Continuous User Authentication Using Behavioral Biometrics

With the increasing use of computer systems, secure user authentication has become a critical component of cybersecurity. Traditional authentication methods, such as passwords and PINs, verify user identity primarily at login and may fail to detect unauthorized access during an active session. This study proposes a privacy-preserving continuous behavioral authentication framework that monitors keyboard and mouse dynamics throughout a user session. Behavioral features, including typing speed, key dwell time, flight time, mouse velocity, acceleration, click intervals and scrolling patterns, are extracted without recording typed content or passwords. The extracted features are segmented into 30-second time windows and fused to construct multimodal behavioral representations. The framework employs one-class anomaly detection trained exclusively on legitimate-user data, using Isolation Forest, One-Class Support Vector Machine (OC-SVM) and an autoencoder. The resulting anomaly scores are mapped to risk levels to support session continuation, step-up re-authentication, or access restriction. Furthermore, an adaptive profiling mechanism updates user profiles using only high-confidence normal behavior to accommodate behavioral drift while minimizing the risk of profile contamination. The framework is evaluated using False Acceptance Rate (FAR), False Rejection Rate (FRR), Equal Error Rate (EER), Receiver Operating Characteristic Area Under the Curve (ROC-AUC) and Precision–Recall Area Under the Curve (PR-AUC). The proposed approach aims to improve continuous authentication by integrating multimodal behavioral analysis, impostor-independent training, adaptive profiling and privacy-aware access control.