Mouse Dynamics Dataset for Behavioral User Substitution Detection in Electronic Testing

Description

This dataset contains streaming behavioral (mouse-interaction) events recorded during computer-based testing sessions between 2015 and 2018. It comprises 31,990,875 raw events collected from 1,755 users, including 9.48 million click events and 22.51 million mouse-movement events. All records are fully anonymized: no names, identifiers, IP addresses, or any personally identifiable information are included. Each user is represented only by an internal numeric ID with no link to real-world identity. Each event record includes: event type (click or movement); click duration (ms); movement speed (pixels/second); movement length (pixels); movement direction (angle); and inter-event timing used to derive tempo features. Data are provided in raw form and, separately, after removal of physically implausible outliers (2.03% of records), such as negative or extreme speed values and unrealistic click durations. For research reproducibility, the dataset also includes intermediate artifacts used in the associated study: cleaned event tables, non-overlapping windowed behavioral profiles (window sizes W = 50, 100, 200 events) built from directional-kinematic features (quantile signatures of click duration, movement speed and length; circular statistics of movement direction; inter-event tempo; click share), and per-user reference/probe window splits used for verification experiments. A refined cohort of 1,067 users meeting minimum activity thresholds (at least 3,000 events, 5 sessions, 200 clicks, and 1,000 movements) is identified via a cohort-selection flag. The dataset is intended to support research on behavioral biometrics, mouse dynamics, continuous and open-set user authentication, anomaly and drift detection in streaming data, and user-substitution detection in remote/e-testing and similar human-computer interaction contexts. It enables reproducible evaluation of distributional and sequential-monitoring methods (e.g., Wasserstein-distance-based criteria, CUSUM-type detectors) without requiring access to any personal or identifying information. Data are shared as CSV.

Steps to reproduce

1) Load raw data. Load dataset.csv - the full stream of behavioral events (clicks and mouse movements) per user, with fields: event type, timestamp, click duration, movement speed, movement length, movement direction. 2) Exploratory analysis and cleaning. Inspect the distributions of click duration and movement speed to identify physically implausible values (e.g., negative or extreme speed, unrealistic click duration). Apply the documented bounds to remove outliers (2.03% of records removed in the original study). 3) Cohort selection. select users meeting the minimum activity thresholds: at least 3,000 events, 5 sessions, 200 clicks, and 1,000 mouse movements per user. 4) Windowing. Split each user's cleaned event stream into non-overlapping windows of W events (use W = 50, 100, and 200 to reproduce the window-size comparison). 5) Feature extraction (DKP). For each window, compute the 21-feature directional-kinematic profile: quantile signatures of click duration, movement speed, and movement length; circular statistics of movement direction (mean direction, resultant vector length, 8-bin histogram); inter-event tempo; and click share. 6) Individual invariant. Estimate the Hill tail index of movement speed for each user (Eq. 1 in the article). 7) Feature discriminativeness. Run one-way ANOVA (identity as factor) on the 21 features to obtain F-ratios and eta-squared values, and derive the WBDS-w modality weights. 8) Reference/probe split. For static verification, split each user's windows into a reference set (40%) and probe set (remaining 60%). Impostor probes are drawn from other users' windows (zero-effort attack). 9) Compute WBDS / WBDS-w scores. For each probe window, compute the normalized Wasserstein distance to the reference distribution per modality (Eq. 2), then the unweighted (Eq. 3) and weighted (Eq. 4) anomaly indices. 10) Static verification metrics. Compute EER, AUC, and FAR at FRR = 1% for WBDS, WBDS-w, and baseline methods (Euclidean, Mahalanobis, Isolation Forest, Random Forest). 11) Streaming simulation. On the chronological event stream, inject substitution attacks by inserting 8-window blocks from a different user. Run the CUSUM statistic (Eq. 5) over the WBDS-w score stream with a sliding reference window (ROLL most recent windows) to obtain detection rate, mean detection delay (in windows), and false alarm rate (ARL). 12) Unsupervised anomaly screening. Apply the same WBDS-w/CUSUM pipeline to each user's own stream (self-comparison) to flag accounts with unstable or bimodal behavioral profiles, indicative of possible account sharing.

Institutions

• Siberian Transport University

  Novosibirsk Oblast, Novosibirsk

Categories

Licence