Client-side brute force attack detection leveraging large language models

For email authentication systems, the last mile of authentication poses a critical security challenge, as attackers leverage known, real logins to bypass established server-side protections against brute-force attacks and credential stuffing. Traditional methods like rate limiting and threshold anomaly detection are ineffective against distributed, stealthy attacks that mimic normal user activity. This paper proposes a novel framework for detecting authentication sequences on the client side by leveraging lightweight Large Language Models (LLMs) in real time. Unlike signature-based approaches, the proposed framework can "explain" the temporal and contextual characteristics of login behavior and detect anomalous sequences, such as high-frequency bursts and low-and-slow last-mile reassembly attacks, without the need for predefined signatures or centralized log aggregation. The framework was tested with 2.5 million authentication sessions, 1 million of which were marked as attacks, and achieved 98.4% attack-detection accuracy with a false-positive rate of 1.2%. With an average response time of 180 ms, it achieves near real-time inference without impacting the user experience. The system was live-deployed for six months and succeeded in blocking more than 1.2 million malicious logon attempts and safeguarding more than 850,000 user accounts against traditional baselines in both scale and precision. The results demonstrate the promise of lightweight, client-side LLMs as a privacy-safe, low-resource, and robust solution for last-mile email authentication security against current and future brute force attack vectors.