## 3 Technologies and Methods  
It is proposed to develop a technology for the implementation of the multilevel protection architecture that would use the user's reaction time when working with the web interface as an additional user identifier. In this case, data collection will be carried out by built-in software components and interface elements, and afterwards, the data will be transferred to the system.  
Figure 1 shows the case when \"User 1\" has entered all the necessary data for access but can be replaced by another user from the workstation of \"User 1\" as well as from another place. If there are no blocks in the system related to user behavior and location, \"User 2\" can access the data.  
It is proposed to include a number of verification questions into the access control system. In this case, it is possible to take into account not only the answer to a specific verification question, but also the reaction time. This will allow excluding cases of changing the user in a single session using personal reactions. It is also possible to define a user when using someone else's passwords to enter the system. Possible cases with a reaction change caused by the current psychoemotional state require additional confirmation of the user's identity. So, in cases, for example, of illness or a decrease in the concentration of the user, the user's admission can be checked by special services in systems with strict access policies.  
In general, the technology being developed can be represented as follows:  
1. The technology is implemented by a computing complex. It can provide a client with one or more services, such as, for example, event monitoring services, financial services, banking services, government services, educational services, real-time data transmission services, gaming services, search services, etc.
2. The system includes computer networks, data transmission control systems (that is, the environment used to provide communication channels between computers), data processing systems, and other devices. The network can include connections in the form of wired communication lines, wireless communication channels, and fiber optic cables.
3. The system can send security incidents to the cloud platform for further analysis by a machine learning application based on the identified characteristics of security incidents detected during local analysis using the security module and event manager. The characteristics identified can include, for example, information that the observed parameters have a safety risk assessment above a threshold value.
4. The infrastructure creates a persistent repository of security information and an event manager. For example, it could be a security information and event manager, which can be implemented as a hardware component or a combination of hardware and  
Figure 1: Example of the system with access control.  
software components. The information and security events manager controls the process of selecting only specific security incidents for local and remote analysis.
5. The interval for evaluating the psychomotor reactions of the user is a predetermined time interval on the basis of which security incidents are formed.  
The workload layer provides the functionality for which systems are used. The collection of behavior characteristics should be built into the interface of client applications. So, for systems [37] that imply the transfer of state, it is necessary to collect data on user requests to the API, tracking the time, parameters, and user ID, and for systems with a graphical user interface (GUI), to collect data on actions regarding the interface, tracking the time of action and user identifiers.  
In the process of the user working with the system interface, it is necessary to check the transition conditions based on the previously completed sets of actions recorded in the event.