TriadAuth: Continuous Authentication Through Structured GUI Sequence Modelling With Drift Adaptation and Modality‐Aware Explanations

Vollständiger Abstract

Worum geht es in dieser Arbeit?

ABSTRACT Continuous authentication (CA) systems based on behavioural biometrics are increasingly deployed in zero‐trust architectures, yet their performance degrades over time due to natural behavioural drift arising from device changes, fatigue and evolving habits. This paper presents TriadAuth, a CA framework that fuses keystroke dynamics, mouse dynamics and graphical user interface (GUI) interaction sequences through hierarchical multimodal processing. TriadAuth consists of three core components: (1) a structured GUI sequence encoder that models navigation actions as ordered embeddings with transition‐aware convolution, retaining sequential dependencies absent in earlier count‐based representations; (2) drift‐adaptive self‐attention with memory replay (DASA‐MR), an online adaptation mechanism that dynamically reweights transformer attention heads and maintains an episodic memory buffer to limit accuracy loss under drift; (3) modality‐aware counterfactual SHAP (MAC‐SHAP), a low‐latency interpretability method that produces modality‐specific feature attributions via counterfactual substitution against per‐user historical baselines. Experiments on the DriftAuth‐6M dataset (≈1.2 million sessions from 50 users recorded over 6 months) show an equal error rate (EER) of 0.94% on the first day and 1.21% after 6 months, showing improved drift resilience compared with reimplemented baseline models evaluated under the same DriftAuth‐6M protocol. The framework sustains 94% classification accuracy under observed drift and delivers explanations in 42 ms on an NVIDIA RTX 3060. This is substantially faster than Kernel SHAP and Integrated Gradients under the same hardware setting, while maintaining comparable attribution fidelity. These results indicate enhanced long‐term stability and decision transparency suitable for practical CA deployments.