Design and Build a Machine Learning-Based Brute-Force Login Early Detection System with Adaptive Risk Scoring and Automated Actions

Brute-force login attacks pose a significant cybersecurity threat to information systems, potentially leading to unauthorized access and data loss. This research designs and builds an early detection system for brute-force login attacks by integrating a machine learning-based classification model, an adaptive risk scoring mechanism, and automated response actions. The Random Forest model was trained using login attempt log data collected from a controlled test website over two months with 100 dummy accounts, resulting in 30,000 entries comprising 17,000 normal, 5,000 suspicious, and 8,000 attack data samples. The adaptive risk scoring mechanism combines the ML model output with four contextual indicators frequency of failed attempts, access time, IP location, and user agent to generate a dynamic risk score, enabling the system to make decisions based on multiple indicators rather than a single factor. Evaluation results demonstrate 96.5% accuracy, 95.8% precision, and 97.2% recall in three-class classification. Ablation studies confirm that the integration of adaptive risk scoring improves accuracy from 91.2% (RF only) to 96.5% (RF with all indicators). The system successfully blocked 8 IP addresses identified as attacking sources, achieving a false positive rate of 0.7% and an average response time of 42 milliseconds. This study concludes that the combination of Random Forest, adaptive risk scoring, and automated actions provides an effective and comprehensive approach for the early detection of brute-force login attacks.