AN ADAPTIVE RISK-BASED AUTHENTICATION FRAMEWORK USING BEHAVIORAL BIOMETRICS AND MACHINE LEARNING FOR CONTINUOUS USER VERIFICATION IN WEB APPLICATIONS

Abstract

Authentication remains one of the most important security requirements in modern web applications. Traditional authentication methods, such as passwords and one-time passwords, verify users only during login and provide limited protection against threats such as session hijacking, credential theft, automated bots, and account takeover after authentication. As cyber threats continue to evolve, there is a growing need for intelligent systems that can continuously verify user identity throughout an active session without disrupting the user experience. This study presents an adaptive risk-based authentication framework that combines behavioural biometrics with machine learning for continuous user verification. The framework captures users' behavioural patterns, including mouse movements, keyboard activity, scrolling behaviour, click frequency, idle time, and session characteristics. These features are converted into numerical data and analysed using a Random Forest model to classify user sessions as either legitimate or suspicious. The model's predictions are then incorporated into a dynamic risk-scoring mechanism that supports adaptive security decisions. The system was developed using React for the client interface, NestJS for backend services, PostgreSQL with Prisma ORM for data management, and FastAPI for machine learning deployment. The microservice architecture allows efficient communication between behavioural data collection, feature extraction, machine learning prediction, and risk assessment while supporting future improvements without affecting the core system. The results demonstrate that combining multiple behavioural features provides more accurate contextual information than traditional authentication methods alone. Continuous behavioural monitoring improves fraud detection, reduces false authentication decisions, and enhances web application security through adaptive risk assessment. This study provides a practical framework that bridges the gap between behavioural authentication research and real-world web security applications while establishing a foundation for future research in deep learning, larger behavioural datasets, and real-time adaptive security systems.