Journal of Modern Technology and Engineering

Continuous authentication is an approach to endpoint security that enhances standard authentication methods. Traditional methods lose effectiveness after the session begins, as they do not monitor who continues to use the system. This work proposes a continuous authentication system based on modeling user behavioral profiles using multimodal telemetry data: mouse dynamics, keystroke dynamics, and application and graphical user interface usage statistics. The system models user behavior by analyzing data from these modalities at one-minute intervals using a sliding window principle. Based on deep encoders, the system classifies user behavior by comparing it with profiles built during endpoint baseline establishment. Experiments were conducted using data collected from participants who performed a chosen task for one hour. All user interactions were recorded based on the features proposed in this work. The results show that the proposed model successfully handles the task of classifying and identifying authenticated users and impostors with an overall accuracy of over 0.80, an average false acceptance rate of 0.24 and an average false rejection rate of 0.08.