## 2 Background and Related Work  
Many research papers are concerned with providing a trusted online learning system. The important aspect is to provide fairness in the LLS student assessment tasks by detecting cheating students remotely. Some researchers deal with the keystroke behavior, like the one published by [PERSON] et al. [16], by collecting the keystrokes and clickstream data to detect cheating students from their authentic writing behavior. The data are collected from university students who performed three writing tasks under different experimental cases. Model-based clustering was used to distinguish cheaters from un-cheating students. The experimental results prove that keystrokes and clickstreams can be used to distinguish cheaters from their writing behavior. Another biometrics used to detect cheating in exams is the one proposed by [PERSON] et al. [17], who collected the biometrics data: fingerprints and the eye tribe of students. They collected data using two devices, the fingerprint reader authenticator and the eye tribe tracker, which required extra cost. Afterward, they used the two parameters collected, which are the collected total time elapsed on the screen and the number of times taken to enter and out from the screen to classify cheating and non-cheating students. After performing several experiments, they proved to reach a precision of 95%. Most of the applications deal with mouse dynamics as it happens more in the system than keystrokes [18]. From applications that used the mouse movement is the paper published by [PERSON] and [PERSON] [19], which recorded the mouse behavior of players playing a memory game through the web to identify the player. They used a pointed device to collect the user interaction and used statistical pattern recognition techniques to verify the player from the imposter. A large set of features were extracted from the user interaction's raw data; then, a feature extraction algorithm chose the main features. Finally, a sequential classifier is used to classify users from the imposter. The experimental results showed that the proposed algorithm succeeded in authenticating users playing a memory game at an inexpensive cost, as it used a standard human interaction device (mouse). Furthermore, other papers that used mouse movement in verifying users is the one proposed by [PERSON] et al. [20]; they collected data sets from general mouse movement and another data set from an online form for several users. Afterward, the raw data is segmented into the PC (Point click) action, and several features are extracted. These featuresare the Angle-based features and the statistical features, which enhanced the process of user verification, as they are unique from one person to another. Finally, they used support vector machines (SVMs) for accurate classification. Their results showed that they could verify users with high accuracy without the need for an extra cost. The paper proposed by [PERSON] & [PERSON] [7] has performed a number of studies to determine the most important mouse actions, which are extracted from mouse dynamics and the number of mouse actions required to detect the intrusion with high precision. They have segmented the mouse movement's raw data collected into three mouse actions. The first one is the Mouse Movement (MM) action, which is a general mouse event. The second one is the Point and Click (PC) mouse action, which ends with a mouse click event. The last type is the Drag and Drop (DD) mouse action, which represents the drag and drop mouse events. Furthermore, they extracted additional features to help increase intrusion detection. They proved that mouse dynamics is considered a good inexpensive intruder detection system. Furthermore, to perform the detection with high accuracy, they used a sufficient data set. Other papers have used mouse dynamics and AI algorithms in classification to enhance the precision of results, like the work done by [PERSON] et al. [21], who collected the mouse dynamics of 10 users playing Minecraft video games.