## 2 Background and Related Work  
As discussed in the introduction, an online network is subject to several types of security threats that can lead to intrusions. Moreover, irregular behavior on the Internet can indicate a security threat or other illegal behavior [13]. Biometric technologies can increase system security by measuring and analyzing the biological data of human behavior, then extracting hidden details from the acquired data and comparing the details to information stored in a recorded catalog. Biometric systems have been used to address security in a broad range of applications in several fields of our society, such as law enforcement, financial and trade security, information systems security, border control, and healthcare [14; 15]. This section will briefly present some examples of research on the use of biometrics for continuous authentication and anomaly detection. [PERSON] and [PERSON] (2014) [9] investigated user identification through online shopping activities. They first collected an extensive array of diverse data from 28 participants. They conducted their experiment using the \(k\)-nearest neighbor classifier. They achieved an accuracy of 87.5% by using 20 features extracted from mouse data. Authors in this study applied the traditional ML for classification using some handcrafted features. However, in our study, we compared the performance of the DL model with different ML algorithms. The study of the behavioral components of human-mouse movement is generally referred to as mouse dynamics. [PERSON] et al. (2015) [16] studied user authentication in web users focusing only on point-click action. A comparison of cumulative distribution functions was used in their study. From 20 participants, the research extracted three mouse-click features: \"pause to click\", \"click duration\", and \"pause after the click\". They obtained 44% user authentication accuracy (ACC) when using features extracted from 100 mouse movement strokes, and they obtained 96% ACC when using features extracted from 100 mouse clicks. [PERSON] et al. (2011) [17] developed a system to capture a user's characteristics using a set of random buttons. The system was built to capture the \(x\) and \(y\) coordinates of the mouse location and the time (in ms) of the event. Users must follow these buttons by moving the mouse and clicking on the buttons wherever the buttons appeared. A user must click 20 buttons to complete the experiment. After the user clicks the first button, a second button appears immediately in a random location. This step needs a user to do it six times to establish the user's personal profile under a controlled environment. The researchers' approach had data of five users with the same laptop and same mouse. They collected 30 files for all users, six files for each user. The researchers used a Euclidean distance algorithm for identification purposes. The experiment achieved 14 files that matched out of 30 files (46.67%). They attempted identification through hand/arm movements using mice and achieved an FRR of 53.55%. While a biometric system is developed for identification or verification as a part of authentication, the proposed approach in [PERSON] et al. (2011) focuses only on identification. [PERSON] et al. (2005) [18] worked on mouse movement as a biometric. They proposed two authentication methods: the first method is for initial login of users ( enrolment), and the second method is to monitor a computer for suspicious activities (verification). It requires from the user about 20 s to complete each of two methods. For the enrolment phase, a user must be using the mouse and following a series of dots that show one at a time on the user's screen. The purpose of this step is to record the coordinates of the mouse every 50 milliseconds and then calculate the speed, deviation from a straight line, and angles. They used the data collected from the enrolment phase for the verification phase by comparing a user's credentials and the data collected in the enrolment phase.