Machine Learning-Driven Adaptive Multi-Factor Authentication Using Keystroke Biometrics for Continuous Identity Verification

This paper has outlined an integrated adaptive multi-factor authentication scheme that deals with the core vulnerability of static authentication; once a session starts, it stays open. Using continuous keystroke and other behaviour analysis during every user session, this authentication scheme constantly assesses the likelihood that the user using the system is the same person who logged in. If this probability dips to a certain level of adaptability, then a TOTP request is automatically triggered, without the user’s intervention. The design proves that behavioral biometric identification, statistical risk assessment, ML-based anomaly detection, bot-blocking CAPTCHA, and OTP via email can be combined to form a complete, usable authentication system through the use of free open source technology and basic web programming. The evaluation metrics – an overall accuracy of 93.1%, a false acceptance rate of 6.9%, and a false rejection rate of 6.0% for the full system – outperform the benchmarks available for single modality behavioral authentication systems, and the multi-model ML ensemble adds significant value. CAPTCHA implementation in the login gate was especially useful since it segregated the problem of bot attacks from that of identity theft by stopping the behaviour data generated by bots from mixing with the enrolment data. The use of the flexible threshold strategy, which allowed the threshold to be set loosely when the grace period kicked in, greatly minimized false positives early in sessions without sacrificing security. The move from STARTTLS port 587 to SMTP_SSL port 465 helped solve actual delivery problems found in institutional settings. The future development is expected to be centered on three key aspects. First, it is necessary to train individual models per each specific user on the basis of their personal behaviour to increase the precision rate while also demanding more user-specific information. Second, it is possible to implement a Bayesian update approach that updates the baseline of the behaviour model depending on successful logins and helps the software account for any changes in the typing patterns of the user. Third, it is recommended to explore touch and gyroscope sensor readings to cover mobile devices and receive new information concerning behaviour from another device-related source. All the aforementioned upgrades can contribute to building a powerful continuous authentication system resistant to both automation attacks and unauthorized human interference.

[1]   M. Verizon, "2024 Data Breach Investigations Report," Verizon Business, Basking Ridge, NJ, USA, Tech. Rep., 2024. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/ [2]   A. Acien, A. Morales, J. V. Monaco, R. Vera-Rodriguez, and J. Fierrez, "BeCAPTCHA-Mouse: Synthetic mouse trajectories and typing patterns to detect human behaviour and increase cybersecurity," Engineering Applications of Artificial Intelligence, vol. 113, pp. 104932, 2022. doi: 10.1016/j.engappai.2022.104932 [3]   P. Teh, A. Teoh, and S. Yue, "A survey of keystroke dynamics biometrics," The Scientific World Journal, vol. 2013, pp. 408280, 2013. doi: 10.1155/2013/408280. [Updated survey context: A. Alsaadi, "Behavioural biometrics survey: Keystroke dynamics," Journal of Physics: Conference Series, vol. 1664, no. 1, 2020.] [4]   F. Monrose and A. D. Rubin, "Keystroke dynamics as a biometric for authentication," Future Generation Computer Systems, vol. 16, no. 4, pp. 351–359, 2000. doi: 10.1016/S0167-739X(99)00059-X [5]   N. Zheng, A. Paloski, and H. Wang, "An efficient user verification system via mouse movements," ACM Transactions on Information and System Security, vol. 16, no. 4, pp. 1–27, 2014. doi: 10.1145/2584415 [6]   R. Kumar, V. Kundu, and S. Phoha, "Continuous authentication using mouse dynamics and keystroke patterns," IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 5, pp. 3344–3357, 2022. doi: 10.1109/TDSC.2021.3092282 [7]   F. T. Liu, K. M. Ting, and Z.-H. Zhou, "Isolation-based anomaly detection," ACM Transactions on Knowledge Discovery from Data, vol. 6, no. 1, pp. 1–39, 2012. doi: 10.1145/2133360.2133363. [Scikit-learn implementation context: F. Pedregosa et al., 'Scikit-learn: Machine learning in Python,' Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2023.] [8]   B. Schölkopf, J. C. Platt, J. Shawe-Taylor, A. J. Smola, and R. C. Williamson, "Estimating the support of a high-dimensional distribution," Neural Computation, vol. 13, no. 7, pp. 1443–1471, 2001. doi: 10.1162/089976601750264965 [9]   E. Bursztein, M. Martin, and J. C. Mitchell, "Text-based CAPTCHA strengths and weaknesses," in Proc. 18th ACM Conference on Computer and Communications Security (CCS), Chicago, IL, USA, 2011, pp. 125–138. doi: 10.1145/2046707.2046724 [10]   D. M'Raihi, S. Machani, M. Pei, and J. Rydell, "TOTP: Time-Based One-Time Password Algorithm," IETF RFC 6238, May 2011. [Online]. Available: https://tools.ietf.org/html/rfc6238