interface SecurityEvent {
  eventId: string;
  timestamp: number;
  userId: string;
  eventType: 'AUTH' | 'SESSION' | 'TRANSACTION';
  payload: Record<string, unknown>;
}

interface NormalizedSignal {
  signalId: string;
  category: 'GEO' | 'DEVICE' | 'VELOCITY' | 'BEHAVIOR';
  weight: number;
  metadata: Record<string, unknown>;
}

class BehavioralTracker {
  private windows: Map<string, SecurityEvent[]> = new Map();

  addEvent(event: SecurityEvent): void {
    const history = this.windows.get(event.userId) || [];
    history.push(event);
    this.windows.set(event.userId, history.slice(-50)); // Keep last 50 events
  }

  computeVelocity(userId: string, windowMs: number = 60000): number {
    const history = this.windows.get(userId) || [];
    const cutoff = Date.now() - windowMs;
    return history.filter(e => e.timestamp >= cutoff).length;
  }

  detectSequence(userId: string, pattern: string[]): boolean {
    const history = this.windows.get(userId) || [];
    const recent = history.slice(-5).map(e => e.eventType);
    return pattern.every((step, idx) => recent[idx] === step);
  }
}

class RiskCalculator {
  private thresholds = { low: 30, medium: 60, high: 85 };

  calculate

Score(signals: NormalizedSignal[]): number { const rawScore = signals.reduce((acc, sig) => acc + sig.weight, 0); return Math.min(rawScore, 100); }

classifyRisk(score: number): 'ALLOW' | 'STEP_UP' | 'BLOCK' | 'REVIEW' { if (score < this.thresholds.low) return 'ALLOW'; if (score < this.thresholds.medium) return 'STEP_UP'; if (score < this.thresholds.high) return 'REVIEW'; return 'BLOCK'; } }

### Step 4: Action Routing & Enforcement
Decouple scoring from enforcement. Route decisions through a policy engine that can trigger step-up authentication, session termination, or manual review without hardcoding logic into the scoring layer.

```typescript
class EnforcementRouter {
  async execute(action: 'ALLOW' | 'STEP_UP' | 'BLOCK' | 'REVIEW', context: Record<string, unknown>): Promise<void> {
    switch (action) {
      case 'ALLOW':
        // Pass through, log for baseline tracking
        break;
      case 'STEP_UP':
        // Trigger MFA or OTP challenge
        break;
      case 'BLOCK':
        // Invalidate session, notify user via out-of-band channel
        break;
      case 'REVIEW':
        // Queue for fraud analyst dashboard
        break;
    }
  }
}

Architecture Decisions & Rationale

• Streaming Windows over Batch Processing: ATO attacks unfold in seconds. Batch analysis misses the temporal correlation required to detect rapid lockout sequences. Rolling windows capture velocity and sequencing in real time.
• Probabilistic Scoring over Hard Thresholds: Static rules generate false positives when legitimate behavior shifts (e.g., business travel, new device). Weighted scoring allows graceful degradation and adaptive thresholds.
• Decoupled Enforcement: Scoring should never directly block traffic. Routing through a policy layer enables A/B testing of thresholds, gradual rollout, and integration with existing IAM systems without rewriting core auth logic.
• Stateful Tracking with TTL Expiry: User baselines drift. Implement automatic window expiration and decay weights for older events to prevent stale data from skewing risk calculations.

Pitfall Guide

1. Hard Thresholds Replace Probabilistic Scoring

Explanation: Setting fixed limits (e.g., if velocity > 5 then block) ignores context. Legitimate users may trigger spikes during onboarding or password recovery. Fix: Implement weighted scoring with dynamic baselines. Use percentile-based thresholds that adapt to historical user behavior.

2. Over-Indexing on IP Reputation

Explanation: IP blocklists and datacenter filters generate massive false positives due to mobile NAT, corporate proxies, and residential VPN usage. Attackers easily bypass them with rotating proxy networks. Fix: Treat IP data as one low-weight signal among many. Prioritize device consistency, behavioral sequencing, and velocity metrics over source address.

3. Ignoring Session Continuity

Explanation: Evaluating requests in isolation misses the attack lifecycle. A password reset followed by an email change and 2FA disable is benign individually but malicious when sequenced. Fix: Maintain session-aware event streams. Track action sequences within defined temporal windows to detect lockout patterns.

4. Failing to Update User Baselines

Explanation: Static baselines become inaccurate as user behavior evolves. New devices, travel, or changed routines trigger false positives. Fix: Implement exponential decay for historical events. Recalculate baseline metrics weekly and allow user-initiated baseline resets with out-of-band verification.

5. Alert Fatigue from Uncalibrated Weights

Explanation: Assigning equal weight to all signals or using arbitrary thresholds floods security teams with low-fidelity alerts. Fix: Calibrate weights using historical fraud data. Run shadow mode deployments to measure precision/recall before enforcing blocks. Adjust weights based on false positive/negative ratios.

6. Privacy & Data Retention Violations

Explanation: Storing raw device fingerprints, IP logs, and behavioral traces indefinitely violates GDPR, CCPA, and internal compliance policies. Fix: Hash or tokenize sensitive identifiers. Implement strict TTL policies for raw event data. Aggregate metrics into privacy-safe summaries after the retention window expires.

7. Missing Fallback Mechanisms

Explanation: Over-reliance on automated scoring can lock out legitimate users during infrastructure outages or false positive cascades. Fix: Implement circuit breakers for the scoring pipeline. Route to permissive mode if latency exceeds SLA or if the scoring service fails. Maintain out-of-band recovery channels for affected users.

Production Bundle

Action Checklist

• Deploy event normalization layer to unify auth, session, and transaction payloads
• Implement rolling window aggregation for velocity and sequence detection
• Replace static rules with weighted probabilistic scoring engine
• Decouple risk calculation from enforcement via policy routing layer
• Run scoring pipeline in shadow mode for 14 days to calibrate thresholds
• Implement TTL-based data retention and identifier tokenization for compliance
• Configure circuit breakers and fallback routing for scoring service failures
• Establish out-of-band user recovery workflow for false positive scenarios

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
SMB SaaS Application	Lightweight scoring with step-up MFA	Low fraud volume, limited security team, need to minimize UX friction	Low infrastructure cost, moderate MFA provider fees
Enterprise B2B Platform	Behavioral correlation with session binding	High-value accounts, complex proxy environments, strict compliance requirements	Higher engineering overhead, reduced chargeback costs
High-Value Fintech/Crypto	Real-time scoring + out-of-band verification + manual review queue	Zero tolerance for ATO, regulatory mandates, rapid attacker monetization	Highest operational cost, lowest fraud loss exposure

Configuration Template

risk_pipeline:
  scoring:
    mode: probabilistic
    decay_factor: 0.85
    window_ms: 60000
    max_events: 50
  thresholds:
    allow: 30
    step_up: 60
    review: 85
    block: 100
  signals:
    geo_anomaly:
      weight: 15
      enabled: true
    device_inconsistency:
      weight: 20
      enabled: true
    velocity_spike:
      weight: 25
      enabled: true
    sequence_lockout:
      weight: 30
      enabled: true
    traffic_automation:
      weight: 10
      enabled: true
  enforcement:
    fallback_mode: permissive
    circuit_breaker:
      latency_threshold_ms: 50
      failure_rate_threshold: 0.15
    recovery:
      channel: email_sms
      cooldown_minutes: 30

Quick Start Guide

1. Instrument Event Emission: Add lightweight telemetry to your authentication and session management endpoints. Emit structured events containing userId, eventType, timestamp, and minimal context (geo hint, device hash, action type).
2. Deploy the Scoring Service: Run the RiskCalculator and BehavioralTracker as a stateless service backed by an in-memory store (Redis/Memcached) with TTL-based eviction. Connect it to your event stream.
3. Route Through Policy Engine: Integrate the scoring output into your existing auth middleware. Replace direct allow/deny logic with a switch that maps ALLOW/STEP_UP/REVIEW/BLOCK to your IAM provider's capabilities.
4. Validate in Shadow Mode: Route scoring decisions to a logging endpoint without enforcing blocks. Collect precision/recall metrics for 7–14 days. Adjust signal weights and thresholds based on observed false positive rates before enabling enforcement.