Published Papers

Volume 33 - Issue 1 (Regular Issue)
Transactions Papers

Adaptive multi‑factor authentication system for detecting the irregularities for sensitive application

Vidhyasagar BS, Vustepalley Mani Manjunath, Soma Prathibha, Dasari Vasu and Innamuri Sairam
Pages: 1-11Published: 05 Nov 2026
DOI: 10.33430/V33N1THIE-2025-0054
Cite thisHide

BS Vidhyasagar, V Mani Manjunath, S Prathibha, D Vasu and I Sairam, Adaptive multi‑factor authentication system for detecting the irregularities for sensitive application, HKIE Transactions, Vol. 33, No. 1 (Regular Issue), Article THIE-2025-0054.R2, 2026, 10.33430/V33N1THIE-2025-0054

 Copy

Abstract:

MFA Multi‑Factor Authentication has become one of the crucial security methods to fight against cyber threats. This paper discusses the MFA techniques and draws inspiration from the previous existing papers, reports, and cyber security frameworks which focus on the various methods of authentication like biometrics, security keys, etc. The traditional methods are based on the static authentic layers, which are vulnerable to threats. This paper proposes a Dynamic Threat Level Detection System to continuously monitor user behaviour and change the authentication levels based on the irregularities detected. The threat level ranges from 0 to 5. The level increases in the response to suspicious activities. A Split One‑Time Password (OTP) Mechanism is integrated into the proposed work where the six‑digit OTP is divided into two and is sent separately to the mail and the user's phone number which prevents the attackers from intercepting the OTP. At higher levels, a fake password interface is designed where the user must enter the hidden original window to enter the password; this process is only known to the user. An extra security method, i.e., the Song‑Based Authentication method is introduced at the highest level where the users select a particular segment of a preloaded song. If the user passes all the levels, a biometric verification is performed, and if any wrong input is detected, the system shuts down immediately to prevent access to unauthorised people. This method enhances the resistance to phishing and brute force methods. The research has further integrated AI for anomaly detection and blockchain‑based process authentication which provide a defensive mechanism against fast‑improving cyber threats.

Keywords:

multi‑factor authentication (MFA), cyber threats, dynamic threat level detection, split OTP Mechanism, song‑based authentication, AI‑based anomaly detection, blockchain, phishing, brute force

Reference List:

[1] D. R. Chirra, “AI‑Powered Adaptive Authentication Mechanisms for Securing Financial Services Against
Cyber Attacks,” Int. J. Adv. Eng. Technol. Innov., vol.5, no. 2, pp. 45–52, 2023.
[2] M. J. Goswami, “AI‑Based Anomaly Detection for Real‑Time Cybersecurity,” Int. J. Res. Rev. Tech.,
vol. 6, no. 1, pp. 10–19, 2024.
[3] V. Papaspirou, L. Maglaras, I. Kantzavelou, N. Moradpoor, and S. Katsikas, “A Blockchain‑based
Two Factor Honeytoken Authentication System,” arXiv preprint, arXiv꞉2307.05047, Jul. 2023.
[4] R. Brown, G. Bendiab, S. Shiaeles, and B. Ghita, “A Novel Multimodal Biometric Authentication System
using Machine Learning and Blockchain,” arXiv preprint, arXiv꞉2109.03014, Sep. 2021.
[5] T. Salman, M. Zolanvari, A. Erbad, R. Jain, and M. Samaka, “Security Services Using Blockchains꞉ A
State of the Art Survey,” arXiv preprint, arXiv꞉1810.08735, Oct. 2018.
[6] N. Alexopoulos, J. Daubert, M. Mühlhäuser, and S. M. Habib, “Beyond the Hype꞉ On Using Blockchains in
Trust Management for Authentication,” arXiv preprint, arXiv꞉1711.04591, Nov. 2017.
[7] J. Bonneau, C. Herley, P. C. van Oorschot, and F. Stajano, “The Quest to Replace Passwords꞉ A
Framework for Comparative Evaluation of Web Authentication Schemes,” in IEEE Symposium on
Security and Privacy, 2012
[8] Verizon, “2023 Data Breach Investigations Report,” 2023. [Online]. Available꞉ https꞉//www.verizon.com/business/resources/reports/dbir/
[9] Google Security Blog, “New Research꞉ How Effectivei s Multi‑Factor Authentication,” 2022. [Online]. Available꞉ https꞉//security.googleblog.com
[10] E. Marques and J. C. Campos, “Understanding User Frustration with Multi‑Factor Authentication,” in
Human Factors in Cybersecurity, Springer, 2022.
[11] Stallings, W. (2020). Cryptography and Network Security꞉ Principles and Practice. Pearson.
https꞉//doi.org/10.1680/CIEN.2009.162.5.44.
[12] Bonneau, J., Herley, C., Van Oorschot, P. C., & Stajano, F. (2015). "Passwords and the evolution of
imperfect authentication," Communications of the ACM, 58(7), 78‑87.
[13] Armknecht, F., Karame, G. O., Mandal, A., Youssef, F., & Zenner, E. (2015). "A survey of provably secure
searchable encryption," ACM Computing Surveys (CSUR), 47(2), 18
[14] Sadeghi, A. R., Visconti, A., & Wachsmann, C. (2015). "Enhancing security features in OTP‑based
authentication schemes," Journal of Information Security and Applications, 19(3), 123‑137.
[15] Dang, H. T., & Matthews, D. (2020). "Deepfake detection꞉ AI‑powered face spoofing attacks and
defenses," Computers & Security, 92, 101760.
[16] Lee, W., Stolfo, S. J., & Mok, K. W. (2018). "Adaptive intrusion detection꞉ A data mining‑based approach,"
Artificial Intelligence Review, 19(4), 253‑295.
[17] Gasti, P., & Rasmussen, K. (2019). "On the security of multi‑layer authentication frameworks," Journal of
Cryptographic Engineering, 9(3), 281‑299.
[18] Rivest, R. L., Shamir, A., & Adleman, L. (1978). "A method for obtaining digital signatures and publickey
cryptosystems," Communications of the ACM, 21(2), 120‑126.
[19] Ren, J., Hu, J., & Tian, W. (2020). "AI‑based anomaly detection for cybersecurity in authentication
systems," Future Generation Computer Systems, 115, 1‑15.
[20] Ye, G., et al. (2020). "SMS‑based OTP security vulnerabilities and countermeasures," International
Conference on Cyber Security and Cloud Computing, 224‑231.
[21] Ahmed, I., et al. (2021). "Decoy interfaces꞉ A novel method for securing password entry," Information
Security Journal꞉ A Global Perspective, 30(2), 89‑101.
[22] Li, Z., He, X., & Wu, C. (2021). "Automated security shutdown mechanisms for intrusion prevention,"
Journal of Cybersecurity Research, 6(1), 11‑23.
[23] Rathore, S., Park, J. H., & Chen, N. Multi‑Layered Authentication Frameworks for Cloud Security꞉ A
Comprehensive Review. Applied Sciences, 2023, 13(6), 10871.
[24] Zhou, Y., Han, J., & Wang, X. An Empirical Study of Weak Password Usage and Its Impact on Cloud
Authentication Systems. Journal of Information Security and Applications, 2021, 58, 102825.
[25] Sahoo, D., Liu, C. H., & Hoi, S. C. Malicious URL Detection using Machine Learning꞉ A Survey. ACM
Computing Surveys (CSUR), 2021, 53(6), 1–44.
[26] Nguyen, T. T., Nguyen, C. M., Nguyen, D. T., Nguyen, D. T., & Nahavandi, S. Deep Learning for Deepfakes Creation and Detection꞉ A Survey. ACM Computing Surveys (CSUR), 2022, 55(2), 1–41.
[27] European Commission. General Data Protection Regulation (GDPR). Official Journal of the European
Union, 2016.
[28] A. Ahmed, H. Alqahtani, et al., “A Novel Multi‑Factor Authentication Framework for Cloud Computing Security Based on Behavior and Contextual Parameters,” Applied Sciences, vol. 13, no. 10871, pp. 1–24, 2023. https꞉//doi.org/10.3390/app131810871
[29] NIST SP 800‑63B, “Digital Identity Guidelines,”National Institute of Standards and Technology.
[30] Bonneau et al., “The Quest to Replace Passwords꞉ A Framework for Comparative Evaluation,” IEEE S&P, 2012.
[31] Das et al., “The Tangled Web of Password Reuse,”NDSS, 2014
[32] Alsharif et al., “Context‑Aware Authentication for Mobile Devices,” Computers & Security, 2021.
[33] Hu et al., “Attribute‑Based Access Control,” NIST, 2014.
[34] Khan et al., “A Survey of Modern Threats and Attack
Trends in Online Banking,” Computers & Security, 2018
[35] Oloyede & Hancke, “Song‑Based Authentication Schemes꞉ A Cognitive Alternative,” IJCS, 2020
[36] Zhang et al., “Face Anti‑Spoofing꞉ A Survey,” arXiv preprint, 2020.
[37] Conti et al., “A Survey of Security and Privacy Issues in Modern Authentication Systems,” CSUR, 2019.
[38] Sebastien et al., “Federated Identity Management Systems꞉ A Review,” Journal of Network and
Computer Applications, 2019.
[39] Abomhara et al., “Machine Learning for Threat Detection in Cybersecurity,” FGCS, 2020.
[40] Sönmez et al., “Next‑Generation Authentication Models꞉ Challenges and Directions,” IEEE Access,
2022.
[41] National Institute of Standards and Technology. (2017). NIST Special Publication 800‑63B꞉ Digital
Identity Guidelines ‑ Authentication and Lifecycle Management.
[42] Cheng, L., Liu, F., & Yao, D. (2017). Enterprise data breach꞉ causes, challenges, prevention, and future
directions. IEEE Security & Privacy, 15(5), 58–66.
[43] International Organization for Standardization. (2013). ISO/IEC 27001꞉2013 Information security management systems.
[44] Bertino, E., & Sandhu, R. (2005). Database security—concepts, approaches, and challenges. IEEE Transactions on Dependable and Secure Computing, 2(1), 2–19.
[45] Almeida, J., & Silva, L. (2020). Adaptive authentication in cloud computing environments꞉ a systematic literature review. Journal of Cloud Computing, 9(1).
[46] Bhargav‑Spantzel, A., Squicciarini, A. C., & Bertino, E. (2007). Establishing and protecting digital identities in federation systems. Journal of Computer Security, 15(3), 321–371.
[47] A. K. Jain, M. P. Easley, and J. Han, “Anomaly detection꞉ A survey,” ACM Computing Surveys (CSUR), vol. 54, no. 2, pp. 1‑38, 2021.
[48] N. Saxena and J. Voris, “Split credentials꞉ Breaking authentication silo with context,” IEEE Security & Privacy, vol. 16, o. 5, pp. 37‑44, 2018.
[49] A. Juels and R. L. Rivest, “Honeywords꞉ Making password‑cracking detectable,” in Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 145‑160, 2013.
[50] X. Chen, M. Jakobsson, and G. Johnson, “Using music and rhythm for secure and usable authentication,” in Proceedings of the 2015 ACM International Joint Conference on Pervasive and Ubiquitous Computing, pp. 157‑168, 2015.
[51] Y. Taigman, M. Yang, M. Ranzato, and L. Wolf, “DeepFace꞉ Closing the gap to human‑level performance in face verification,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1701‑1708, 2014.
[52] T. Ristenpart, E. Tromer, H. Shacham, and S. Savage, “Hey, You, Get Off of My Cloud꞉ Exploring Information Leakage in Third‑Party Compute Clouds,” in Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS), pp. 199‑212, 2009.
>> more<< less