Behavioral Biometrics
Behavioral biometrics identifies people by how they type, move a mouse or swipe — the unconscious patterns bots can't replicate at scale.
Advanced Behavioral Protection
Secure your platform with behavioral analysis
What are Behavioral Biometrics?
Behavioural biometrics identify a person by how they interact with a device rather than by a physical characteristic. Typing rhythm, the shape of a mouse path, scroll cadence, how a thumb travels across a touchscreen — the patterns are consistent enough per person to be measurable, and hard to reproduce deliberately.
In bot protection the question asked of them is usually simpler than identity. It is not "which person is this" but "is any person here at all", and that is a much easier question to answer reliably.
What is measured
| Channel | What is recorded | Why automation struggles with it |
|---|---|---|
| Pointer | Path curvature, acceleration, overshoot and correction near targets | Scripted movement is straight, or follows a curve with no correction |
| Keyboard | Dwell time per key, flight time between keys, where pauses fall | Injected text has uniform or zero inter-key timing |
| Touch | Pressure, contact area, swipe arc, tremor | Synthetic events carry no pressure or area data at all |
| Session rhythm | Where a person stops to read, reaction time after a page paints | Scripts act before a human could have perceived the change |
The last row is the one that generalises best. A response that arrives faster than human reaction time is not a probabilistic signal, it is an impossibility, and it does not depend on modelling anyone's individual style.
Why it holds up better than fingerprinting
A device fingerprint is a set of values an attacker can edit. Spoofing toolkits exist precisely to rewrite them, and they are effective.
Behaviour is harder to forge because it has to be generated continuously and remain internally consistent. Faking one mouse path is easy; faking a path whose acceleration profile, timing and relationship to the page's layout all agree, across a whole session, is considerably harder. That difficulty is the defence, and it is a difference of degree rather than of kind — it raises cost rather than making forgery impossible.
The honest limitations
Three things are worth saying plainly, because vendors tend not to:
- Assistive technology looks unusual. Screen readers, switch access and voice control produce interaction patterns far from a mouse-and-keyboard baseline. A model that treats unusual as automated will reject disabled users, which is both a harm and a legal exposure.
- Replay is possible. Recorded human interaction can be played back. Defences against that are session freshness and binding the behaviour to a specific challenge, not the behavioural analysis itself.
- It is personal data. Interaction patterns relate to an identifiable person and fall under GDPR. Collecting them needs a lawful basis, a retention limit and a straight answer about where they are processed.
How it is used here
Procaptcha uses behavioural signals as one input among several, alongside browser characteristics and proof of work, and weighs them against each other rather than scoring any one in isolation. The signals inform a live verdict and are not retained to build a profile of an individual across sites, which is the distinction between using behaviour to answer "is someone here" and using it to track a person.