Behavioral Biometrics: Keystroke Dynamics and Touch Dynamics Combined With Mouse Movement Analysis

Keystroke dynamics

Everyone types on a keyboard in their own way: some drum on the keys rapidly, some make characteristic pauses between certain letters, and some keep their fingers on individual keys longer. These individual features of typing rhythm and pace form a unique biometric profile that is practically impossible to fake — even knowing the password, an attacker will not be able to reproduce its owner’s typing manner.

Keystroke dynamics is a behavioral biometrics method based on analyzing the timing characteristics of a user’s interaction with the keyboard. The technology records exactly when each key was pressed and released, and then converts this data into a mathematical model describing an individual typing style.

Research shows that modern neural network-based algorithms achieve identification accuracy of up to 99.95% on benchmark datasets with an equal error rate (EER) of about 0.65%.

The main advantage of this method is that it requires no specialized hardware. An ordinary keyboard is sufficient for data collection, and the analysis is performed in software. This makes the technology economically accessible and easy to integrate into existing security systems: from corporate portals to online banking and distance learning.

Timing Parameters of Keystrokes

Keystroke dynamics is based on two basic timing indicators. The first is dwell time: the interval between the moment a key is pressed and its release. This parameter reflects the force and duration of the finger’s contact with the key, which vary from person to person depending on motor skills, habits, and even the anatomical features of the hands. The second indicator is flight time: the interval from releasing one key to pressing the next. It characterizes the speed of finger movement across the keyboard and the coordination of movements.

More complex features are formed on the basis of these basic metrics. Digraphs are the timing characteristics of pairs of consecutive keys — for example, the combinations “th” or “er” in English. Trigraphs cover three keys in a row, and n-graphs arbitrary sequences of any length. Research shows that common letter combinations such as “ing” are typed much faster than the same letters in reverse order, and the degree of this difference is individual for each user.

The system also records latency — the delay between consecutive keystrokes, overall typing speed, the frequency of using the Backspace and Shift keys, and typical errors: character substitutions, omissions, accidental presses of neighboring keys. Paradoxically, it is errors and their patterns that serve as a powerful discriminating factor: a person makes characteristic typos with stable regularity.

Timing measurements are recorded with millisecond resolution. To build a reliable user profile, the system usually needs from several hundred to several thousand keystrokes. At the same time, the algorithms take natural variability into account: typing rhythm can change depending on fatigue, time of day, or keyboard type. Modern machine learning methods — from support vector machines (SVM) to recurrent neural networks (RNN) and Siamese networks — make it possible to identify stable individual patterns even in the presence of these fluctuations.

Static and Free-Text Authentication

Keystroke dynamics systems fall into two fundamentally different approaches, depending on what text is analyzed: fixed or arbitrary.

Many systems combine both approaches: a static check at login and continuous monitoring during the session. This two-level model provides a balance between usability and depth of protection, making it possible to detect both password-guessing attempts and unauthorized access to an already open session.

Mouse Movement Analysis

Everyone controls a computer mouse in their own way. Some move the cursor in smooth arcs, others in sharp jerks. Some users pause before clicking, others press the button instantly. These individual features form a unique “handwriting” of interaction with the pointer that is practically impossible to fake.

Mouse movement analysis (mouse dynamics) is a behavioral biometrics method based on recognizing characteristic patterns of working with the pointer. The system records the cursor coordinates, the timestamps of each event, and button actions, and then extracts from this data a set of features that make it possible to distinguish one user from another. According to an ACM Computing Surveys review (2024), research in this area has been conducted since the late 19th century, but practical application became possible only with the development of machine learning.

The key advantage of the method is that it is completely unnoticeable to the user. Data is collected passively, in the background, without any additional actions on the person’s part. No special hardware is required: a standard mouse or touchpad is enough.

Kinematic Characteristics of Cursor Movements

To build a biometric profile, the system analyzes several groups of parameters.

The first group is speed characteristics. These include the instantaneous speed of the cursor along the horizontal and vertical axes, the overall speed of movement across the screen, and angular velocity — an indicator of how quickly the direction of movement changes. Research shows that most users prefer low speed and predominantly straight-line trajectories.

The second group is dynamic parameters. Acceleration records the change in speed per unit of time. Jerk — the derivative of acceleration — reflects the abruptness or smoothness of mouse control. These indicators are especially informative: human hand movement is characterized by initial acceleration and final deceleration as it approaches the target, whereas software bots show either constant speed or atypical patterns.

The third group is geometric features. The curvature of the trajectory shows the degree to which the cursor’s path deviates from a straight line. The angle between successive movement segments, the distance from the start point to the end point, and the number of critical points (places where the direction changes sharply) complete the picture of an individual style. According to research by Zheng, Paloski, and Wang, angular metrics are robust to differences in hardware settings and pointer speed, which makes them especially valuable for identification.

The fourth group is click characteristics. The rhythm and frequency of clicks, the duration of holding the button, and the time between pressing and releasing — all this forms an additional layer of unique features. Some systems also take into account pauses before a click and the distance at which the user releases the button after hovering over the target.

From the raw data, the algorithms extract statistical indicators: the mean, standard deviation, minimum, maximum, and variance for each parameter. According to a study published in the journal Applied Sciences (2021), the total number of extracted features can exceed 80. At the same time, modern neural network architectures — convolutional networks (CNN), long short-term memory recurrent networks (LSTM), and transformers — are able to identify significant patterns in time series on their own, bypassing the stage of manual feature engineering.

Continuous User Verification

Unlike classic authentication, which happens once at login, continuous verification works throughout the entire session. The system constantly compares current behavior with the reference profile and, if significant deviations are detected, may request additional identity confirmation or block access.

The accuracy of modern solutions reaches high levels. According to IEEE (2024), deep learning-based systems show an equal error rate (EER) of 0.2–3% when using long sequences of actions. One-dimensional convolutional networks show authentication accuracy of about 86% for top users, and multiclass neural network classifiers reach 92%. When combined with keystroke dynamics, accuracy increases to 98%.

An important parameter is the time to detect an attacker. According to recent research by Russian cybersecurity specialists, a few seconds are enough to detect a bot, whereas identifying a human intruder requires about 8 minutes of analysis. This is because automated scripts generate fundamentally different patterns: movements at constant speed, perfectly straight trajectories, and no micro-corrections. Human motor skills, on the contrary, always contain an element of variability.

The practical implementation of continuous verification requires a balance between reaction speed and accuracy. Short analysis intervals increase the risk of false positives; long ones give the attacker time to act. Modern systems solve this problem through adaptive thresholds: when behavior is suspicious, the check interval is shortened and the requirements for matching the profile are tightened.

Continuous verification based on mouse movements naturally complements traditional protection mechanisms. Even if an attacker obtains the password and bypasses two-factor authentication, their behavioral pattern is highly likely to give away the substitution. The technology is already used in the financial sector, online education (to monitor exam integrity), and corporate security systems.

Touch dynamics

Mobile devices with touchscreens record dozens of parameters with each touch by the user. Touch dynamics is a field of behavioral biometrics that turns this data into a unique digital fingerprint of the owner. Unlike static methods such as a PIN code or a pattern lock, analyzing touch dynamics makes it possible to verify identity continuously, in the background, without requiring any additional actions from the person.

The principle of operation is based on the fact that the manner of interacting with the screen is individual: one user makes sharp, short taps, another smooth and extended ones. Some swipe with great pressure, others barely touch the surface. These patterns are formed over years and are difficult to imitate — an attacker may learn the victim’s password, but reproducing their motor skills is practically impossible.

Modern smartphones are equipped with sensors capable of registering the touch coordinates, contact area, pressing force, finger tilt angle, and movement speed. This raw data is processed by machine learning algorithms that build a behavioral profile and compare current actions with the reference. If significant deviations are detected, the system may request additional authentication or block access.

Touch and Gesture Parameters on Touchscreens

Biometric analysis of touch dynamics relies on three categories of features: temporal, spatial, and kinematic.

Temporal parameters measure the duration of interaction with the screen. Dwell time is the interval between the moment of touch and lifting the finger from the surface during a tap. Flight time is the pause between the end of one touch and the start of the next. Input time covers the full input cycle, for example the time to enter a PIN code from the first to the last digit. Research shows that the spread of dwell time between users reaches 200–300 ms for similar tasks, which gives the feature high discriminating power.

Spatial features describe the geometry of a touch. Touch area depends on the finger’s anatomy, the angle of touch, and the habitual pressing force. Finger pressure is registered by force sensors or calculated indirectly via the contact area on capacitive screens. The coordinates of the touch point (X, Y) record exactly where the user presses — for example, when entering digits on a virtual keyboard, some people hit the exact center of the button, while others systematically shift toward the edges.

Kinematic characteristics describe the movement of the finger across the screen. For swipes and scroll gestures, velocity, acceleration, trajectory, and line curvature are analyzed. For multi-touch gestures such as pinch-to-zoom, the distance between fingers, the synchronization of movements, and the rotation angle are additionally taken into account. Horizontal and vertical swipes by the same user show stable patterns: a characteristic acceleration at the start, a plateau in the middle, and deceleration toward the end of the gesture.

To increase accuracy, systems combine primary features with derived ones. From a series of dwell time measurements, the mean, median, standard deviation, and coefficient of variation are extracted. This makes it possible to separate stable individual traits from random fluctuations. According to ACM Computing Surveys, a typical feature set for touch authentication includes from 20 to 150 variables, depending on the complexity of the model and the type of gestures analyzed.

Authentication Models on Mobile Devices

The task of authentication by touch dynamics comes down to binary classification: determining whether the current interaction pattern belongs to the legitimate owner of the device or to an outsider. Two approaches are used for this: static verification at login and continuous authentication throughout the session.

The algorithmic basis consists of machine learning methods. The most common are Support Vector Machine (SVM), Random Forest, k-Nearest Neighbors, and neural networks of various architectures. According to a study in Scientific Reports (2023), a one-class SVM achieves an accuracy of 98.9% and an F1-score of 99.4% when authenticating by a combination of touch events and motion sensor data. Deep neural networks, in particular LSTM and convolutional architectures, show an EER (Equal Error Rate) of 1.4% to 3.6% on standard datasets.

The effectiveness of a model depends on the volume and quality of the training sample. To form a stable profile, 5 to 30 sessions of the user’s interaction with the device are required. The context of use is also important: the behavioral pattern varies depending on posture (sitting, standing, moving), hand (left, right, both), device type, and even emotional state. Modern systems take these factors into account, adapting the model to specific conditions and gradually retraining on new data.

A separate problem is the balance between security and convenience. An overly strict threshold leads to frequent false rejections (False Rejection Rate) that irritate legitimate users. An understated threshold increases the probability of letting an attacker through (False Acceptance Rate). The optimal setting depends on how critical the protected data is: for mobile banking, a higher FRR is acceptable in order to minimize FAR, whereas for social apps the priority shifts toward a seamless user experience.

Multimodal systems combine touch dynamics with other behavioral and physiological features: accelerometer and gyroscope data, app usage patterns, and facial biometrics. Such a combination compensates for the weaknesses of individual modalities and increases resistance to attacks. Research shows that merging touch features with motion sensor data reduces EER to 0.007% under controlled conditions, bringing accuracy close to the level of physiological biometrics while retaining the advantages of passive data collection.