:risk_score} % Added label for correct referencing
\end{equation}
where:

\begin{itemize}
    \item $S_{R}$ is the weighted, normalised risk score (0 to 1). The final $S_{risk}$ is this value multiplied by 100.
    \item $n$ is the total number of contextual factors evaluated.
    \item $w_i$ is the weight assigned to the $i^{\text{th}}$ factor. The weights are configurable and reflect the perceived importance of each factor in a specific application environment, where $\sum w_i = 1$.
    \item $F_i$ is the value of the $i^{\text{th}}$ factor, a normalised value (e.g., between 0 and 1) that indicates the degree of deviation from the user's established baseline. A value of 0 indicates a perfect match to the trusted profile, while a value of 1 indicates a significant anomaly.
\end{itemize}

The final risk score, $S_{risk}$ (scaled from 0 to 100), is then compared against predefined thresholds to determine the authentication action. A very low score (e.g., $S_{risk}<20$) triggers a frictionless login, granting immediate access. A moderate score (e.g., \leq S_{risk}<60$) prompts a secondary verification step, such as a one-time password. A high score (e.g., $S_{risk} \geq 60$) could result in a temporary account lock or a more intensive verification process, such as a biometric check or security questions. This tiered approach enables highly granular, dynamic responses to the perceived risk of each login attempt, ensuring robust security without compromising the user experience.
The following table provides examples of contextual factors, their typical normalised values $F_i$, and suggested weights $w_i$ for a real-world implementation.

\begin{table*}[htbp]
\centering
\caption{Contextual factors used in the risk-scoring model}
\small
\begin{tabularx}{\textwidth}{X X X}
\toprule
\textbf{Contextual Factor} & \textbf{Example Value ($F_i$)} & \textbf{Suggested Weight ($w_i$)} \
\midrule
Location (e.g., new city/country) & 1.0 (new) to 0.0 (frequent) & 0.6 \
Device (e.g., new device type or browser) & 1.0 (new) to 0.0 (known) & 0.2 \
Time of Day (e.g., unusual time zone) & 1.0 (unusual) to 0.0 (usual) & 0.1 \
IP Address Reputation (e.g., Tor exit node, VPN) & 1.0 (suspicious) to 0.0 (trusted) & 0.1 \
\bottomrule
\end{tabularx}
\label{tab:risk_factors}
\end{table*}


\subsection{Data Collection and Baseline Establishment}
The system begins by collecting key contextual data points for each user's login history over a specified period. This includes:
\begin{enumerate}
    \item Geographical Location: User's city and country, and timezone based on the geographic location of the user.
    \item Device Information: Type of device (e.g., desktop, mobile) and operating system (e.g., Windows, macOS, Android, iOS).
    \item Login Timing: Time of day, which is critical for identifying logins that occur outside a user's normal pattern.
    \item Network Attributes: The presence of a VPN, proxy, or Tor exit node.
\end{enumerate}
This data is used to construct a baseline profile of each user's typical login behaviour. The behaviour learns the most frequent locations, devices, and times of day from which they log in. This baseline serves as the normative model against which all future login attempts are measured.

\subsection{Real-time Risk Scoring}
Upon each login attempt, the system compares the current contextual data to the user's established baseline profile. For each factor, a partial risk score ($F_x$) is calculated based on the degree of deviation from the expected value. For example, a login from an unknown city or a different country than the user's last login would receive a higher partial score ($F_x$). The partial scores are then aggregated using a weighted sum and scaled to 100 to produce a single, comprehensive risk score, $S_{risk}$. The expanded formula for the total risk score $S_{risk}$ is as follows:
\begin{multline}
S_{risk} = 100 \times (w_{loc}\times F_{loc} + w_{device}\times F_{device} \
+ w_{timing}\times F_{timing} + w_{network}\times F_{network})
\end{multline}
where $w_x$ represents the weight of each contextual factor and $F_x$ is the partial, normalised score for that factor (0 to 1). The sum of all weights $\sum w_x$ must equal 1. The weights are assigned based on each factor's perceived security risk. For instance, a login from a Tor exit node carries a significantly higher weight than a slight deviation in login timing. 

\subsection{Adaptive Response}
The final phase involves an adaptive response based on the calculated risk score. The system classifies the risk score into three categories, each triggering a different user experience.

Frictionless Login ($Score < 30$): If the risk score is low, the system considers the attempt normal and grants immediate access, with no additional security steps required. This ensures a seamless user experience for trusted behaviour.

Moderate Risk ( \le Score \le 60$): A score in this range triggers a secondary verification step, such as a one-time code sent to the user's registered email or phone number.

High Risk ($Score > 60$): For high-risk attempts, the system may block the login entirely or prompt the user to reset their password, along with an email notification about the suspicious activity.

This adaptive approach allows the system to apply the appropriate level of security for each unique login attempt.

\subsection{Simulation and Evaluation Methodology}
Obtaining large-scale, real-world user login data spanning diverse geographic locations and behavioural patterns is often constrained by privacy, security, and feasibility issues. To effectively evaluate the performance, robustness, and adaptability of the proposed Adaptive Risk-Based Authentication (RBA) scheme under various conditions, we developed a comprehensive simulation framework, which we term the \textbf{Login Scenario Simulator}. 
\begin{figure}[htbp] \centering \includegraphics[width=0.5\textwidth]{login_scenarios1.png} \caption{Simulation Login Scenario Distribution} \label{fig:simulation} \end{figure}
The simulator generates synthetic user data and dynamically constructs thousands of unique login attempts across hundreds of virtual users. The primary goal of the simulator is to provide the RBA model with a wide range of test cases, encompassing both:
\begin{enumerate}
    \item \textbf{Normal Login Scenarios:} Attempts that align closely with a user's established trusted profile (e.g., known device, frequent location, usual time).
    \item \textbf{Abnormal/High-Risk Scenarios:} Attempts that significantly deviate from the trusted profile (e.g., new device, connection from a suspicious IP/VPN, unusual time zone), simulating potential credential compromises or session hijackings.
\end{enumerate}

Test cases are dynamically generated by passing the required contextual parameters (such as mock location, device identifier, and time of day) to the authentication engine, mimicking the data transmission of an actual login request (e.g., via a standard HTTP GET method). Upon receiving these simulated attempts, the authentication engine processes the input through the risk-scoring model defined in Equation \ref{eq:risk_score}. The simulation then records the engine's response, classifying each attempt into one of the predefined tiers: Low Risk, Medium Risk, or High Risk, and verifying that the appropriate corresponding action (frictionless access, secondary challenge, or account block) is taken. This methodology enables a comprehensive assessment of the scheme's ability to balance security enforcement with user experience across a wide range of scenarios.



\section{Result and Discussion}
\label{sec:results}

\subsection{Results}

\begin{table}[h]
\centering
\caption{Average Risk Scores and Risk Categories Across 1000 Simulated Logins}
\label{tab:avg_scores}
\begin{tabular}{l c c}
\toprule
Scenario & Avg. Risk Score & Risk Category \
\midrule
Frictionless Login & 14.82 & Low \
Device Change & 35.92 & Moderate \
Odd Timing & 45.65 & Moderate \
Location Change & 58.03 & Moderate \
Proxy Login & 68.33 & Moderate/High \
VPN Login & 74.77 & Moderate/High \
Tor Login & 87.48 & High \
Password Stolen & 98.52 & High \
Incorrect Password & 100.00 & High \
\bottomrule
\end{tabular}
\end{table}

The simulation data provides clear evidence of the framework's effectiveness in accurately classifying login attempts by risk level. Across 1000 simulated logins from 200 users, risk scores were calculated for each scenario.

Normal Logins: The vast majority of normal logins (n = 97) received risk scores below 20. The average risk score for these attempts was 14.82, placing them squarely in the Frictionless Login category. This confirms the system's ability to minimise user friction for trusted, routine behaviour.

Location Change: Logins from a new or previously unseen location (n = 22) were associated with significantly higher risk scores. The average score for this scenario was 58.03, placing it in the Moderate Risk category, which appropriately triggered a secondary verification step.

Device Change: Attempts from an unknown device (n = 16) yielded an average risk score of 35.92, also categorising them as Moderate Risk. This demonstrates the system's ability to identify and respond to deviations in a user's typical device usage.

Odd Timing: Login attempts made at an unusual time of day (n = 20) resulted in an average risk score of 45.65, placing them in the Moderate Risk category.

VPN or Proxy Use: Logins originating from VPNs (n = 13) or proxies (n = 9) consistently received elevated risk scores, averaging 74.77 and 68.33 respectively. These scenarios straddle the boundary between moderate and high risk, often prompting an immediate security alert or secondary challenge.

Incorrect Password: This scenario is straightforward—incorrect credentials result in immediate denial.

Stolen Password: This case simulates credential compromise, where contextual mismatches (location, device, network) elevate the risk score to more than 90, categorising it as High Risk.

\begin{figure}[htbp]
\centering
\includegraphics[width=0.5\textwidth]{Risk_score_avg1.png}
\caption{Distribution of Average Risk Scores Across Scenarios}
\label{fig:simulation2}
\end{figure}

\subsection{Discussion}

\begin{table*}[t]
\centering
\caption{Sample Simulation Events and Risk Engine Outcomes}
\label{tab:case_studies}
\begin{tabular}{l l l l l l}
\hline
User & Location & Device/OS & Distance (km) & Risk Score & Outcome \
\hline
user104 & Dubai & Laptop/macOS & 7.61 & 1 & Frictionless, no anomalies \
user169 & Paris & Desktop/macOS & 9.26 & 21 & Frictionless, device change \
user6   & New York & Laptop/Windows (Proxy) & 276.72 & 72 & Elevated Risk, email alert \
user173 & Paris & iPhone/iOS & 10.6 & 22 & Frictionless, device change \
\hline
\end{tabular}
\end{table*}

The simulation results validate the core hypothesis that a contextual anomaly detection framework can effectively differentiate between normal and fraudulent login attempts. The system’s risk-scoring model, which aggregates scores based on location, device, timing, and network attributes, proved to be a reliable indicator of potential security threats. By assigning higher weights to more critical factors, such as VPN or proxy usage, the framework correctly escalated the response for the most suspicious activity.

A key strength of this framework is its adaptive nature. The clear delineation of risk score thresholds enables a dynamic response that balances security and user experience. Users performing routine logins from their usual device and location were granted frictionless access, while users exhibiting anomalous behaviour were challenged with proportionate security measures. This approach avoids the ``one-size-fits-all'' friction of traditional multi-factor authentication, which can frustrate users and lead to security fatigue \cite{nag2015mfa,DeCristofaro13}.

Our findings align with prior work on risk-aware authentication, which emphasises adaptive decision-making based on contextual signals \cite{bijon2013riskaware,eastwood2014a,eastwood2014}. Unlike earlier models that primarily relied on static thresholds, our framework introduces a dynamic scoring mechanism that continuously recalibrates based on user behaviour. This distinction highlights the novelty of our contribution: a system that not only detects anomalies but also adjusts its response in real time to minimise unnecessary friction.

Furthermore, integrating contextual variables, such as device type and network attributes, builds on the principles of context-aware security \cite{mhamed2013contextaware}. By synthesising these signals into a unified risk score, our framework demonstrates how anomaly detection can be operationalised into practical, user-friendly authentication. This positions our work as a bridge between theoretical models of risk assessment \cite{tsiakis2005economic,asosheh2009risk_assesment,lv2010risk_assesment} and applied authentication systems that must balance usability with robust defence.


\section{Conclusion}
\label{sec:conclusion}

This paper introduces a robust risk-based authentication framework that leverages contextual anomaly detection to enhance both security and the user experience. By establishing a baseline of normal user behaviour and assessing each login attempt against this profile, the system can calculate a real-time risk score. The simulation results demonstrate the framework's effectiveness, showing that it accurately assigns low risk scores to legitimate logins and appropriately escalates responses to anomalous attempts from unknown locations, devices, or networks. Our findings confirm that a dynamic, risk-based approach is a viable and more effective alternative to traditional, static authentication methods \cite{morris1979,blonder1996,tari2016,bijon2013riskaware,eastwood2014a,misbahuddin2017}. 

This research offers a blueprint for building a more intelligent security system that is both resilient to modern threats and responsive to user needs \cite{schneier2013carryon,tsiakis2005economic}. Future work will focus on refining the risk-scoring model by incorporating advanced machine learning techniques \cite{misbahuddin2017,lv2010risk_assesment} and exploring additional contextual data points, such as behavioural biometrics, to further strengthen the system's predictive capabilities \cite{killourhy2009,mhamed2013contextaware}.


% -----------------------------
% Acknowledgment (optional)
% -----------------------------
\section*{Acknowledgment}
%/--<acknowledgment

%/-->acknowledgment
\section{Future Work}
The weights of each contextual factor could be dynamically adjusted in future work by integrating machine learning, enabling the system to gradually learn and adapt to changing user behaviour and emerging threats. Future developments will focus on expanding the contextual anomaly detection model. A more advanced model would include a greater variety of behavioural biometrics, such as mouse movement patterns, keystroke dynamics, and navigation behaviour before login. By creating a dynamic, evolving baseline for each user, the system could identify more complex and subtle abnormalities that conventional contextual data alone might miss.

A significant next step is to integrate the framework into real-world settings and conduct large-scale validation. This would involve embedding the risk-scoring engine into an existing identity and access management (IAM) system, such as one utilising OAuth 2.0 or OpenID Connect. A formal user study with a diverse population would be necessary to gather both quantitative data on authentication friction and qualitative feedback on the user experience. Such a study would provide concrete metrics on the trade-off between security enhancements and usability, which is a central theme of this research.

Finally, the risk-scoring logic can be further refined using advanced machine learning models. The current framework's risk calculation is based on a defined set of rules. Future work could explore training a neural network or a Support Vector Machine (SVM) on a massive dataset of both legitimate and fraudulent login attempts. This would enable the model to autonomously identify complex, non-linear relationships between contextual data points, resulting in a more accurate and resilient risk assessment in an evolving threat landscape.


% -----------------------------
% References
% -----------------------------
\bibliographystyle{IEEEtran}
\bibliography{references}

\end{document}