Skip to main content

Behavioral Analytics

Prerequisites

Before implementing behavioral analytics, understand:

TL;DR
  • Behavioral analytics = Detecting fraud through how users interact, not just what they do
  • Fraudsters steal credentials, but can't steal behavior (typing rhythm, mouse curves, navigation patterns)
  • Use cases: ATO detection, bot detection, fraud ring identification
  • Signals: straight-line mouse paths (bot), instant form completion (paste), erratic typing (unfamiliar)
  • Vendors: BioCatch, BehavioSec (LexisNexis), NeuroID

Detecting fraud through user behavior patterns.

Overview​

Behavioral analytics examines how users interact with your platform, not just what they do. Fraudsters may have stolen credentials, but they can't steal behavior.

Types of Behavioral Signals​

SignalLegitimate PatternFraud Pattern
Time on pageVaries, reads contentMinimal, jumps to goals
Scroll behaviorGradual, pausesNo scrolling or erratic
Mouse movementNatural curvesStraight lines, robotic
Click patternsReads before clickingDirect to buttons
Tab switchingOccasionalFrequent (copy-paste)

Input Behavior​

SignalLegitimate PatternFraud Pattern
Typing speedConsistent, personalErratic, paste-heavy
Typing rhythmUnique cadenceAutomated, unnatural
Error correctionNatural mistakesFew errors (pasted)
Form completionGradualInstant (autofill abuse)
Field focus orderNatural flowRandom or optimized

Session Behavior​

SignalLegitimate PatternFraud Pattern
Session durationReasonable for taskVery short or very long
Page sequenceExploratoryDirect to high-value
Return visitsPattern existsFirst and only visit
Time to transactionNormal deliberationImmediate

Behavioral Biometrics​

More advanced signals based on physical behavior:

Keystroke Dynamics​

  • Time between keystrokes (dwell time)
  • Time between key releases (flight time)
  • Typing rhythm patterns
  • Error patterns and corrections

Mouse Dynamics​

  • Movement velocity and acceleration
  • Curve patterns (humans curve, bots don't)
  • Click pressure (on supported devices)
  • Scroll patterns

Touch Dynamics (Mobile)​

  • Touch pressure
  • Touch area (finger size)
  • Swipe patterns
  • Hold duration

Use Cases​

Account Takeover Detection​

Normal User Behavior:
- Knows password (types smoothly)
- Familiar with site layout
- Consistent navigation pattern
- No hesitation on familiar fields

ATO Behavior:
- Password pasted or typed differently
- Explores unfamiliar areas
- Changes sensitive settings immediately
- Different behavioral biometric signature

Bot Detection​

Bot IndicatorDescription
No mouse movementKeyboard-only navigation
Perfect timingSuperhuman speed
Linear pathsNo natural curves
Consistent rhythmNo human variation
Missing eventsJavaScript events not fired

Fraud Ring Detection​

Shared behavior patterns across accounts:

  • Similar navigation sequences
  • Identical typing rhythms
  • Same form completion patterns
  • Matching session characteristics

Implementation​

Data Collection​

// Example: Capture keystroke timing
let lastKeyTime = 0;
const keyTimings = [];

document.addEventListener('keydown', (e) => {
  const now = performance.now();
  if (lastKeyTime) {
    keyTimings.push(now - lastKeyTime);
  }
  lastKeyTime = now;
});

Building Baselines​

  1. Collect behavior data during normal usage
  2. Build profile for each user/segment
  3. Score new sessions against baseline
  4. Alert on significant deviations

Risk Scoring​

Deviation LevelBehavioral Score Impact
< 1 std devNo impact
1-2 std dev+10 risk points
2-3 std dev+25 risk points
> 3 std dev+50 risk points

These scores combine with velocity rules, device signals, and other factors in your overall risk scoring model.

Privacy Considerations​

Data Sensitivity

Behavioral data can be highly personal. Consider:

  • Disclosure in privacy policy
  • Purpose limitation
  • Data minimization
  • Retention periods

Vendor Landscape​

  • BioCatch
  • BehavioSec (LexisNexis)
  • NeuroID
  • Darktrace
  • Recorded Future (behavioral)

Next Steps​

Implementing behavioral analytics?

  1. Start with navigation behavior - Easy to collect
  2. Add input behavior - Typing patterns
  3. Integrate with risk scoring - Combine signals

Detecting specific threats?

  1. Use for ATO detection - Behavior mismatch
  2. Add bot detection - Robotic patterns
  3. Find fraud rings - Shared behavior

Evaluating vendors?

  1. Review vendor landscape - BioCatch, NeuroID, etc.
  2. Consider privacy requirements - Data sensitivity
  3. Plan baseline building - Collection first