To detect unauthorized access using outlier detection
This question is quite broad. I'll try to set you on the right path, more so than providing a truly complete answer.



Theoretical background

As others have mentioned, the task you're trying to do is usually known as anomaly detection, also known as novelty detection.

There's many possible ways to approach this kind of task, depending on the assumptions you are willing to make about your data. 



Before we start exploring alternatives, it's important to mention here that all your variables  are categorical (country, service_key, system, app_type). This is important, since usually algorithms usually handle either continuous variables or discrete variables, and categorical ones fall into the latter type.

There's some tricks you can do, however, to handle them interchangeably. One-hot encoding is simple and popular, and enables you to transform a categorical variable into N binary variables. For some classes of algorithms, you can then use these binary variables as if they were continuous. You can even mix binary and truly continuous variables.



Now, there's usually two families of methods to approach this sort of problem: parametric vs non-parametric. 

Parametric methods require that you do assumptions on the underlying probability distributions of your data. You can then estimate these parameters using your data.

Non-parametric methods, on the other hand, are simpler to use, as they don't require assuming a underlying distribution. They might also be less powerful / exact, especially if you don't have a lot of data and your data very closely follows a known probability distribution.



Practical advise

If you're willing to do some statistical work, look into bayesian inference.

For a easier non-parametric method, look into into One-Class SVM. Here is a code example using python and scikit-learn and more practical information on anomaly detection

But, honestly, you're giving us a important clue here:


  Here to be note is that logins can have different country and system
  but it cannot have different username, service_key and app_type.


If you already know all this, you might want to completely skip the complicated parts. Just compare those values directly, summarize them into a distance measure (you can give different weights to service_key and app_type, for example) and see if that's good enough