# Siberia: A Self-Sovereign Identity and Multi-Factor Authentication Framework for Industrial Access
## 2 Materials and Methods
### Behavioural Biometric Authentication Module
This module, integrated within the CA architecture, acts as an additional security layer automatically activated during regular application usage. It captures and analyzes behavioral biometric patterns derived from mouse and keyboard activity without impacting the user experience. Data capture occurs at the backend associated with the authenticated user session. Raw event streams remain local to the protected service, while only derived anomaly scores or risk signals need to be shared with higher-level orchestration components. This approach reinforces the privacy-preserving design of the broader SIBERIA framework. To effectively perform this analysis, the system employs a DNN model designed to process the extracted features during application usage. The model is optimized to handle continuously collected temporal data, enabling it to identify unique behavioral patterns over time. Its architecture is tailored to integrate multiple information sources and to deliver continuous identity predictions throughout the session. Table 6 summarizes the DNN model designed to process behavioral biometric signals. The model adopts a dual-branch autoencoder structure, with distinct convolutional and recurrent pathways independently processing mouse and keyboard signals. These temporal sequences are analyzed separately in each branch, and their representations are fused into a shared latent layer. From this combined representation, the decoders reconstruct the original signals, enabling both user identity verification and anomaly detection. The input sequence length is set to 10, allowing the model to capture temporal windows that are representative of the user's behavior. The latent space dimension is fixed to 32, providing a compact yet expressive encoding of biometric features. Training is performed in batches of 16 samples, balancing computational efficiency and learning stability, over 10 epochs. Mean squared error is employed as the loss function, as it is well-suited for measuring the difference between the original sequence and its reconstruction by the autoencoder. After training, a decision threshold is calculated to detect significant deviations from the user's normal behavior pattern. This threshold is defined as the mean of the combined reconstruction error plus three times its standard deviation, following a \begin{table}
\begin{tabular}{l l} \hline
**Feature** & **Description** \\ \hline avg\_key\_interval & Average time interval between two key presses \\ avg\_key\_duration & Average duration a key remains pressed \\ backspace & Number of times the backspace key is used \\ enter & Number of enter key presses \\ shift & Number of times the shift key is activated \\ ctrl & Number of control key presses \\ alt & Number of Alt key usage \\ caps\_lock & Number of caps lock key activations \\ tab & Number of tab key presseses \\ esc & Number of escape key usage \\ space & Number of spacebar presses \\ \hline \end{tabular}
\end{table} 
Table 5: Keyboard-based behavioral biometric features. statistical criterion that promotes high sensitivity to anomalies without compromising the false-positive rate. The model is trained using samples collected over a 5 min period, with a sampling rate of one sample per second on a single computer. To preserve the temporal coherence of the sequence, the samples are kept contiguous without any random shuffling. The full dataset is initially split by reserving the last 20% of the samples, which is further divided equally: 50% of this subset is used to generate the model's threshold, while the remaining 50% serves for validation. The initial 80% is used as the training set. For operational deployments, however, we recommend collecting data across all application sections where the user performs work tasks (e.g., monitoring, input forms, and maintenance tools) to ensure that the learned profile captures context-dependent interaction styles and reduces false alarms when workflows change. In real environments, several practical factors can influence CA performance.