## 2 Background: Behavioral Biometrics Continuous Authentication  
Behavioral Biometric Continuous Authentication (BBCA) is a security enhancing technology, operating alongside with the initial login process, that monitors user's behavior and continuously re-authenticates users throughout a session. BBCA is based on behavioral modalities, such as walking gait, touch gestures, keystroke dynamics, hand waving, user profile, and power consumption [15]. According to [PERSON] et al. [20], behavioral biometrics are classified into five major categories: gait, motion, voice, keystroke dynamics, and gesture. Moreover, [20] argues that a multi-modal user authentication can be provided by combining these modalities. According to [28], 70 million smartphones are lost each year, while only 7 percent are recovered. Further to this, article [23] argues that intruders can illegally gain access to personal information if the password is compromised or if users do not maintain adequate attention to the smartphone after the initial authentication. The authors of [29] proposed as a remedy to this issue that the device should continuously monitor and validate the user after the initial login process. [PERSON] [22], emphasizes that continuous authentication methods could provide a more effective means of authenticating mobile devices' users. In addition, articles [21, 30] support the claim that users' authentication based on both Behavioral Biometrics (BB) and Continuous Authentication (CA) can provide high accuracy of authentication. Currently, smartphone vendors implement both physiological biometrics and knowledge-based schemes as the primary security mechanism for identifying a user [20]. Knowledge-based approaches depend on something the users know (e.g., PINs, password, etc. ), while physiological biometrics approaches depend on users' unique physiological characteristics (e.g., fingerprint, face recognition, iris). Article [11] argues that PIN-based authentication in smartphones is neither sufficient nor convenient in most situations. This drawback refers mostly to the entry-point authentication method, i.e., the authentication that takes place when a user starts a new session [22]. In addition, [20] argues that both these methods can provide point-of-entry authentication, but they fall short on delivering tacit continuous authentication, without causing constant annoyance or inconvenience to users. Another shortcoming is that physiological biometrics are mostly hardware-dependent, which increases the cost of devices [31]. On the contrary, a strong argument in favor of behavioral biometrics technology is that it can support continuous and passive authentication without depending on extra hardware [32]. Thus, behavioral biometrics have a stronger potential to fulfill the requirements for an effective authentication method [15]. [PERSON], [PERSON] and [PERSON] [33] report that 90% of the participants in the sample of their study are in favor of behavioral biometrics-based authentication, which reflects an increasing attention on behavioral biometrics. The authors also demonstrate that 30% of the sample do not use any security method on their smartphone, although they believe that their device should be protected. Further to this, several government projects aim to develop authentication systems based on behavioral biometrics. The US government has launched a pilot project to use behavioral biometrics for the authentication systems of the Internal Revenue Service (IRS) [9]. Also, the US Defense Information System Agency substituted employees' ID cards with a mix of behavioral biometrics and traditional measures [9]. Hence, both individual users and government organizations demonstrate an increased interest in behavioral biometrics. Despite that, however, there is a slow diffusion of behavioral biometrics pointing out that attention on protection measures usefulness is not an adequate motivation for adopting the technology.