Identity & access
New device, new IP, and login velocity on a live identity graph
Account takeover and session fraud are relationship-plus-time problems. JetGraph stores which identities used which devices, IPs, and locations — and answers novelty and velocity before you mint a session.
Signals
- New device detection — no prior identity→device edge
- New IP detection — no prior identity→IP edge
- Unusual geography — model geo as a node or as typed edges; novelty vs the identity’s known geos
- Login velocity — ring counters on LOGIN (or equivalent) edges
- Identity relationship graphs — shared devices/IPs across accounts (credential stuffing, mule networks)
- Session anomaly detection — combine the above at session start, then write the session/login edge regardless of challenge/reject
Why this is a graph engine job
A SQL table of last-login IP is not the same as “how many accounts share this device in 24h” plus “is this device flagged.” Those are neighbor and cardinality questions. JetGraph keeps them on the hot path; your IdP or app still owns MFA and session policy.
Loop
Login attempt → novelty(user, device), novelty(user, ip) → velocity(user, LOGIN, 1h) → GetNeighborCount(device) / neighbor risk → policy (allow / MFA / block) → write LOGIN edge → flag device or user if confirmed abuse