Client-Side Continuous Authentication Using Keystroke Dynamics: A Lightweight Pipeline and Cross-Session Evaluation

Post-login threats such as device sharing and session takeover motivate continuous authentication with behavioral signals. This paper studies a lightweight keystroke-dynamics pipeline designed for strict cross-session evaluation and browser-side scoring. Using the fixed-text and free-text tracks of the public KeyRecs dataset, we extract compact repetition-level and sliding-window digraph-timing features and train per-user one-vs-rest Logistic Regression verifiers on Session 1 (S1). Thresholds are selected only on S1 and transferred unchanged to Session 2 (S2), preventing test-set tuning and exposing operating-point instability under session drift. Fixed-text achieves S2 AUC mean/median 0.895/0.918 with a half total error rate (HTER) around 0.19, while free-text reaches AUC mean/median 0.884/0.899 with a similar transferred-threshold HTER. Personal thresholds and a pooled-S1 global threshold perform similarly on average, suggesting that global thresholding can simplify deployment without replacing per-user scoring models. A scaler-only warm-up update yields limited and inconsistent gains, showing that mean/variance adaptation alone is insufficient. Finally, compact JSON artifacts and replay-based browser benchmarks demonstrate deterministic client-side scoring with very small per-sample latency. Overall, the results show that useful threshold-free separability does not by itself guarantee stable operating-point transfer under cross-session drift.