Machine learning and artificial intelligence (A.I.) are rapidly finding new and interesting ways of changing the world. From A.I. powered toothbrushes to content recommendation engines, A.I. is making waves through our lives. Recently, A.I. has proven to be a powerful ally in cybersecurity by busting fraudsters, booting unauthorized guests, and locking down compromised systems. At OneLogin, we use the same A.I. principles that protect the biggest names in tech. Our Vigilance AI™ platform works tirelessly to detect and flag suspicious activity in your account and adds an additional layer of protection to your logins in real time if suspicious activity is detected. Here’s an insider look at how we do it. **There’s Nothing Naïve About Bayes’ Theorem Here **Bayes’ Theorem is considered one of the most important theorems in statistics. You may have seen this formula in a textbook, or a Wikipedia article, or tattooed on a stats geek before. This is the underpinning of how OneLogin analyzes user behavior to determine the risk with each login event. 
For anyone not into statistics, this is how the formula reads: A = The event is fraudulent B = The event we were given P( A | B ) probability that the login is fraudulent given that it looks like the event given P( B | A ) is the probability a bad actor sending this event P( A ) is the probability of an event being fraudulent P( B ) is the probability of being given an event that looks like this Before we describe the formula, there are a few things we should get out of the way. First, the data we analyze is known as a “login event.” A login event has various features such as time of day, city location, computer model, web browser. A table of these events might look like this if you log into work every morning at 10AM. 
As you can see, the more times you log into work from your work MacBook in San Francisco, the more the system trusts these events. If you continue to follow the pattern you’ve set up for yourself, the probability of a login being fraud looks like this. P(B) the probability that we’d get an event like this is high, which drives the overall risk factor down, considering that the probability of an event event like this is fraud P(B|A) is low as well as the fact that most logins are not fraudulent so P(A) is low normally. 
Let’s look at a suspicious event that comes in using the formula. Example: Business Trip or Hacks? Say we get an event that looks like this: 
This event is a login from a city that you’ve never logged in from before: Tokyo, Japan. So out of say 1000 logins you’ve made in the past year, 5 (for example) have happened at 7 AM, and none have happened in Tokyo from a Google Pixel device. Therefore the probability of receiving such an event P(B) is very low. However, if a bad actor were to compromise your account and they happened to be located in Tokyo, Japan, the probability of them logging in with these parameters P(B | A) is moderate to high. In this case, we’re detecting the Tokyo IP via 3rd party IP reputation service, cross referencing with our internal risk engine, and matching with what we know about you. 
This is great! But what happens if you’re legitimately traveling to London for business and log in to your desktop station from your MacBook? You might have never logged in from London before, so P(B) is going to be low, but we can account for that by looking at the device type, network domain, time of day, and other features of the event for anomalies. These other features have lower risk factors associated with them because they’re within normal parameters for your login patterns, so the risk calculated is less than the Tokyo example. Your company can configure what constitutes a high enough risk score, which provides flexibility to set policies that range from highly secure to user convenient. Why Naïve Bayes?
You’ll note that this entire article is predicated on Naïve Bayes. I should come clean— I lied to you— we do not use Naïve Bayes in our algorithm. What we actually use is far more complex using neural networks and machine learning, but Naïve Bayes is a good starting point for you to understand the direction our system takes to secure your logins. “Naïve” in the name of Naïve Bayes is the assumption that features are independent from one another. That is, what time of day you logged in has no correlation to which browser you’re using. This assumption is clearly false in reality because how you work may affect the features of the login event (you browse with Firefox at your desk job with scheduled hours, but you browse with Safari on a MacBook when you log in from home). The data scientists at OneLogin have come up with a carefully tuned system that accounts for these cross-contaminations among features of login events, but I hope that this oversimplified example offers you an entry into the way Vigilance AI™ keeps your systems safe.