6. The method of claim 1 , the annotating comprising: evaluating the set of malicious account context properties to identify a user account context property pattern indicative of at least one of a compromised user account or a compromised user authentication event; and annotating the user account context property pattern as malicious to create a malicious user account context property pattern for inclusion within the annotated context property training set.
7. The method of claim 6 , the training comprising: generating a machine learning structure comprising a decision structure for the malicious user account context property pattern, the decision structure specifying that a user context property, corresponding to the malicious user account context property pattern, is indicative of a malicious user account event.