# Siberia: A Self-Sovereign Identity and Multi-Factor Authentication Framework for Industrial Access
## 2 Materials and Methods
### Behavioural Biometric Authentication Module  
One of the core components of SIBERIA is the behavioral biometric authentication module, deployed directly on the protected service. It centrally collects and analyzes features derived from the user's keyboard and mouse interaction patterns. This design enables tighter control over the authentication process, streamlines integration with existing security mechanisms, and allows centralized updates to the model. By leveraging human-machine interaction signals already present in typical industrial software environments, the module eliminates the need for additional biometric hardware, representing a significant advantage in regulated operational contexts. The real-time collection of these features enables the system to capture unique interaction signals that are difficult for attackers to imitate or replicate accurately [47; 48]. Studies have shown that attributes such as cursor speed, keystroke intervals, and the use of modifier keys (e.g., Shift or Ctrl) exhibit stable, user-specific patterns over time [49]. This stability makes these signals a reliable source for adaptive verification and CA systems. In our implementation, feature snapshots are sampled every 1 s from the protected application's backend telemetry, which is linked to the authenticated user session. The inference window size is administratively configurable; a 10 s sliding window with a 1 s stride is recommended as a practical balance between responsiveness and statistical stability. Longer windows reduce noise but slow detection, whereas shorter windows improve reactivity but may result in sparse data during low-activity periods. Tables 4 and 5 show the features extracted from the user's mouse and keyboard behavior, respectively, and used later to train the DNN models for behavioral biometrics. \begin{table}
\begin{tabular}{l l} \hline \hline
**Feature** & **Description** \\ \hline cursor\_speed & Average speed of cursor movement during usage \\ left\_clicks & Total number of left mouse button clicks \\ right\_clicks & Total number of right mouse button clicks \\ left\_double\_clicks & Total number of left double-click actions \\ right\_double\_clicks & Total number of right double-click actions \\ movement\_to\_click\_time & Average time from cursor movement to a click \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Mouse-based behavioral biometric features. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Process** & **Module** & **Time (s)** \\ \hline \multicolumn{3}{c}{Processing Times} \\ \hline GET keys & Keys manager & 1.00 \(\pm\) 0.25 \\ Enrollment & Encrypted Biometry & 1.06 \(\pm\) 0.19 \\ Authentication & Encrypted Biometry & 1.76 \(\pm\) 0.17 \\ SASV Fusion & Keys manager & 3.59 \(\pm\) 0.38 \\ \hline \multicolumn{3}{c}{Audio Duration} \\ \hline Enrollment & & 9.40 \(\pm\) 0.03 \\ Authentication & & 9.40 \(\pm\) 0.03 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Run time performance of the different stages of the SASV Biometric module in SIBERIA. Time (in seconds) is presented in terms of the mean \(\pm\) standard deviation of a set of 10,873 enrollment and authentication requests. The variables listed in Table 4 extracted from mouse interactions capture the user's motor behavior during system use. For example, cursor speed and the latency between movement and click reflect individual differences in movement precision and decisiveness. Likewise, the frequency of single and double clicks helps characterize habitual interaction patterns with the interface, among other aspects. In the case of the keyboard features shown in Table 5, the selected variables describe key aspects of typing dynamics. Metrics such as the time between keystrokes and key press durations are well-established in keystroke dynamics research. Special keys--such as Backspace, Shift, or Ctrl--provide further discriminatory power, revealing individual habits in error correction and the execution of key combinations, thereby enriching the user's biometric profile.