Generative AI for Event ID 4625 Simulation: Training ML Models

Eng. Donya Bino

Eng. Donya Bino Published September 03, 2026 · 12 min read

Updated on September 03, 2026

You are building a machine learning model to detect failed logon attempts. You need thousands of Event ID 4625 samples. But you only have a few hundred in your logs. What do you do?

This is the problem every security team faces when training ML models. There is never enough data. And the data you have is often too similar. Your model learns to detect your specific environment, not the wide range of attacks it will face in the real world.

Generative AI solves this problem. You can generate synthetic Event ID 4625 patterns that look exactly like real failed logons. Different users, different IPs, different timestamps, different failure reasons. Thousands of variations in minutes.

Here is how to do it.

Important Disclaimer

This article is intended for educational and defensive purposes only. The techniques described here are shared to help security professionals understand emerging threats so they can better protect their systems.

Do not use these techniques against systems you do not own or do not have explicit written permission to test. Unauthorized testing is illegal in most jurisdictions.

The author assumes no liability for any damages, legal consequences, or other outcomes resulting from the use or misuse of this information. Never conduct security testing without first getting the right permissions. Stay legal. Stay ethical. Stay responsible.

Why Event ID 4625 Is Important

Event ID 4625 is the security log event of Windows for failed logon attempts. Each time there is a failed logon attempt, this event is created.It is one of the most important events for security monitoring.

The event tells you:

The account name that was used
The source IP address
The workstation name
The failure reason code
The timestamp

This event is your first line of defense against brute force attacks, credential stuffing, and compromised accounts. But to detect these attacks, you need to understand what normal looks like. And that requires data.

The Data Problem

Here is the challenge. To train an ML model to detect abnormal failed logon patterns, you need thousands of Event ID 4625 samples. But the real ones in your logs have problems.

They are limited. You only have as many as your users actually generate. For most organizations, that is not enough for robust ML training.
They are biased. Your data is unique to your own environment. A system trained on your data will not work on another network.
They are imbalanced. You have far more successful logons than failed ones. Your model learns to ignore failures.
They lack variety. All your failed logons happen under similar conditions. The model does not learn to handle edge cases.

Generative AI solves all of these problems.

How Generative AI Helps

Generative AI creates synthetic data that looks real. It learns the patterns of your existing Event ID 4625 logs and generates new, realistic variations.

Here is what you can generate:

Different usernames (including common and rare ones)
Different source IPs (from different geographies)
Different timestamps (day, night, weekends, holidays)
Different failure reasons (bad password, account locked, wrong domain)
Different workstation names
Different logon types (network, interactive, remote desktop)

You can control the volume. Need 10,000 samples? No problem. Generate them in minutes.

You can control the distribution. Want more failed logons from unusual IPs? Generate them. Want more failures at night? Generate them.

There can be exceptions too. Need an example of failure occurring exactly at midnight? It can be made up.

Example in Practice: Generation of Event ID 4625 with Python

Below is an example of creating Event ID 4625 using generative AI.

import openai
import json
import random
from datetime import datetime, timedelta

# Set up OpenAI API key
openai.api_key = "YOUR_API_KEY_HERE"

def generate_event_4625():
    """
    Generate a realistic Event ID 4625 sample using AI
    """
    prompt = """
Generate a realistic Windows Event ID 4625 (failed logon) event.

Include:
- A realistic Windows username (common format like jdoe, smith.j)
- A realistic source IP address
- A realistic workstation name (like DESKTOP-ABC123 or LAPTOP-XYZ)
- A realistic failure reason (one of: bad password, account locked,
 wrong domain, expired password)
- A timestamp within the last 30 days

Format the output as a JSON object with these fields:
{
    "timestamp": "YYYY-MM-DD HH:MM:SS",
    "username": "username",
    "source_ip": "x.x.x.x",
    "workstation": "workstation_name",
    "failure_reason": "reason",
    "logon_type": "type"
}

Make it look like a real Windows event log entry. Be realistic.
"""
    
    response = openai.ChatCompletion.create(
        model="gpt-4",
        messages=[
            {"role": "system", "content": "You are a security log
 generator.
 Generate realistic Windows Event ID 4625 entries."},
            {"role": "user", "content": prompt}
        ],
        temperature=0.8,
        max_tokens=300
    )
    
    try:
        event = json.loads(response.choices[0].message.content)
        return event
    except:
        # Fallback if JSON parsing fails
        return {
            "timestamp": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
            "username": "unknown_user",
            "source_ip": "192.168.1.100",
            "workstation": "DESKTOP-FALLBACK",
            "failure_reason": "bad password",
            "logon_type": "3"
        }

# Generate 10 samples
samples = []
for i in range(10):
    event = generate_event_4625()
    samples.append(event)
    print(f"Generated sample {i+1}: {event['username']} from
 {event['source_ip']}")

# Save to file
with open("event_4625_samples.json", "w") as f:
    json.dump(samples, f, indent=2)

print(f"\nGenerated {len(samples)} samples saved
 to event_4625_samples.json")

Advanced Generation with Customization

You can customize the generation to create specific patterns you need.

def generate_event_4625_with_failure_reason(failure_reason):
    """
    Generate Event ID 4625 with a specific failure reason
    """
    prompt = f"""
Generate a realistic Windows Event ID 4625 
(failed logon) event.
The failure reason must be: {failure_reason}

Include:
- A realistic Windows username
- A realistic source IP address
- A realistic workstation name
- A timestamp within the last 30 days

Format as JSON.
"""
    
    response = openai.ChatCompletion.create(
        model="gpt-4",
        messages=[
            {"role": "system", "content": "You are 
a security log generator."},
            {"role": "user", "content": prompt}
        ],
        temperature=0.7,
        max_tokens=300
    )
    
    return json.loads(response.choices[0].message.content)

# Generate samples with different failure reasons
failure_reasons = ["bad password", "account locked", 
"wrong domain", "expired password", "unknown user"]

for reason in failure_reasons:
    event = generate_event_4625_with_failure_reason(reason)
    print(f"Generated event with reason: {reason}")
    print(f"  Username: {event['username']}")
    print(f"  Source IP: {event['source_ip']}")
    print(f"  Timestamp: {event['timestamp']}")
    print()

Generating Large Datasets

For ML training, you need thousands of samples. Below is a script for generating a large dataset.

def generate_dataset(num_samples, failure_distribution=None):
    """
    Generate a large dataset of Event ID 4625 samples
    
    Args:
        num_samples: Number of samples to generate
        failure_distribution: Dict of failure reason -> percentage
    """
    if failure_distribution is None:
        failure_distribution = {
            "bad password": 0.5,
            "account locked": 0.2,
            "wrong domain": 0.15,
            "expired password": 0.1,
            "unknown user": 0.05
        }
    
    events = []
    for i in range(num_samples):
        # Pick failure reason based on distribution
        reasons = list(failure_distribution.keys())
        weights = list(failure_distribution.values())
        failure_reason = random.choices(reasons, weights=weights)[0]
        
        event = generate_event_4625_with_failure_reason(failure_reason)
        events.append(event)
        
        if (i + 1) % 100 == 0:
            print(f"Generated {i+1} samples...")
    
    return events

# Generate 5000 samples
dataset = generate_dataset(5000)

# Save to file
with open("event_4625_dataset.json", "w") as f:
    json.dump(dataset, f, indent=2)

print(f"\nGenerated {len(dataset)} samples saved to
 event_4625_dataset.json")

Machine Learning Model Training with Synthetic Data

After generating the synthetic data set with Event ID 4625, the next step is training machine learning models with the generated data.

Step 1: Structure of Data

Convert your JSON events into the format that can be used for machine learning.

import pandas as pd
from datetime import datetime

def create_dataframe(events):
    """
    Convert events to a pandas DataFrame
    """
    df = pd.DataFrame(events)
    
    # Convert timestamp to datetime
    df['timestamp'] = pd.to_datetime(df['timestamp'])
    
    # Extract hour, day of week, and month
    df['hour'] = df['timestamp'].dt.hour
    df['day_of_week'] = df['timestamp'].dt.dayofweek
    df['month'] = df['timestamp'].dt.month
    
    # Create features for ML
    df['is_weekend'] = df['day_of_week'].isin([5, 6])
    df['is_night'] = df['hour'].between(22, 23) | df['hour'].
between(0, 6)
    
    # Encode failure reasons
    df['failure_code'] = df['failure_reason'].map({
        'bad password': 0,
        'account locked': 1,
        'wrong domain': 2,
        'expired password': 3,
        'unknown user': 4
    })
    
    return df

# Create DataFrame
df = create_dataframe(dataset)
print(df.head())

Step 2: Feature Selection

Choose features which can be helpful in identifying anomalies.

def add_features(df):
    """
    Add additional features for ML
    """
    # User-specific features
    user_counts = df.groupby('username')['failure_reason'].count()
    df['user_failure_count'] = df['username'].map(user_counts)
    
    # IP-specific features
    ip_counts = df.groupby('source_ip')['failure_reason'].count()
    df['ip_failure_count'] = df['source_ip'].map(ip_counts)
    
    # Count failures in the last hour (rolling window)
    df = df.sort_values('timestamp')
    df['failures_last_hour'] = df.rolling
('1h', on='timestamp')['username'].count()
    
    return df

# Add features
df = add_features(df)
print(df.head())

Step 3: Train an Anomaly Detection Model

Anomaly detection using Isolation Forest on the login process.

from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

# Select features for training
features = ['hour', 'day_of_week', 'failure_code', 'user_failure_count', 
            'ip_failure_count', 'failures_last_hour', 'is_weekend',
 'is_night']

# Prepare data
X = df[features].fillna(0)
scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)

# Train Isolation Forest
model = IsolationForest(
    contamination=0.05,  # Expected proportion of anomalies
    random_state=42
)
model.fit(X_scaled)

# Predict anomalies
df['anomaly'] = model.predict(X_scaled)
df['anomaly_label'] = df['anomaly'].map({1: 'normal', -1: 'anomaly'})

# View anomalies
anomalies = df[df['anomaly_label'] == 'anomaly']
print(f"Found {len(anomalies)} anomalies out of {len(df)} events")
print(anomalies[['timestamp', 'username', 'source_ip',
 'failure_reason', 'anomaly_label']].head())

Why Generative AI Is the Right Tool

Speed

You can generate thousands of samples in minutes. No more waiting for months of log accumulation.

Variety

You can control the distribution of failure reasons, times, and IPs. You can create any pattern you need.

Privacy

Synthetic data contains no real user information. No privacy concerns. No compliance issues.

Edge Cases

You can generate rare scenarios that would take years to see in real logs. Your model learns to handle everything.

Cost

Generating synthetic data is cheaper than collecting and storing real data. Less storage, less processing, less overhead.

How to Evaluate Synthetic Data Quality

Before using synthetic data for training, evaluate its quality.

Comparison of the Feature Distributions

Compare feature distributions between the synthesized and the actual datasets.

import matplotlib.pyplot as plt

# Assuming you have real data in df_real and 
synthetic data in df_synthetic

fig, axes = plt.subplots(1, 2, figsize=(12, 5))

# Compare hour distribution
df_real['hour'].hist(ax=axes[0], bins=24, alpha=0.5, label='Real')
df_synthetic['hour'].hist(ax=axes[0], bins=24, alpha=0.5, 
label='Synthetic')
axes[0].set_title('Hour Distribution Comparison')
axes[0].legend()

# Compare failure reason distribution
df_real['failure_reason'].value_counts().plot(kind='bar',
 ax=axes[1], alpha=0.5, label='Real')
df_synthetic['failure_reason'].value_counts().
plot(kind='bar', ax=axes[1], alpha=0.5, label='Synthetic')
axes[1].set_title('Failure Reason Distribution Comparison')
axes[1].legend()

plt.tight_layout()
plt.show()

Performance Comparison of Model

Train the same model using the real and synthesized dataset and compare performance.

from sklearn.metrics import classification_report

# Train on real data
model_real = IsolationForest(contamination=0.05,
 random_state=42)
model_real.fit(X_real_scaled)
y_pred_real = model_real.predict(X_test_scaled)

# Train on synthetic data
model_synthetic = IsolationForest(contamination=0.05, 
random_state=42)
model_synthetic.fit(X_synthetic_scaled)
y_pred_synthetic = model_synthetic.predict(X_test_scaled)

# Compare performance
print("Real data model:")
print(classification_report(y_test, y_pred_real))

print("\nSynthetic data model:")
print(classification_report(y_test, y_pred_synthetic))

Mistakes to Avoid

1. Generating Data without Validating

It is always crucial to validate your synthetic data with the data distributions. In case they don’t coincide, your model won’t generalize.

2. Lack of Edge Cases

The attackers make use of edge cases. Thus, your synthetic data should incorporate them. Unusual reasons for failure, odd timestamps, and uncommon IPs.

3. Overfitting to Patterns in Synthetic Data

In case you generate numerous similar examples, you model will overfit. To prevent that use temperature control and diversification.

4. Ignoring Time Dependencies

Logons happen over time. Your synthetic data should include time-based patterns. More failures on weekends. More failures at night.

5. Using Synthetic Data Alone

Synthetic data should supplement real data, not replace it. Real data captures patterns you might not think to generate.

Conclusion

The advent of Generative AI has proven to be revolutionary in building ML models for Event ID 4625. The technology allows generating thousands of realistic examples in just a few minutes. The distribution of failure reasons, timestamp, and IPs can be managed.

Moreover, the creation of edge cases becomes possible.

Here is your quick checklist:

Generate diverse Event ID 4625 samples with generative AI
Include all failure reasons in realistic proportions
Add time-based patterns (weekends, nights, holidays)
Validate your synthetic data against real logs
Train your model with a mix of real and synthetic data
Test your model on real logs to confirm performance

The attackers are using AI. You should use it too.

FAQ Section

What is Event ID 4625?

Event ID 4625 is the security log entry that records failed logon attempts in Windows. Such information includes crucial elements such as username, IP address, and reason for failure.

What makes the generated Event ID 4625 data important?

Actual Event ID 4625 data is rare, not representative, and not diverse enough. When using synthetic data, you will get thousands of diverse entries to train your ML model.

Is there any way to generate Event ID 4625 data without API key?

The examples shared here use OpenAI’s API. You can also use open-source language models such as Llama 2 and Falcon to generate data.

Are synthetic datasets equivalent to real datasets?

Synthetic data performs quite well in training ML models when checked against real data patterns. Synthetic data serves as an addition to real data.

How many data do I need for training the model?

Anomaly detection requires 5,000-10,000 data points to start with. More data points mean better performance of your model.

What features can be extracted from Event ID 4625?

Hour, day of week, reason for failure, number of user failures, number of IP failures, and rolling counts based on time.

Can I use this for other Windows events?

Yes. The same approach works for any Windows event. Adjust the prompt and fields for your target event ID.

IIs this method legal?

Yes, as long as it is being used in a defensive manner. The use of generated data in training machine learning algorithms is perfectly legal.

Keywords