A Hybrid Multi-Model Framework for Personalized User-Level Anomaly Detection With Data-Driven Threshold Optimization

Modern user authentication systems increasingly need user and device behavior aware adaptive mechanism to detect evolving threats beyond the traditional authentication framework of static credential verification. This paper proposes a hybrid multi-model framework for personalized user-level anomaly detection using a data-driven Hybrid Anomaly Score (HAS). Unlike static thresholding approaches, The proposed framework derives algorithm that integrates multiple anomaly detection methodologies to compute HAS through adaptive per-user thresholds (using cohort maturity and percentile-based optimization). The framework is evaluated on 72 million real-world data set. The framework demonstrate 96% precision, 92% recall, and an F1-score of 0.94, while maintaining inference latency within 2-3 ms per authentication event. The ablation analysis of the framework confirms the contribution of dynamic weighting and personalized threshold optimization to improved detection stability and convergence. The proposed framework outperforms existing approaches in both scalability and latency satisfying real-time operational constraint. The results indicate that data-driven adaptive thresholding combined with hybrid anomaly modeling provides an effective and deployable solution for large-scale authentication environments.