💻 computer science

A Hybrid Two-Tier Continuous Authentication Framework with a Security-First Calibration Strategy for Zero-Trust Web Deployments

This paper presents ALJ, a hybrid two-tier continuous authentication framework for Zero-Trust web deployments that replaces proxy models with genuine ARIMA, LCS, SVM, and JRip algorithms and introduces a security-first calibration strategy to significantly improve recall and reduce adversary bypass rates compared to standard static thresholds.

Original authors: Nabil El Kadhi

Published 2026-09-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Nabil El Kadhi

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, the password is the old-fashioned key. For decades, it has been the primary way we prove who we are when we log into a bank, a hospital record, or a government portal. But a password is a static thing; once it is stolen, it is useless as a shield. A thief with the right code can walk right through the front door. To fix this, security experts have moved toward a philosophy called "Zero Trust." The idea is simple: never trust anyone, not even the person who just typed the right password. Instead, you must keep checking their identity the entire time they are inside. This is where continuous authentication comes in. It does not just ask "Who are you?" at the start; it watches how you behave while you work. It looks at the rhythm of your typing, the speed of your clicks, and the unique patterns of your movement. If the rhythm changes, the system assumes the person at the keyboard might be an impostor, even if they have the correct password.

A new study by researcher Nabil El Kadhi explores how to build this kind of constant watchfulness for web applications. The goal was to create a system that could spot a thief in real-time without annoying the real user. The researcher built a two-stage security framework. The first stage acts as a quick filter, using two different methods to check a user's typing habits. One method looks at the time gaps between keystrokes, predicting what the next pause should be based on the user's history. The other method compares the sequence of typing speeds to a stored template of how that specific user usually types. If the current typing matches the history well, the user is let through immediately. If the typing is ambiguous or suspicious, the session is sent to a second, more detailed stage. This second stage uses two powerful tools working together: a statistical engine that calculates the probability of an attack, and a rule-based system that creates a clear, human-readable explanation for why a decision was made. This combination allows the system to be both accurate and understandable, giving security teams a reason for every alert.

The study began with a significant discovery that changed the entire direction of the research. The team had previously tested their system using a simplified, simulated version of the typing data. When they replaced that simulation with real, complex data from a large public dataset of fifty-one people typing a fixed password, a hidden flaw appeared. The system's first filter, which had been set to a fixed standard, suddenly became too loose. Because the real data was more informative than the simulation, the filter let through a large number of fake sessions. Specifically, nearly thirty percent of the attacker sessions bypassed the second stage entirely, slipping past the system undetected. The researchers realized that a threshold that worked for a simple, noisy signal failed completely when faced with a strong, real signal. This was a critical lesson: upgrading the tools inside a security system can break the settings that were tuned for the old tools.

To fix this, the researchers had to rethink how they set the rules. They tried a standard mathematical approach often used to find the "best" balance between catching thieves and not bothering real users. However, this standard approach made the problem worse, dropping the system's ability to catch attackers from fifty-three percent down to forty-six percent. The reason was that the standard method treated missing a thief and annoying a real user as equally bad mistakes. In a security-first world, missing a thief is far more dangerous. The researchers then applied a new strategy: they forced the first filter to be much stricter, ensuring that no more than three percent of attackers could slip through. This meant that many more sessions, including some from real users, had to go to the second, more expensive stage for a closer look.

The result of this stricter approach was a system that finally worked as intended. By accepting more false alarms in the first stage to ensure no attackers got through, the overall system caught seventy percent of the intruders. This was a major improvement over the initial failure. The system also maintained a high level of accuracy, correctly identifying legitimate users most of the time, though it did flag more real users for extra checking. The study confirmed that the combination of the statistical engine and the rule-based explanation was significantly better than using either tool alone. The researchers also tested a potential upgrade where the system would check if the user was on a familiar device, which further improved security in simulations, though this part still needs real-world testing.

The paper concludes with a clear message for anyone building these systems. Simply having powerful tools is not enough; the settings that control them must be adjusted carefully to match the specific risks. A setting that works for a weak, noisy signal will fail when the signal becomes strong and clear. The researchers showed that by prioritizing security over convenience and by understanding the specific cost of missing an attacker, they could build a system that is both robust and practical. The study does not claim to have solved the problem of online security forever, but it provides a clear, tested path forward for how to build continuous authentication that actually works in the real world, rather than just in a simulation. The findings suggest that the future of secure web access lies in systems that are constantly watching, constantly learning, and constantly adjusting their rules to stay one step ahead of those who would steal our identities.

Technical Summary: A Hybrid Two-Tier Continuous Authentication Framework with a Security-First Calibration Strategy

Problem Statement
Password-based authentication remains a critical vulnerability, particularly against Stolen Password Attacks (SPA), where attackers utilize valid credentials to impersonate users. While Multi-Factor Authentication (2FA) addresses initial login, it fails to detect unauthorized activity after authentication, as it does not monitor user behavior during the session. Zero Trust Architecture (ZTA) proposes "never trust, always verify," requiring continuous re-verification of identity and behavior. However, many web applications lack practical continuous authentication mechanisms. Existing AI-driven approaches often rely on hardware sensors (increasing deployment costs) or use methodological proxies (simulations) that may mask structural flaws in the decision logic. Furthermore, standard threshold calibration methods often assume symmetric costs for false positives and false negatives, which is inappropriate for security-first environments where missing an attacker is far more costly than inconveniencing a legitimate user.

Methodology: The ALJ Framework
The paper proposes ALJ, a two-layer continuous authentication framework designed for web applications. It integrates behavioral biometrics (keystroke dynamics) with a hybrid decision engine.

Layer 1: Statistical Filtering (ARIMA + LCS)
- Registration: Builds a user profile based on historical typing data (password length, character composition, and timing).
- Feature Extraction: Analyzes inter-keystroke latencies to generate three core metrics: mean, median, and mode of timing.
- Scoring:
  - ARIMA(1,0,0): Fits a time-series model to the first seven inter-keystroke timings of a session to forecast the next three pause durations. These forecasts are compared against the user's historical confidence ranges.
  - Longest Common Subsequence (LCS): Compares the sequence of keystroke timing codes against the user's historical template to calculate a similarity coefficient.
- Decision: A composite score ( $C1$ ) is derived. If $C1$ exceeds a fixed threshold ( $T$ ), the session is accepted as legitimate. If below, it is escalated to Layer 2.
Layer 2: Hybrid Fusion (SVM + JRip)
- Purpose: Resolves ambiguous sessions that Layer 1 cannot confidently classify.
- Components:
  - Support Vector Machine (SVM): Provides a high-accuracy, calibrated probability estimate of an attack using an RBF kernel.
  - JRip (RIPPER): A rule-based induction algorithm that generates human-readable "if-then" rules to explain the decision, ensuring interpretability.
- Fusion: A logistic regression meta-classifier fuses the SVM probability, the JRip rule confidence, and the Layer 1 composite score into a final decision.
- Automated Safeguard: The framework includes an automated check to verify the sign convention of the SVM output and rule confidence during training, preventing errors where the model inadvertently predicts "legitimate" when it should predict "attacker."

Key Contributions and Corrections
The paper's primary contribution is not merely the framework design, but the rigorous validation of its components and the discovery of a critical calibration flaw exposed by replacing methodological proxies with genuine implementations.

Replacement of Proxies: Previous validation passes used a Gaussian-noise substitute for ARIMA and a decision-tree surrogate for JRip. This revision implements real ARIMA(1,0,0) models (fitted via conditional least squares) and a real RIPPER model (using the wittgenstein library).
Discovery of Threshold Miscalibration: Replacing the proxies revealed that the previously used fixed 60% Layer 1 threshold was calibrated against the noise of the simulation. When applied to the real, more discriminative ARIMA/LCS signal, this threshold allowed 29.1% of attacker sessions to bypass Layer 2 entirely, capping the system's recall at 53.1%.
Failure of Standard Calibration: The author tested a "Data-Driven Decision Node" using Youden's J statistic (which maximizes $TPR - FPR$ ). This approach improved accuracy but decreased recall to 45.8%, because Youden's J treats false acceptances and false rejections as symmetric costs, failing to account for the security reality that a missed attacker at Layer 1 is a permanent breach.
Security-First Calibration Strategy: The author proposes a new calibration rule:
1. Set the Layer 1 threshold ( $T$ ) to strictly constrain attacker leakage to $\le 3.3\%$ (achieved at $T=75$ ).
2. Optimize the Layer 2 fusion threshold ( $\tau$ ) using the F2-score, which weights recall twice as heavily as precision.
3. Retrain the model on the resulting expanded dataset.

Results
The framework was validated on the CMU Keystroke Dynamics Benchmark Dataset (12,240 sessions, 51 users, 16.7% attacker rate) using the standard Killourhy & Maxion protocol.

Performance of the Security-First Configuration:
- Recall: Recovered to 70.4% (95% CI: 68.4%–72.4%), a significant improvement over the 53.1% baseline and the 45.8% Youden-optimized result.
- Precision: 40.5% (reflecting the trade-off of accepting more false alarms to catch attackers).
- Accuracy: 77.8%.
- AUC (Layer 2 escalated pool): 0.879.
- False Acceptance Rate (FAR): 20.73% (due to the aggressive recall optimization).
Statistical Significance: The fused SVM-JRip classifier significantly outperformed individual components (SVM-only and JRip-only) with $p < 0.001$ (McNemar's test).
Trade-offs: The paper explicitly presents three operating points (Fixed Threshold, Learned Decision Node, and Recall-Constrained) to demonstrate that there is no single "optimal" point; the choice depends on whether an organization prioritizes user experience (fewer false alarms) or security (catching all attackers).

Significance and Claims
The paper claims that its most durable contribution is the demonstration that upgrading proxy components to genuine models can silently break thresholds that were implicitly tuned to the weaknesses of the proxies. It argues that standard calibration heuristics (like Youden's J) are insufficient for security-critical systems where error costs are asymmetric.

The author emphasizes that their results are modest compared to some literature claiming >99% accuracy, noting that those studies often use closed-set protocols or balanced datasets. ALJ operates under a realistic, imbalanced threat model and a strict "hard gate" protocol where Layer 1 failures are permanent. The paper concludes that maintaining robust Zero Trust security requires dynamic, risk-sensitive threshold calibration rather than static, cost-insensitive heuristics.

Limitations Noted

Data Source: Validation uses a physical QWERTY keyboard dataset; browser-based timing (JavaScript) and mobile touchscreens are not yet empirically validated.
Adversarial Mimicry: Attackers are simulated via cross-user impostors, not by adversaries actively trying to mimic the target's rhythm.
Latency: End-to-end decision latency on a live web client has not been measured.
Device Trust: A proposed device-trust extension was only evaluated via simulation, not real multi-device data.

Technical Summary: A Hybrid Two-Tier Continuous Authentication Framework with a Security-First Calibration Strategy

More like this