Risk-Aware Multimodal Authentication Using EEG-Based Identity Verification and Behavioral Biometrics

In environments where traditional methods such as passwords and unimodal biometrics are becoming increasingly susceptible to spoofing, replay attacks, and interference from environmental conditions, the necessity for a more reliable solution is essential. This paper proposes a new multimodal biometric framework that integrates physiological, behavioral, and risk-aware contextual signals to enhance security. The proposed framework presents an access control system that uses EEG-based authentication to recognize an individual’s identity and assess cognitive risk conditions using feature-based EEG analysis. If the detected risk state is found to be NOT_SAFE, the system conditionally escalates authentication by activating a secondary behavioral verification stage, and optionally triggers an additional biometric fallback. In order to further strengthen the user’s identity verification, keystroke dynamics are selectively employed with the EEG signals only under elevated risk conditions, acting as a behavioral biometric layer for enhanced authentication security. Direct access may be granted during SAFE conditions based solely on EEG-based identity verification, while escalation is enforced when instability is detected. This paper proposes an adaptive method that is not only more resistant to unauthorized access but also adds a contextual element to the access decision because it is based on a risk-aware, conditional escalation strategy that involves EEG-based identity authentication, feature driven EEG risk detection and behavioral typing patterns of the user, with fingerprint verification serving as a conceptual final fallback layer. Experimental evaluation demonstrates that the proposed system achieves high authentication accuracy i.e., 98.73% for keystroke and 96.70% for EEG-based identity verification, while maintaining strong detection of unstable cognitive states, achieving 88.71% accuracy and 96.55% recall for NOT_SAFE conditions. The EEG identity-authentication accuracy represents the unweighted mean of the per-user accuracies obtained via using the one-vs-all evaluation test, with a separate RBF-kernel SVM trained and examined for each target user using a 70:30 split method.