US Patent 10362016 Dynamic knowledge-based authentication

A computer-implemented method includes receiving user data from a plurality of data sources, where the user data describes a user. A plurality of events are determined within the user data by applying anomaly detection to the user data. A request to authenticate the user is received. A key event is selected from among the plurality of events, responsive to the request to authenticate the user. For the user, a challenge is generated, by a computer processor, based on the key event and responsive to the request to authenticate the user. A response to the challenge is received. It is decided whether to authenticate the user based on the response to the challenge.