What is behavioral biometrics?

Fraudsters and cybercriminals increasingly target legitimate users by using malware, phishing and social engineering scams to capture credentials and take over their accounts for malicious ends. According to the IBM® Cost of a Data Breach Report, stolen or compromised credentials account for 10% of data breaches.

Behavioral biometric authentication methods can add an extra layer of security to identity security and fraud detection systems beyond traditional authentication measures, such as passwords or security keys.

Hackers can steal passwords and USB keys to gain control of a user’s account. However, to get past a behavioral biometric system, they must impersonate a user’s behavior—making it much harder to hide suspicious activity.

The key distinction between behavioral biometrics and physical biometrics is that behavioral biometric factors are active, monitoring a user’s actions. Physical biometric factors are passive, based on physical characteristics that do not change, such as a fingerprint.

Common physical biometric factors include facial features, retina structures, vein patterns fingerprints or the patterns in a person's voice. Common behavioral biometric factors include keystrokes, mouse movements and device location.

Behavioral biometrics are usually monitored continuously during a user’s session to detect any deviations from normal behavior in real time, such as a person’s typing speed suddenly changing. Physical biometrics are generally only checked once at the start of a session. 

Behavioral biometric technology uses unique patterns in a person’s activity to identify that individual. Analyzed activities can include mouse movement, keystroke velocity or mobile phone positioning, among other factors.

Common behavioral biometric authentication factors include:

Behavioral biometrics tools use artificial intelligence (AI) and machine learning (ML) algorithms to analyze user behavior patterns and build models of a user’s typical behavior. The user’s subsequent behavior can be compared to the model for authentication. If a user behaves as normal, the system knows it is them. If the system detects strange deviations from the baseline, it can flag the suspicious activity and block user authentication. 

The first step in implementing behavioral biometrics is to collect data to build user behavior profiles—that is, a picture of normal behavior for each user.

Behavioral biometric data is often gathered passively as a user interacts with an app, website or database. Behavioral authentication tools often require several samples of user activity to generate an accurate baseline and reduce false positives. For example, IBM's Verify identity and access management (IAM) solution requires at least eight sessions to gather data.

Behavioral biometric solutions use advanced AI and ML technologies, such as deep learning and convolutional neural networks (ConvNets or CNNs), to process the collected data and build a model.  

Most behavioral biometrics systems continue to collect user behavior data during every subsequent session. This data is used to further refine the baseline model, making it more accurate over time.

When a user logs in to a system or requests access to a new resource, their behavioral patterns are compared to the model. Is the user logging in from an expected IP address? Do their keystroke dynamics match the user's typical patterns?

User behaviors are scored based on how anomalous or unusual they are. Requests can be automatically granted, flagged or blocked based on score thresholds set in the security system.

Identity verification is usually not based on behavioral biometrics alone. Rather, behavioral biometric factors are commonly used as part of an adaptive authentication system, which changes authentication requirements based on security context. For example, if a user logs in from their normal IP address—a behavioral biometric—they might need to enter only a password. But if they log in from an unexpected address, they might need to enter a password and a fingerprint scan.

Behavioral biometrics is also used in continuous authentication and monitoring tools, such as user behavior analytics (UBA) systems. These track user activity patterns at all times, even beyond logins and access requests. If a user deviates from the norm at any time during a session, a UBA can alert the security team.

For both organizations and individuals, behavioral biometric authentication can function in several useful ways.

Behavioral biometrics can help facilitate on-premises and remote access to sensitive resources for legitimate digital identities while combating cyberattacks where hackers attempt to steal or mimic a user’s identity.

Biometric authentication measures can also be used to protect sensitive physical locations. Government agencies might use a scanner to verify that a person’s walking gait matches the walk of the verified individual on file. This behavioral authentication method is being tested by the European Union, which is using gait recognition to monitor border crossings.

Biometric factors can be used with other authentication factors to provide extra cybersecurity and convenience in multifactor authentication (MFA) implementations, which ask users for two or more factors to prove their identities.

For example, an MFA system might ask users for a password while treating keystroke dynamics as a second factor. By requesting two means of identification—one of which cannot easily be stolen—MFA makes it harder for attackers to hijack a person’s identity. And because the second factor is based on automatic analysis, the user doesn’t have to do anything aside from enter a password. 

Behavioral biometrics can help speed up and secure financial services transactions, streamlining the user experience. For example, if a person normally makes a payment by using their smartphone, behavioral biometrics can automatically determine whether they’re using the same phone as they normally do—and whether they’re using it consistently with their behavior on file.

Behavioral biometrics can help financial institutions, e-commerce retailers and other organizations, strengthen data security measures and detect and prevent fraudulent activity.

For example, behavioral biometrics can help prevent fraudulent account openings and account takeover fraud by comparing the fraudster’s activity to that of the user they are pretending to be. These protections are more important than ever as AI tools make it easier for hackers to seize control over user’s accounts. According to Gartner, AI agents will reduce the time it takes to exploit account exposures by 50%.

Behavioral biometrics can also help detect mule accounts that are used to hide and move money for illegal purposes. Behavioral biometric systems can identify the ways in which these accounts don’t act like regular users, flagging them for investigation.

It is easier to steal a password or ID card than it is to flawlessly imitate how a person uses a keyboard or walks. And even if a fraudster gets through the initial login, they must keep up the act during the entire session. Any deviation from the norm can alert the security team. 

Because biometric authentication relies on human behavior, it is nonintrusive and requires no additional effort on the user’s part. This helps deliver frictionless employee and customer experiences.