AI-Driven Authentication Anomaly Detection for Modern Telco and Enterprise Networks

Detecting anomalies in identity and access management is critical for protecting enterprise and telco systems from unauthorized access. This paper presents a hybrid anomaly detection framework that combines unsupervised clustering and supervised classification to identify and label anomalous login behaviors. Operating on realistic synthetic authentication logs, the system applies clustering algorithms (HDBSCAN, DBSCAN, OPTICS, KMeans, KMedoids) to detect behavioral outliers, which are then scored using silhouette-based confidence and classified into five categories: spoof, typo, command, random, and service. HDBSCAN achieved the best clustering performance with a silhouette score of 0.73. The neural network classifier reached over 98% accuracy with F1-scores above 0.96 for all categories. These results demonstrate the framework’s effectiveness in detecting high-risk authentication anomalies and enhancing Security Operations Center (SOC) workflows through interpretable classification.