5. The method of claim 4 , the training comprising: generating a machine learning structure comprising a decision structure for the malicious authentication context property pattern, the decision structure specifying that a user context property, corresponding to the malicious authentication context property pattern, is indicative of a malicious user account event.
4. The method of claim 1 , the annotating comprising: identifying a first set of historical authentication data associated with malicious user authentication events; evaluating authentication context properties of the first set of historical authentication data to identify an authentication context property pattern indicative of malicious user authentication; and annotating the authentication context property pattern as malicious to create a malicious authentication context property pattern for inclusion within the annotated context properties training set.