# Online Binary Models are Promising for Distinguishing Temporally Consistent Computer Usage Profiles

arXiv: https://arxiv.org/abs/2105.09900 · HTML: https://mlsanity.com/paper/2105.09900/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 47 references that are in the map.
- First posted on arXiv 20 May 2021.

## Builds on (most cited first, 5 of 5)

- [River: machine learning for streaming data in Python](https://mlsanity.com/paper/2012.04740/) (2020)
- [Scikit-Multiflow: A Multi-output Streaming Framework](https://mlsanity.com/paper/1807.04662/) (2018)
- [Active User Authentication for Smartphones: A Challenge Data Set and Benchmark Results](https://mlsanity.com/paper/1610.07930/) (2016)
- [Continuous Authentication of Smartphones Based on Application Usage](https://mlsanity.com/paper/1808.03319/) (2018)
- [Active Authentication on Mobile Devices via Stylometry, Application Usage, Web Browsing, and GPS Location](https://mlsanity.com/paper/1503.08479/) (2015)

## Abstract (arXiv)

This paper investigates whether computer usage profiles comprised of process-, network-, mouse-, and keystroke-related events are unique and consistent over time in a naturalistic setting, discussing challenges and opportunities of using such profiles in applications of continuous authentication. We collected ecologically-valid computer usage profiles from 31 MS Windows 10 computer users over 8 weeks and submitted this data to comprehensive machine learning analysis involving a diverse set of online and offline classifiers. We found that: (i) profiles were mostly consistent over the 8-week data collection period, with most (83.9%) repeating computer usage habits on a daily basis; (ii) computer usage profiling has the potential to uniquely characterize computer users (with a maximum F-score of 99.90%); (iii) network-related events were the most relevant features to accurately recognize profiles (95.69% of the top features distinguishing users were network-related); and (iv) binary models were the most well-suited for profile recognition, with better results achieved in the online setting compared to the offline setting (maximum F-score of 99.90% vs. 95.50%).