A Human-Centric Hybrid Framework for Continuous Authentication via Keystroke Behavioral Biometrics Using ML and Deep Q-Networks

According to the IBM Cost of a Data Breach Report 2024, 19% of all data breach cases are attributed to compromised credentials, whereas insider attacks cost 4.90 million on average. In this research, a human-centered cybersecurity architecture is introduced that considers the person as the key element of design, where security conforms to the person's needs and requirements instead of placing additional constraints on them. Keystroke dynamics will be used as a behavioral biometric for continuous authentication and monitoring without interfering with users' activities. Specifically, SVM and RF classify multi-class users by applying supervised learning techniques, whereas DQN functions as a reinforcement learning algorithm for detecting anomalies. The human-centric aspect is addressed through three aspects: (i) privacy preservation, which ensures that only anonymized timing attributes are recorded, while no keystroke attribute is retained; (ii) usability, which guarantees that the system remains covert and does not interfere with the user's activities; and (iii) adaptability, which enables the DQN algorithm to learn from its experiences and adjust its reward policy to account for changes in behavior due to stress or fatigue. Experimentation conducted using the CMU DSL-StrongPassword dataset (with 51 participants and 20,400 password records) leads to an accuracy rate of 92.94% for the multi-class classification task (using the random forest classifier) and an F1 score of 0.9949 for anomaly detection (using the DQN method). These results demonstrate the viability of behavior-driven, human-centric authentication for enterprise-scale deployment.