KNN-Based Behavioral Intrusion Detection Using Mouse Dynamics and Session Timing

Abstract

This research proposes a behavioral intrusion detection system that uses mouse movement, session duration, and K-Nearest Neighbors (KNN) for classifying sessions. This system attempts to classify users into legit and non-legit users based on session time, number of mouse clicks, and mouse movement speed. The system was built using one of the class sessions, and the other class session was set aside for testing. The result was impressive, as every single metric of classification evaluation, such as accuracy, precision, recall, and F1-score, scored 1. The more advanced metrics also display an MCC of 1.00, a FRR of 0.00, and a FAR of 0.00, indicating that there were no misclassifications whatsoever. This indicates that the behavioral characteristics the system relied on captured user patterns of identification effectively and distinctly. The system has proven to be effective in the application of behavioral biometrics in intrusion detection systems.