Deep Learning Based Behavioral Drift Modeling for Continuous Biometric Authentication

Suprava Saha Dibya; Minar; Abdulla Al Noman; Md. Zafir Abid Shresto; Ahmed Sayef

cs.CROct 29, 2026

Deep Learning Based Behavioral Drift Modeling for Continuous Biometric Authentication

Authors: Suprava Saha Dibya, Minar, Abdulla Al Noman, Md. Zafir Abid Shresto, Ahmed Sayef

Abstract

This research proposes a two-level keystroke dynamics authentication system that provides defense-in-depth security through continuous behavioral drift monitoring. Level 1 employs fixed-text password authentication using Temporal Convolutional Networks (TCN) with contrastive learning and population-based training (PBT), achieving 3.77% EER for high-security login verification. Upon successful authentication, Level 2 continuously monitors user typing during natural free-text sessions using a 4-Model Deep Learning Ensemble. If suspicious behavioral drift is detected during monitoring, the system re-authenticates the user by returning to Level 1, providing a feedback loop against session hijacking and behavioral anomalies. The system explicitly models long-term behavioral drift through the fixed-text component's PBT mechanism, which adapts to temporal variations in password typing patterns. This research leverages free-text (Buffalo dataset) and fixed-text (GREYC dataset) keystroke dynamics datasets, extracting temporal and spatial features including hold times, up-down latencies, down-down intervals, and trigram patterns. The final system achieves 96%+ accuracy for fixed-text authentication (3.77% EER) and 83.53% True Acceptance Rate (TAR) at 5% False Acceptance Rate (FAR) for free-text continuous authentication (10.05% EER), demonstrating superior performance and strong resistance to impostor attacks through continuous behavioral monitoring.

Figures & tables

Fig. 1: Two-Level Behavioral Authentication System

Layer	Type	Parameters	Output Dim.
Input	Feature Vector	–	231
Projection	$1\times 1$ Conv	14,848	64
TCN Block 1	Dilated Causal Conv	dilation=1, kernel=3	64
TCN Block 2	Dilated Causal Conv	dilation=2, kernel=3	64
TCN Block 3	Dilated Causal Conv	dilation=4, kernel=3	64
TCN Block 4	Dilated Causal Conv	dilation=8, kernel=3	64

TABLE I: Evo-BioTCN layer specifications

Feature Category	Count	Drift Resilience	Rationale
Rank Features	32	$\checkmark$ High	Ordinal positions invariant to speed scaling
Ratio Features	32	$\checkmark$ High	Proportions of total time resist global drift
Rhythm/Entropy	7	$\checkmark$ High	Timing variance patterns persist across sessions
Hand Balance	4	$\checkmark$ High	Left/right asymmetry reflects motor dominance
Statistical	44	Medium	Mean, std, CV capture within-session consistency
Normalized Timing	60	Medium	Session-relative z-scores

TABLE II: Feature categories organized by drift resilience

Fig. 3: Buffalo dataset [ 15 ] reconstruction pipeline

Feature Group	Description
Statistical Timing	Summary statistics of hold, flight, and latency times.
Positional	Timing variation across early, middle, and late word segments.
Rhythm	Entropy and variability-based measures of typing regularity.
Key Overlap	Metrics describing overlapping keystrokes and rollover behaviour.
Rank-Based	Ordinal timing patterns invariant to absolute typing speed.
N-gram Timing	Bigram and trigram timing statistics capturing key sequences.

TABLE III: Overview of the 85 engineered keystroke features organized by functional category

Component	Loss Function	Epochs	Learning Rate	Dropout
ArcFace + MS	ArcFace + Multi-Similarity	100	$3\times 10^{-4}$	0.20
Enhanced Embedding	Focal Triplet + Center	50	$3\times 10^{-4}$	0.30
Simple ArcFace	ArcFace ( $s=20,m=0.3$ )	100	$1\times 10^{-3}$	0.40
Fine-Tuned	Cross-Entropy (Fine-tune)	30	$5\times 10^{-5}$	0.30

TABLE IV: Training hyperparameters for ensemble components

Property	Value	Research Significance
Total Samples	7,560 typing sessions	Enables statistically meaningful evaluation
Participants	133 individuals	Represents diverse user population
Password	“greyc laboratory” (16 characters)	Fixed-text authentication scenario
Collection Period	110 days (March 17 – July 5, 2009)	Longest temporal span in keystroke literature
Sessions per User	Mean: 56.84, Range: varies by user	Variable user engagement patterns
Raw Timing Features	71 measurements	Hold (H), Up-Down (UD), Down-Down (DD), Release-Release (RR)

TABLE V: GREYC dataset [ 14 ] characteristics

Metric	Achieved	Target	Assessment
	Value
Equal Error Rate (EER)	3.77%	$<$ 5%	Exceeds Target
TAR @ FAR=5%	96.87%	$>$ 90%	Exceeds Target
Decidability Index ( $d^{\prime}$ )	3.49	$>$ 2.0	Exceeds Target
FRR @ FAR=5%	3.13%	$<$ 10%	Exceeds Target

TABLE VI: Final system performance metrics

Fig. 5: ROC curve for Evo-BioTCN showing excellent discrimination (AUC = 0.995).

Fig. 6: Score distribution showing minimal overlap between genuine and impostor scores.

Architecture	EER	EER	Improve-	d’ Post-	Statistical
	Pre-PBT	Post-PBT	ment	PBT	Significance
Transformer	8.26%	4.24%	$-4.02$ pp	3.21	Reference
TCN	8.09%	3.77%	$-4.32$ pp	3.49	$p=0.0023$ vs Transformer

TABLE VII: Post-PBT architecture comparison

Rank	Feature	Importance	Category	Password Position
1	weekday	0.0266	Temporal context	—
2	$\text{RR}_{2}$	0.0164	Flight time	2 ( $\text{r}\rightarrow\text{e}$ )
3	$\text{UD}_{2}$	0.0112	Flight time	2 ( $\text{r}\rightarrow\text{e}$ )
4	$\text{UD}_{5}$	0.0108	Flight time	5 ( $\text{c}\rightarrow\text{space}$ )
5	$\text{RR}_{11}$	0.0098	Flight time	11 ( $\text{a}\rightarrow\text{t}$ )
6	hour	0.0088	Temporal context	—

TABLE VIII: Top 10 most important features

Category	Count	Proportion	Key Finding
Flight times (UD, RR, DD)	18	60%	Most discriminative category
Hold times (H)	8	27%	Secondary importance
Temporal metadata	3	10%	Context significantly contributes
Derived features	1	3%	Limited incremental contribution

TABLE IX: Feature category distribution among top 30 features

Strategy	Best EER	GPU Hours	Relative Efficiency
Manual Tuning	4.38%	10	Low (Suboptimal)
Grid Search	4.21%	3,000	Very Low (High cost)
Random Search	4.12%	2,500	Low
PBT (Proposed)	3.77%	1,000	High (Best)

TABLE X: Comparison of optimization strategies

Fig. 7: Temporal stability analysis showing consistent baseline EER over 90 days.

Fig. 8: Enrolment sensitivity analysis showing diminishing returns beyond 10 sessions.

Fig. 9: Performance metrics under imbalanced vs balanced evaluation

Fig. 10: Confusion matrix at FAR=5% operating point

Metric	Imbalanced (131:1)	Balanced (1:1)	Difference
TAR (Recall)	88.26%	88.26%	0.00%
FRR	11.74%	11.74%	0.00%
FAR	4.99%	4.99%	0.00%
TRR (Specificity)	95.01%	95.01%	0.00%
Accuracy	98.24%	91.63%	$-6.61$ %
Precision	11.88%	94.64%	$+82.76$ %

TABLE XI: Class imbalance impact on metrics

Metric	Value	Interpretation
Equal Error Rate (EER)	10.05%	65% reduction vs. Baseline (28.77%)
AUC-ROC	0.9518	Excellent discrimination capability
D-prime ( $d^{\prime}$ )	2.45	Strong separation of score distributions
Global TAR @ FAR = 5%	83.53%	High usability for continuous monitoring
Global TRR @ FAR = 5%	95.00%	Very high true rejection rate for impostors
Global Balanced Accuracy	89.27%	Robust performance across genuine and impostor classes

TABLE XII: Global performance metrics summary

Pre-trained	Fixed-Text	Free-Text	Performance
Model	Performance	Transfer	Drop
Evo-BioTCN	$\geq$ 96% accuracy	32.75%	$-63$ pp
DATT (fixed-text)	$\sim$ 95% accuracy	33.06%	$-62$ pp
Individual DL Models	87.4% accuracy	10–15%	$-72$ to $-77$ pp

TABLE XIII: Transfer learning failure

Evaluation Protocol	Accuracy	Interpretation
Cross-Session (mixed training)	95.03%	Artificially inflated due to exposure to Session 2 during training
Session-Split (drift-aware)	86.41%	Authentic performance under temporal behavioral drift
Drift-Induced Degradation	8.62 pp	Real-world accuracy penalty caused by behavioral drift

TABLE XIV: Impact of evaluation protocol on reported accuracy

Architecture	Session-Split Accuracy	Complexity
DATT (Proposed)	53.25%	Medium ( $\sim$ 500K params)
Simplified MLP	41.82%	Low
Deep Individual Models	30–35%	High ( $\sim$ 1.5M params)
Random Forest	45.12%	Classical

TABLE XV: Architecture ablation revealing the Goldilocks Effect

Rank	Model	Category	TAR @ 5%	EER	AUC
			(%)	(%)
1	4-Model DL Ensemble	Deep Learning	83.53	10.05	0.9518
2	Enhanced Embedding	Deep Learning	82.31	12.50	0.9304
3	ArcFace + Multi-Similarity	Deep Learning	72.76	14.46	0.9146
4	Ultra-Deep Embedding	Deep Learning	67.72	15.77	0.9150
5	Random Forest	Machine Learning	65.00	20.00	0.8500

TABLE XVI: Comprehensive ablation study results across all 18 evaluated models

Fig. 11: Ablation study showing performance across 18 architectures.

Architecture	Parameters	TAR @ 5%	EER	Complexity
		FAR	(%)	Type
Ultra-Deep Embedding	$\sim$ 1.2M	67.72%	15.77	Concentrated
4-Model DL Ensemble	$\sim$ 3.2M	83.53%	10.05	Distributed
Improvement	+167%	+23%	36%

TABLE XVII: Architectural complexity comparison

Metric	Point Estimate	95% CI Lower	95% CI Upper
EER	10.05%	9.52%	10.61%
TAR @ FAR5%	83.53%	82.14%	84.89%
AUC-ROC	0.9518	0.9472	0.9561
Balanced Accuracy	89.27%	88.12%	90.38%

TABLE XVIII: Bootstrap CI for key performance metrics

Metric	Imbalanced (74:1)	Balanced (1:1)	Change
Rate-Based Metrics
TAR (Recall)	83.53%	83.53%	0.00%
FRR	16.47%	16.47%	0.00%
FAR	5.00%	5.00%	0.00%
TRR (Specificity)	95.00%	95.00%	0.00%
Count-Dependent Metrics

TABLE XIX: Imbalanced vs balanced classification metrics

Fig. 12: Imbalanced vs Balanced Metrics Comparison

Fig. 13: Imbalanced vs Balanced evaluation confusion matrix

Metric	Original	Stratified	Change
	Dataset	Balanced
Dataset Size	2,912,625	77,670	$-2,834,955$
Ratio	74:1	1:1	Balanced
TAR	83.53%	83.53%	Same
FAR	5.00%	5.00%	Same
Precision	18.42%	94.35%	$+75.93$ %

TABLE XX: Metrics of original vs balanced dataset

Metric	Level 1	Level 2	Synergy
	(Evo-BioTCN)	(4-Model Ens.)
Authentication Type	Explicit Login	Continuous Monitoring	Defense-in-Depth
EER	3.77%	10.05%	Sequential Filtering
TAR @ FAR=5%	96.87%	83.53%	Layered Confidence
Primary Error Mode	FRR (Usability)	FAR (Security)	Error Diversity
Temporal Resilience	PBT Adaptation	Score-Level Fusion	Multi-scale drift handling

TABLE XXI: Two-level keystroke authentication system performance summary

Biometric Identification

Biometric identification matches or verifies people and animals using distinctive physical, physiological, or behavioral signals.

See all 130 papers

Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis for Secure Data Sharing
Jun 20, 2026Stergios Lantzos, Ilias Syrigos, Apostolos Apostolaras +1Bidirectional Encoder Representations from Transformers Anomaly Detection
Dept. of Electrical and Computer Engineering, University of Thessaly, Greece
Transfer Learning of Keystroke Dynamics for Cross-Device User Authentication
Aug 17, 2026Nuwan Kaluarachchi, Sevvandi Kandanaarachchi, Kristen Moore +2Biometric Identification Cross-Domain Transfer Learning
RMIT University, Australia · CSIRO, Australia · Griffith University, Australia
Template Ageing and Longitudinal Verification in Fixed-Text Keystroke Dynamics: A Subject-Disjoint Study Across Eight Weeks
Sep 24, 2026Simon Parkinson, Saad Khan, Na Liu +1Biometric Identification
Department of Computer Science, University of Huddersfield, HD1 3DH Huddersfield, U.K. · College of Intelligence and Computing, Tianjin University, Tianjin, China

Jun 20, 2026J/K move · Enter open · S save

Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis for Secure Data Sharing

Stergios Lantzos, Ilias Syrigos, Apostolos Apostolaras, Thanasis Korakis

Dept. of Electrical and Computer Engineering, University of Thessaly, Greece

Bidirectional Encoder Representations from Transformers Anomaly Detection

Open paper AskPDF arXiv

Continuous authentication for mobile and zero-trust systems requires nonintrusive evidence confirming the enrolled user-device context remains valid after initial login. This paper presents a BERT log analysis framework for continuous behavioral authentication using Android system logs. The proposed pipeline parses logcat streams into event templates and dynamic variables, pre-trains a domain-adapted BERT encoder on Android log syntax, and fine-tunes three expert models for network/device identity, battery-transition timing, and Wi-Fi topology. The expert confidence scores are fused through a log-space transformation and a 5-nearest-neighbor distance classifier to generate a normality score that is provided to a Policy Decision Point (PDP) for risk-aware access control. Experiments on normal traces, controlled anomaly injections, and benign Wi-Fi perturbations indicate that multi-expert BERT log analysis can detect semantic, battery-timing, and topology deviations in the evaluated setting while maintaining sub-1% False Positive Rate (FPR). The results suggest that Android system logs are a practical sensor-free signal for continuous authentication and user-device context assurance.

Abstract

Biometric Identification

Explore similar work

Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis for Secure Data Sharing

Transfer Learning of Keystroke Dynamics for Cross-Device User Authentication

Template Ageing and Longitudinal Verification in Fixed-Text Keystroke Dynamics: A Subject-Disjoint Study Across Eight Weeks