I want to detect whether or not an account sign in is suspicious, like Google is doing it. How can I achieve that, or what resources should I look at?
Scenario: My login credentials are stolen at yet another Yahoo breach, and a hacker is using those to sign into a service. I want to detect that this user is not the real user, for example, by using the location of the sign in ip address.