Continuous Authentication for Business Platforms Using HMMs on Mouse Movement Patterns

Password-based and MFA session authentication verifies identity once, at login, leaving the remainder of a session vulnerable to session hijacking, credential sharing, and insider threat once the initial checkpoint has been passed. Continuous behavioural authentication addresses this by silently verifying the logged-in user throughout a session, using device interaction patterns that are both user-specific and difficult to consciously control. Mouse movement patterns-velocity, acceleration, curvature, angular deviation, click timing, and task-mode signature (navigation, reading, precision clicking, scrolling)-are particularly attractive for this purpose in enterprise business-platform contexts, where mouse-driven interaction is pervasive, continuous, and available without additional hardware or user action. Hidden Markov Models, whose latent state structure is a natural fit for the sequential, mode-switching nature of mouse behaviour across a session, offer a generative framework that captures within-user consistency across task contexts as well as between-user discriminability. This paper applies a four-state HMM (Active Navigation, Reading/Idle, Precision Clicking, Scrolling) to 15,120 monitored sessions from 840 business-platform users (840 × 18 sessions each), extracting 72 features per 30-second analysis window across 12-minute mean session lengths, benchmarking against a keystroke-dynamics static biometric baseline, a Naïve Bayes mouse-movement classifier, and an SVM mouse-movement classifier. The HMM achieves an Equal Error Rate of 3.1% (FAR 2.4%, FRR 3.8%), outperforming the SVM (EER 7.6%; 59.2% relative reduction), the keystroke baseline (EER 10.4%; 70.2%), and Naïve Bayes (EER 15.6%; 80.1%), and detects simulated impostor sessions in a mean of 84 seconds (11.7% of a typical 720-second session). Deployed across an 18,400-session business-platform evaluation cohort, the system flagged 1,284 sessions (7.0%) for elevated anomaly score, of which 912 (71.0%) were confirmed upon review as genuine threats (credential sharing, session hijacking, or insider-activity anomalies), with 372 false-interruption events (2.0% of total sessions). User acceptance across a post-deployment survey of 840 enrolled users was 84.8% (712 of 840). Physical fatigue and acute stress substantially degrade EER from 3.1% to 7.8% (+151.6%), touchpad/trackpad interaction increases EER to 6.4% (+106.5%), users with fine-motor difficulties show EER of 9.2% (+196.8%), and sophisticated mimicry attacks reduce the FAR advantage but not eliminate it (observed FAR 4.8% under expert mimicry vs. 2.4% baseline), each bounding the system's deployment alongside rather than as a replacement for conventional authentication factors.

Hali tarjima qilinmagan