User Logins: Detect Suspicious Login Patterns Across Sessions

Question

## Round 1 - Coding

## Problem

Given a log of user login events `(user_id, timestamp, ip_address)`, detect suspicious activity: a user logging in from more than `K` distinct IP addresses within any rolling window of `W` minutes.

```python
from datetime import datetime

def detect_suspicious_logins(
    events: list[tuple[str, datetime, str]],
    max_ips: int,
    window_minutes: int
) -> list[str]:
    # returns list of user_ids flagged as suspicious
    ...
```

## Example

```
events = [
  ("u1", datetime(2024,1,1,10, 0), "1.1.1.1"),
  ("u1", datetime(2024,1,1,10,10), "2.2.2.2"),
  ("u1", datetime(2024,1,1,10,20), "3.3.3.3"),
  ("u1", datetime(2024,1,1,10,25), "4.4.4.4"),
  ("u2", datetime(2024,1,1,10, 0), "5.5.5.5"),
]
detect_suspicious_logins(events, max_ips=3, window_minutes=30)
# u1 has 4 distinct IPs in 25 minutes -> flagged
# u2 has 1 IP -> not flagged
# -> ["u1"]
```

## Follow-ups

1. How do you efficiently maintain the rolling window as new events arrive?
2. How would you handle events that arrive out of order by timestamp?
3. What additional signals (e.g., geolocation jumps, failed login ratio) would strengthen the detection?
4. How would you store and query these events in a database for historical analysis?

User Logins: Detect Suspicious Login Patterns Across Sessions

Question Details

Full Details

Topics

More from MongoDB