Patent Description:
Embodiments of the present invention relate to systems for utilizing behavioral features to authenticate a user entering login credentials.

Currently, when users enter login credentials such as a username and password into, for example, a login form of a web-application, biometric data such as keystroke rate, number of mouse clicks, and the like are used to authenticate a user. A biometric data profile for a user may be established and associated with a user account (such as a mobile banking account) defined by the login credentials. This biometric data profile may contain information such as the typical keystroke rate, speed at which a cursor is moved, time elapsed between key up (release of a key) and key down (depression of a key) events, time spent entering a single login credential, time elapsed between entering successive login credentials, and number of mouse clicks per minute of the user. When the user subsequently enters the login credentials associated with the user account, biometric data associated with the action of entering the login credentials is collected. The collected biometric data is then compared to the biometric data profile associated with a user account. If the collected biometric information matches the biometric data profile (and other entered credentials are correct) a user is authenticated and logged into the user account associated with the entered logon credentials.

In some instances, when login credentials are entered into a login form, insufficient biometric data is available to be collected to be utilized to authenticate a user. In one example, an insufficient amount of biometric data for authenticating a user may be available to be collected when a user enters login credentials using an autofill function or a copy and paste function. In another example, an insufficient amount of biometric data for authenticating a user may be available to be collected when a hacker attempts to access the user account. In yet another example, an insufficient amount of biometric data for authenticating a user may be available to be collected when a user enters a small amount of data as login credentials (for example, when a user enters a <NUM>-digit pin).

<CIT> discloses apparatus and methods for providing persistent biometric authentication for a computer system. <CIT> discloses an authentication, identification, and/or verification system. <CIT> discloses a mobile device that may perform continuous authentication with an authenticating entity.

The scope of the present invention is set out in the appended set of claims. The embodiments described herein provide a system for utilizing behavioral features to authenticate a user entering login credentials. Unlike biometric data, behavioral features are not collected based on how login credentials are entered to access a user account. Examples of behavioral features include a geolocation, an internet protocol (IP) address, a unique device identifier (UDID), a decentralized identifier (DID), a device fingerprint, a web browser, a user agent, a time stamp, an email domain, an internet service provider (ISP), an operating system version, a combination of the foregoing, and the like. Therefore, embodiments described herein provide for a more accurate mechanism for authenticating users in instances where biometric data collected during a login attempt is limited. It should be understood that, in some embodiments, biometric data may be used in combination with behavioral features to authenticate a user. In the embodiments described herein, a user is authenticated by calculating a score based on behavioral data (a plurality of behavioral features) associated with a login attempt. The calculated score is compared to a threshold value to determine whether the login attempt is being made by the user associated with the user account or the login attempt is fraudulent. When it is determined that the login attempt is being made by the user associated with the user account, the user is authenticated. In this way, authentication can occur more readily for legitimate users while at the same time still preventing fraudulent users from accessing user accounts.

By providing a system for authenticating users using behavioral features in place of behavioral data, embodiments described herein enable users to be authenticated in a faster and more efficient manner when limited biometric data associated with a user's login attempt is available. For example, rather than requiring a user to refill in login credentials or provide additional information in order to collect additional biometric data when insufficient biometric data is collected during a login attempt, embodiments described herein utilize behavioral features to authenticate a user. Not having to re-enter credentials or enter additional credentials allows a user to access their account faster and with minimal effort, while using behavioral features to authenticate a user maintains the security of the users' account.

One embodiment provides an example system for utilizing behavioral features to authenticate a user entering login credentials. The system includes an electronic processor configured to receive a request to access a user account, the request including behavioral features and compare the behavioral features included in the request to behavioral features included in a user behavior profile associated with the user account. The behavioral features included in the user behavior profile include behavioral features associated with one or more previous requests to access the user account. The electronic processor is also configured to, based on the comparison, generate one or more scores including at least one selected from the group comprising a recency score, a frequency score, a novelty score, and a temporality score. The electronic processor is further configured to, for each of the one or more scores, compare the score to a predetermined threshold and, based on the comparison of the score to the predetermined threshold, adjust a match value. The electronic processor is also configured to compare the match value to one or more predetermined thresholds to determine whether the behavioral features included in the request to access the user account authenticates the user, does not authenticate the user, or is inconclusive.

Another embodiment provides an example method for utilizing behavioral features to authenticate a user entering login credentials. The method includes receiving a request to access a user account, the request including behavioral features and comparing the behavioral features included in the request to behavioral features included in a user behavior profile associated with the user account, the behavioral features included in a user behavior profile include behavioral features associated with one or more previous requests to access the user account. The method also includes, based on the comparison, generating one or more scores including at least one selected from the group comprising a recency score, a frequency score, a novelty score, and a temporality score. The method further includes, for each of the one or more scores, comparing the score to a predetermined threshold and based on the comparison of the score to the predetermined threshold, adjusting a match value. The method also includes comparing the match value to one or more predetermined thresholds to determine whether the behavioral features included in the request to access the user account authenticates the user, does not authenticate the user, or is inconclusive.

Yet another embodiment provides an example method non-transitory computer-readable medium with computer-executable instructions stored thereon that are executed by an electronic processor to perform a method of utilizing behavioral features to authenticate a user entering login credentials, comprising. The method includes receiving a request to access a user account, the request including behavioral features and comparing the behavioral features included in the request to behavioral features included in a user behavior profile associated with the user account, the behavioral features included in a user behavior profile include behavioral features associated with one or more previous requests to access the user account. The method also includes, based on the comparison, generating one or more scores including at least one selected from the group comprising a recency score, a frequency score, a novelty score, and a temporality score. The method further includes, for each of the one or more scores, comparing the score to a predetermined threshold and based on the comparison of the score to the predetermined threshold, adjusting a match value. The method also includes comparing the match value to one or more predetermined thresholds to determine whether the behavioral features included in the request to access the user account authenticates the user, does not authenticate the user, or is inconclusive.

One or more embodiments are described and illustrated in the following description and accompanying drawings. These embodiments are not limited to the specific details provided herein and may be modified in various ways.

As described above, in some cases insufficient biometric data for authenticating a user may be collected when a user attempts to login to an account. In these cases, behavioral data may be used to authenticate a user in addition to or in place of biometric data. For example a user may attempt to access a bank account from their mobile phone by entering a username and password (login credentials) to a webpage displayed in a web browser on their mobile phone. However, a feature may be enabled in the web browser that allows the web browser to automatically enter the user's credentials when the webpage is displayed. When the username and password are automatically entered, little to no biometric data (for example, keystroke rate) may be collected. When little to no biometric data is collected, behavioral features such as the time of day that the user is attempting to access the account, the location of the mobile phone from which the user is attempting to access the user account, the device identifier of the mobile phone, and the like may be used to authenticate the user. For example, if the attempt to access the bank account is received on a Tuesday afternoon and the bank account is normally accessed on Tuesday afternoons, the mobile phone is in a city that is associated with the last ten requests to access the user account, and the device identifier of the mobile phone matches the device identifier associated with a plurality of successful attempts to access the account, the user may be authenticated.

<FIG> is a block diagram of a system <NUM> for utilizing behavioral features to authenticate a user entering login credentials. In the example shown, the system <NUM> includes a first user device <NUM>, a second user device <NUM>, a third user device <NUM>, and a fourth user device <NUM> (referred to herein collectively as the user devices <NUM>, <NUM>, <NUM>, <NUM>) and an electronic computing device <NUM>. The electronic computing device <NUM> and user devices <NUM>, <NUM>, <NUM>, <NUM> are communicatively coupled via a communication network <NUM>. The communication network <NUM> is an electronic communications network including wireless and wired connections. The communication network <NUM> may be implemented using a variety of one or more networks including, but not limited to, a wide area network, for example, the Internet; a local area network, for example, a Wi-Fi network; or a near-field network, for example, a Bluetooth™ network.

It should be understood that the system <NUM> may include a different number of user devices and that the four user devices <NUM>, <NUM>, <NUM>, <NUM> included in <FIG> are purely for illustrative purposes. It should also be understood that the system <NUM> may include a different number of electronic computing devices than the number of electronic computing devices illustrated in <FIG> and the functionality described herein as being performed by the electronic computing device <NUM> may be performed by a plurality of electronic computing devices. It should be understood that some of the functionality described herein as being performed by the electronic computing device <NUM> may be performed by a user device. It should also be understood that some of the functionality described herein as being performed by a user device may be performed by the electronic computing device <NUM>.

In the embodiment illustrated in <FIG>, the electronic computing device <NUM> is, for example, a server that is configured to authenticate a user. In the embodiment illustrated in <FIG>, the user devices <NUM>, <NUM>, <NUM>, <NUM> are electronic computing devices (for example, a smart telephone, a laptop computer, a desktop computer, a smart wearable, a smart appliance, a smart home assistant, or other type of electronic computing device configured to operate as described herein).

<FIG> is a block diagram of an example of the first user device <NUM>. As illustrated in <FIG>, the first user device <NUM> is an electronic computing device that includes an electronic processor <NUM> (for example, a microprocessor, application-specific integrated circuit (ASIC), or another suitable electronic device), a memory <NUM> (a non-transitory, computer-readable storage medium), and a communication interface <NUM>, such as a transceiver, for communicating over the communication network(s) <NUM> and, optionally, over one or more additional communication networks or connections. The communication interface <NUM> allows the first user device <NUM> to communicate with the electronic computing device <NUM> over the communication network(s) <NUM>.

The first user device <NUM> also includes an input device <NUM> and a display device <NUM>. The display device <NUM> may include, for example, a touchscreen, a liquid crystal display ("LCD"), a light-emitting diode ("LED"), a LED display, an organic LED ("OLED") display, an electroluminescent display ("ELD"), and the like. The input device <NUM> may include, for example, a keypad, a mouse, a touchscreen (for example, as part of the display device <NUM>, or the like (not shown). The electronic processor <NUM>, the memory <NUM>, the communication interface <NUM>, the input device <NUM>, and the display device <NUM> communicate wirelessly, over one or more communication lines or buses, or a combination thereof. It should be understood that the first user device <NUM> may include additional components than those illustrated in <FIG> in various configurations and may perform additional functionality than the functionality described herein. For example, in some embodiments, the first user device <NUM> includes multiple electronic processors, multiple memories, multiple communication interfaces, multiple input devices, multiple output devices, or a combination thereof. Also, it should be understood that, although not described or illustrated herein, the second user device <NUM>, third user device <NUM>, and fourth user device <NUM> may include similar components and perform similar functionality as the first user device <NUM>.

As illustrated in <FIG>, the memory <NUM> included in the first user device <NUM> includes an application <NUM>. The application <NUM> is a software application that allows a user to access sensitive information (web content). For example, the application <NUM> may allow access to a user's bank account, credit card, healthcare information, or the like when a user enters login credentials into a login form and the user is authenticated. As described above, a user is authenticated by verifying that a user associated with the entered login credentials (or, for example, the user account <NUM> described below) is the user that entered the login credentials into the login form.

<FIG> is a block diagram of an example of the electronic computing device <NUM>. As illustrated in <FIG>, the electronic computing device <NUM> includes an electronic processor <NUM> (for example, a microprocessor, application-specific integrated circuit (ASIC), or another suitable electronic device), a memory <NUM> (a non-transitory, computer-readable storage medium), and a communication interface <NUM>, such as a transceiver, for communicating over the communication network(s) <NUM> and, optionally, one or more additional communication networks or connections. The communication interface <NUM> allows the electronic computing device <NUM> to communicate with the user devices <NUM>, <NUM>, <NUM>, <NUM> over the communication network(s) <NUM>.

As illustrated in <FIG>, the memory <NUM> included in the electronic computing device <NUM> includes a user account <NUM> and an authentication software application <NUM>. The user account <NUM> is associated with one user and associated with login credentials <NUM>. The login credentials <NUM> may be a username, a password, a pin number, an identification number, a combination of the foregoing, or the like. The user account <NUM> is also associated with a user behavior profile <NUM>. The user behavior profile <NUM> includes data (behavioral features) relating to how the user account <NUM> is usually accessed. For example, the user behavior profile <NUM> may include, for a plurality of requests associated with the user account <NUM>, a geolocation, an internet protocol (IP) address, a unique device identifier (UDID), a decentralized identifier (DID), a device fingerprint of one or more user devices that have accessed the user account <NUM>, and the web browsers and user agents used to access the user account <NUM> associated with the request. The user behavior profile <NUM> may also include dates and times that requests to access the user account <NUM> are sent by a user device. In some embodiments, behavioral features received along with a request to access the user account <NUM> is used to update the user behavior profile <NUM> associated with the user account <NUM>. It should be noted that the memory <NUM> may include a different number of user accounts and that the single user account <NUM> included in <FIG> are purely for illustrative purposes.

<FIG> illustrates an example method <NUM> of utilizing behavioral features to authenticate a user entering login credentials. The method <NUM> is performed by the electronic processor <NUM>, when the electronic processor <NUM> executes the authentication software application <NUM>. At step <NUM>, the electronic processor <NUM> receives, from a user device (for example, the first user device <NUM>) a request to access a user account (for example, the user account <NUM>). In some embodiments, the request includes login credentials, insufficient biometric data to authenticate the user, and behavioral features that may be used to authenticate the user. For example, the request may include the login credentials <NUM>, a geolocation, an IP address of the first user device <NUM>, a UDID of the first user device <NUM>, a DID of the first user device <NUM>, a device fingerprint of the first user device <NUM>, or a combination of the foregoing. The request may also include a web browser, a user agent, or both via which the first user device <NUM> requested access to the user account <NUM>. The request may also include a time stamp.

At step <NUM>, the electronic processor <NUM> compares the behavioral features included in the request to behavioral features included in a user behavior profile associated with the user account. The user behavior profile (for example, the user behavior profile <NUM>) includes behavioral features associated with one or more previous requests to access the user account (for example, the user account <NUM>). At step <NUM>, the electronic processor <NUM> generates one or more scores based the comparison between the behavioral features included in the request to behavioral features included in a user behavior profile. The one or more scores include at least one selected from the group comprising a recency score, a frequency score, a novelty score, and a temporality score. At step <NUM>, for each of the one or more scores, the electronic processor <NUM> compares the score to a predetermined threshold and, based on the comparison of the score to the predetermined threshold, adjusts a match value. Examples of the one or more scores and how the match value is adjusted based on the one or more scores are described in detail below.

At step <NUM>, the electronic processor <NUM> compares the match value to one or more predetermined thresholds to determine whether the behavioral features included in the request to access the user account authenticates the user, does not authenticate the user, or is inconclusive. For example, the electronic processor <NUM> compares the match value to a first predetermine threshold and a second predetermined threshold. In some embodiments, the second predetermined threshold is a lower value than the first predetermine threshold. In some embodiments, when the match value is greater than the first predetermine threshold, the electronic processor <NUM> authenticates the user (determines the user requesting access to the user account <NUM> is the user associated with the user account <NUM>). In some embodiments, when the match value is less than the second predetermine threshold, the electronic processor <NUM> does not authenticate the user (determines the user requesting access to the user account <NUM> is not the user associated with the user account <NUM>). In some embodiments, when the match value is less than the first predetermined threshold and is greater than the second predetermine threshold, the electronic processor <NUM> determines that it is inconclusive, based on the behavioral features included in the request, whether the user requesting access to the user account <NUM> is the user associated with the user account <NUM>.

The following paragraphs include a description of example scores used to calculate the match value described in <FIG> and how the scores influence the match value. In some embodiments, before the frequency score, novelty score, recency score, first temporality score, and second temporality score are set to a predetermined value (for example, <NUM>) before the electronic processor <NUM> analyzes the behavioral features associated with the request to determine the scores. In some embodiments, a frequency score of the one or more scores is generated based on frequent behavioral features included in the user behavior profile <NUM>.

For example, the frequency score may be determined by comparing a geolocation (for example, the geographical state, city, or both that the first user device <NUM> was in when the first user device <NUM> sent the request) included in the request received from the first user device <NUM> to geolocations included in the user behavior profile <NUM>. In some embodiments, if the geographical state (for example, Vermont) that the first user device <NUM> was in when the first user device <NUM> sent the request to the electronic processor <NUM> is, according to the behavioral features included in the user behavior profile <NUM>, the geographical state that requests to access the user account <NUM> are frequently associated with, the value of the frequency score is increased by a value. The value may be a predetermined by a predetermined value and requests may be considered to be frequently associated with a geographical state, when the majority of requests to access the user account <NUM> are associated with the geographic state. In some embodiments, if the geographical city (for example, Boston) that the first user device <NUM> was in when the first user device <NUM> sent the request to the electronic processor <NUM> is, according to the behavioral features included in the user behavior profile <NUM>, the geographical city that requests to access the user account <NUM> are frequently associated with, the value of the frequency score is increased by a value. The value may be a predetermined value and requests may be considered to be frequently associated with a geographical city, when the majority of requests to access the user account <NUM> are associated with the geographic city.

The frequency score may also be determined by comparing a DID or UDID included in the request (for example the DID or UDID of the first user device <NUM> that sent the request) to one or more DIDs, UDIDs, or both included in the user behavior profile <NUM>. In some embodiments, if a DID or UDID of the first user device <NUM> is the DID or UDID of a user device that, according to the behavioral features included in the user behavior profile <NUM>, frequently requests to access the user account <NUM>, the frequency score is increased. The frequency score may be increased by a predetermined value and requests may be considered to be frequently associated with a DID or UDID, when the majority of requests to access the user account <NUM> are associated with the DID or UDID.

In some embodiments, when the frequency score is greater than the first predetermined threshold, the match value is increased by a predetermined value.

In some embodiments, the electronic processor <NUM> determines a novelty score based on, with respect to data included in the user behavior profile, a novelty of a behavioral feature associated with a request received from a user device. For example, he value of the novelty score may be determined by comparing the geographical state (for example, Wisconsin) included in the request received from the first user device <NUM> to the geolocations included in the user behavior profile <NUM> and comparing a DID or UDID included in the request received from the first user device <NUM> to the one or more DIDs, UDIDs, or both included in the user behavior profile <NUM>. In some embodiments, if the geographical state that the first user device <NUM> was in when the first user device <NUM> sent the request to the electronic processor <NUM> is a geographical state that is not included in the user behavior profile <NUM>, the value of the novelty score is increased (for example, by a predetermined value). In some embodiments, if a UDID or DID of the first user device <NUM> is the UDID or DID of a user device that is not included in the user behavior profile <NUM>, the value of the novelty score is increased. In some embodiments, when the value of the novelty score is less than the second predetermined threshold, the match value is increased by a predetermined value.

In some embodiments, the electronic processor <NUM> determines a recency score. In some embodiments, the value of the recency score is determined by comparing the behavioral features received from the first user device <NUM> to the behavioral features included in the most previous or recent one or more requests (for example, the two most previous requests) to access the user account <NUM>. The behavioral features included in the most previous one or more requests to access the user account <NUM> is included in the user behavior profile <NUM>. In some embodiments, if the geographical state that the first user device <NUM> was in when the first user device <NUM> sent the request to the electronic processor <NUM> is a geographical state that was included in the most previous one or more requests to access the user account <NUM>, the recency score is increased (for example, by a predetermined value). In some embodiments, if the geographical city that the first user device <NUM> was in when the first user device <NUM> sent the request to the electronic processor <NUM> is a geographical city that was included in the most previous one or more requests to access the user account <NUM>, the recency score is increased (for example, by a predetermined value). In some embodiments, if the IP address of the first user device <NUM> is the IP address of the user device that sent the most previous one or more requests, the recency score is increased (for example, by a predetermined value). In some embodiments, if the UDID of the first user device <NUM> is the UDID of the user device that sent the most previous one or more requests, the recency score is increased by (for example, by a predetermined value). In some embodiments, if the DID of the first user device <NUM> is the DID of the user device that sent the most previous one or more requests, the recency score is increased (for example, by a predetermined value). In some embodiments, if the fingerprint of the first user device <NUM> is the fingerprint of the user device that sent the most previous one or more requests, the recency score is increased (for example, by a predetermined value). In some embodiments, if the user agent the request is received from is the user agent that sent the most previous one or more requests, the recency score is increased (for example, by a predetermined value). In some embodiments, if the browser the request is received from is the browser that sent the most previous one or more requests, the recency score is increased (for example, by a predetermined value). When the recency score is greater than the third predetermined threshold, the match value is increased by a predetermined value.

In some embodiments, the electronic processor <NUM> determines a first temporality score. The first temporality score is set to a predetermined value (for example, one) when the time and date associated with the request to access the user account <NUM> is similar to the date and time that the most previous one or more requests are associated with (for example, the times and dates the requests were sent at or received at). In some embodiments, a similar time is a time that is within a predetermined range. For example, if a time associated with a request is <NUM>:<NUM> PM coordinated universal time (UTC), a similar time may be between <NUM> PM UTC and <NUM> PM UTC. When the first temporality score is equal to the predetermined value (for example, one), the match value is increased by a predetermined value.

In some embodiments, the electronic processor <NUM> determines a second temporality score. The second temporality score is set to a predetermined value (for example, one) when the time elapsed between a time associated with the request to access the user account <NUM> (for example, the time the request is received by the electronic processor <NUM>) and a time associated with the most previous request to access the user account <NUM> is within one standard deviation of the average time elapsed between the reception of previous consecutively received requests to access the user account <NUM>. When the second temporality score is equal to the predetermined value (for example, one), the match value is increased by a predetermined value.

It should be understood that scores, other than the scores described herein, may be determined and influence the match value. For example, of velocity at which certain behavioral features are included in received requests may influence the match value. Behavioral features for which a velocity may be determined are, for example, DID, UDID, geographical location, an email domain, an internet service provider (ISP), an operating system version, a combination of the foregoing, and the like. A velocity of a behavioral feature may be the number of times an access request associated with a particular behavioral feature is received during a predetermined time period. In one embodiment, a velocity score may be set to a predetermined value when at least a predetermined number (for example, <NUM>) of requests to access the user account <NUM> associated with the same DID are received during a predetermined time period (for example, five minutes). In some embodiments, when the velocity score is at least a predetermined value, the match value is decreased by a predetermined value.

It should also be understood that the behavioral features described above as being used to determine the scores need not necessarily be used to determine the scores. In some embodiments, behavioral features other than or in addition to those described in the examples provided above may be used to determine the scores. Additionally, it should be understood that thresholds, time periods, and values described above in relation to the calculation of one or more scores are illustrative examples and are not meant to be limiting.

In some embodiments, the predetermined thresholds that the frequency score, novelty score, recency score, match value or a combination of the foregoing are compared to are determined experimentally by adjusting the predetermined thresholds to achieve a desired authentication rate (percentage of users authenticated). In some embodiments, the predetermined thresholds that the frequency score, novelty score, recency score, match value or a combination of the foregoing are compared to are determined experimentally by adjusting the predetermined thresholds to achieve a desired false positive rate (percentage of users incorrectly authenticated).

In some embodiments, when the request to access the user account <NUM> is received in step <NUM> of the method <NUM>, the electronic processor <NUM> may determine the reason that there is insufficient biometric data to authenticate the user. Depending on the reason for the insufficient amount of biometric data (for example, whether login credentials are entered with an autofill function or a copy and paste function, a hacker attempts to access the user account <NUM>, or a user enters a small amount of data as login credentials), the electronic processor <NUM> varies the behavioral features analyzed to authenticate the user, varies the predetermined thresholds used in the method <NUM> to authenticate the user, or both.

It should be understood that other embodiments may exist that are not described herein. Also, the functionality described herein as being performed by one component may be performed by multiple components in a distributed manner. Likewise, functionality performed by multiple components may be consolidated and performed by a single component. Similarly, a component described as performing particular functionality may also perform additional functionality not described herein. For example, a device or structure that is "configured" in a certain way is configured in at least that way, but may also be configured in ways that are not listed. Furthermore, some embodiments described herein may include one or more electronic processors configured to perform the described functionality by executing instructions stored in non-transitory, computer-readable medium. Similarly, embodiments described herein may be implemented as non-transitory, computer-readable medium storing instructions executable by one or more electronic processors to perform the described functionality. As used herein, "non-transitory computer-readable medium" comprises all computer-readable media but does not consist of a transitory, propagating signal. Accordingly, non-transitory computer-readable medium may include, for example, a hard disk, a CD-ROM, an optical storage device, a magnetic storage device, a ROM (Read Only Memory), a RAM (Random Access Memory), register memory, a processor cache, or any combination thereof.

In addition, the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. For example, the use of "including," "containing," "comprising," "having," and variations thereof herein is meant to encompass the items listed thereafter and equivalents thereof as well as additional items. The terms "connected" and "coupled" are used broadly and encompass both direct and indirect connecting and coupling. Further, "connected" and "coupled" are not restricted to physical or mechanical connections or couplings and can include electrical connections or couplings, whether direct or indirect. In addition, electronic communications and notifications may be performed using wired connections, wireless connections, or a combination thereof and may be transmitted directly or through one or more intermediary devices over various types of networks, communication channels, and connections. Moreover, relational terms such as first and second, top and bottom, and the like may be used herein solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.

Claim 1:
A system for utilizing behavioral features to authenticate a user entering login credentials, the system comprising:
an electronic processor, the electronic processor configured to:
receive (<NUM>) a request to access a user account, the request including biometric data and behavioral features;
utilize the behavioral features to authenticate the user when the biometric data is insufficient to authenticate the user;
compare (<NUM>) the behavioral features included in the request to behavioral features included in a user behavior profile associated with the user account, the behavioral features included in the user behavior profile include behavioral features associated with one or more previous requests to access the user account;
based on the comparison, generate (<NUM>) one or more scores including at least one selected from the group comprising a recency score, a frequency score, a novelty score, and a temporality score;
for each of the one or more scores,
compare (<NUM>) the score to a predetermined threshold; and
based on the comparison of the score to the predetermined threshold, adjust a match value; and
compare (<NUM>) the match value to one or more predetermined thresholds to determine whether the behavioral features included in the request to access the user account authenticates the user, does not authenticate the user, or is inconclusive,
wherein the electronic processor is further configured to:
determine a reason that there is insufficient biometric data to authenticate the user; and
depending on the reason for the insufficient amount of biometric data, determine which behavioral features to analyze to determine the one or more scores and determine one or more predetermined thresholds to compare the one or more scores, match value, or both to.