Technical Summary: BEACON Dataset for Behavioral Fingerprinting

Problem Statement

Continuous authentication in high-stakes digital environments, particularly competitive esports, faces a critical bottleneck: the lack of comprehensive, multimodal datasets that capture fine-grained behavioral signals under realistic cognitive and motor demands. Existing benchmarks are often limited by small scale, unimodal sensing (e.g., only keystrokes or mouse dynamics), or a lack of synchronized environmental context. Furthermore, current datasets frequently rely on low-frequency desktop tasks or artificially brief sessions that fail to capture the onset of player fatigue or the microsecond-level sensorimotor inputs inherent to fast-paced gaming. This gap hinders the training and evaluation of next-generation foundational AI models for continuous authentication, behavioral profiling, and anomaly detection.

Methodology

To address these limitations, the authors introduce BEACON (Behavioral Engine for Authentication & Continuous Monitoring), a large-scale multimodal dataset derived from competitive Valorant gameplay.

Data Collection Architecture

The authors developed a custom, low-latency logging framework designed to capture telemetry without interfering with gameplay or degrading frame rates. The system operates via four concurrent threads:

1. Keyboard Telemetry: Captures key press/release events, timestamps, dwell times, and inter-key latencies using pynput.keyboard.
2. Mouse Telemetry: Records cursor coordinates, movement trajectories, click events, scroll activity, speed, and acceleration using pynput.mouse.
3. Network Telemetry: Utilizes scapy.sniff to capture raw network traffic (PCAPs), enabling temporal alignment of local physical inputs with server-side game activity.
4. Screen Recording: Captures gameplay sessions via an FFmpeg subprocess at 25 fps using conservative encoder settings to minimize CPU contention while preserving visual context.

All modalities are stamped with the host's POSIX time (Unix epoch) to ensure precise cross-modality temporal alignment without explicit synchronization markers. Data collection involved 28 distinct participants across 79 real-world sessions, conducted in both controlled lab settings and home environments to ensure hardware diversity.

Dataset Composition

BEACON comprises approximately 430 GB of synchronized modality data (461 GB total on-disk including auxiliary configuration captures). The dataset includes:

• Participants: 28 distinct players (pseudonymized P001–P028) spanning various competitive skill tiers.
• Duration: Approximately 102.51 hours of active gameplay.
• Event Volume: Over 90 million mouse events, ~498,000 keystrokes, and over 114 million network packets.
• Modalities: Mouse dynamics, keystroke dynamics, network packet captures, screen recordings, and hardware metadata (CPU, RAM, peripherals).

Baseline Evaluation

To characterize the dataset's utility, the authors established baseline performance using six state-of-the-art architectures originally developed for Website Fingerprinting (ARES, BAPM, NetCLR, TCN, TMWF, and Var-CNN). These models were adapted to perform a 28-class user identification task using mouse and keyboard modalities. The evaluation utilized temporal windows of 10s, 30s, 45s, and 60s, with data partitioned chronologically (80% training, 10% validation, 20% testing).

Key Contributions

1. The BEACON Dataset: A publicly released, large-scale multimodal dataset specifically designed for behavioral biometrics in high-stakes FPS environments. It uniquely isolates the intersection of raw sensorimotor dynamics, hardware configurations, and network telemetry.
2. Multimodal Synchronization: The dataset provides synchronized data across mouse, keyboard, network, and video modalities, allowing for the study of continuous authentication and user drift in a high-fidelity setting.
3. Baseline Benchmarks: The paper provides initial performance metrics for user identification using deep learning architectures, demonstrating the feasibility of continuous authentication in this domain.
4. Open Access: The dataset and the custom logging code are released on Hugging Face and Zenodo, respectively, to create a reproducible benchmark for the community.

Results

The baseline experiments yielded the following key findings:

• Modal Performance: Unimodal mouse dynamics consistently outperformed unimodal keyboard dynamics. Mouse-only models achieved identification accuracies up to 63.16% (Var-CNN at 10s resolution), whereas keyboard-only models peaked at 36.23% (TMWF at 45s).
• Fusion Performance: Early fusion of mouse and keyboard modalities yielded the highest overall performance. The Var-CNN architecture achieved a global maximum identification accuracy of 70.82% with an Equal Error Rate (EER) of 4.31% in the 60-second fusion setup.
• Architectural Variance: The Var-CNN and NetCLR architectures demonstrated superior convergence and performance, suggesting that dilated causal convolutions and contrastive representation learning are well-suited for esports telemetry. Conversely, the ARES architecture failed to converge across all configurations, highlighting a domain gap between models optimized for bursty network traffic and continuous human sensorimotor output.
• Temporal Resolution: Performance generally improved with longer observation windows (up to 60s), indicating that while micro-reflexes provide distinct signals, macro-behaviors (e.g., rotational pacing) provide the contextual stability necessary to minimize False Rejection Rates.

Significance and Claims

The paper positions BEACON as a foundational asset for cybersecurity research, specifically for stress-testing continuous authentication systems and autonomous AI agents under realistic, high-fatigue conditions. The authors claim that the dataset enables:

• Robust Behavioral Profiling: The high inter-user variance and low intra-user variance observed in the data confirm that competitive gameplay generates genuine, stable biometric signals.
• Passwordless Security: By leveraging subconscious sensorimotor habits, the dataset supports the development of seamless, non-intrusive authentication mechanisms suitable for latency-sensitive gaming applications.
• Future Research Directions: The authors explicitly frame the dataset as a starting point for open research directions, including adversarial robustness (detecting mimicry and bots), the fusion of network-level PCAP data with video frames, and the development of self-supervised behavioral foundation models for skill assessment and fatigue detection.

The authors remain modest regarding the dataset's scope, acknowledging limitations such as the specific cohort size (28 participants), the single-game/single-platform nature of the data (Valorant on Windows), and the lack of longitudinal data to model behavioral drift over time. They emphasize that the dataset is intended to support defensive research (authentication, anti-cheat) rather than covert surveillance.