Authentication systems often rely on static rules, external reputation services, or heavy models to detect suspicious logins. I wanted to explore whether a much smaller, self-hostable component could provide useful risk signals directly inside the login flow.
This experiment focuses on designing a lightweight behavioral risk scoring module that can run inline with authentication requests while staying extremely fast and infrastructure-friendly.
Key ideas behind the implementation:
<ul>
<li>combine simple behavioral rules with a very small ML model</li>
<li>keep the model tiny (~2k parameters) so it remains CPU-friendly</li>
<li>target sub-millisecond inference to avoid adding latency to auth flows</li>
<li>make deployment trivial so it can run in self-hosted panels, gateways, or internal tools</li>
</ul>
The goal wasn’t to build a sophisticated ML system, but to see how far practical engineering constraints — latency, deployability, and simplicity — can be pushed while still producing meaningful risk signals.
I’d be very interested in feedback from people running their own infrastructure:
Do you see value in inline risk scoring like this, or do you prefer external security layers?
Repo: <a href="https://github.com/onuion/onuion" target="_blank" rel="noopener nofollow">https://github.com/onuion/onuion</a>

🚀 Daily Open Source Tools Squad delivers daily articles, open-source projects, and technical resources for Developers & DevOps pros. Stay updated with the latest trends & insights!

📬 Join our mailing list! → theinfinity.dev

Daily Open Source Tools

A lightweight, self-hostable risk scoring component designed to detect suspicious logins inline during authentication flows. The system combines simple behavioral rules with a tiny ML model (~2k parameters) to achieve sub-millisecond inference times while remaining CPU-friendly and easy to deploy. The design prioritizes practical engineering constraints like latency, deployability, and simplicity over sophisticated ML approaches, making it suitable for self-hosted panels, gateways, and internal tools.

Designing a sub-millisecond, self-hostable risk scoring component for login flows