Behavioral biometric modeling of keyboard typing has historically relied on basic metrics such as dwell time (key press duration) and flight time (inter-key latency) [4][5]. These approaches have shown moderate success, with Equal Error Rates (EER) ranging from 5% to 20% depending on the protocol [3]. However, their reliability remains fragile in the face of contextual factors such as fatigue, stress, or changes in typing habits.

Cognitive sciences suggest that typing is not a linear sequence of letters but a structured motor activity. According to Levelt [6], written language production relies on preparatory units—known as syllables—that are planned and executed as coherent motor blocks. This hypothesis is supported by the work of Pinet et al. [7], which shows that significant slowdowns occur at syllable boundaries, a phenomenon known as the “unit boundary effect” [8].

This behavior reveals the existence of an intrinsic syllabic rhythm for each user—one that is relatively stable over time and difficult to consciously falsify. In a study by Lambert and Vilette [11], it was observed that inter-syllabic latencies show lower intra-individual variance than inter-letter latencies, reinforcing the idea that the syllable constitutes a relevant biometric unit.

Syllabation is a key task in natural language processing (NLP), used in applications such as speech synthesis, speech recognition, and linguistic modeling. Various approaches have been proposed, ranging from rule-based systems to modern neural models. Below is an overview of recent notable works:

2.2.1. SylNet (2019)

Räsänen et al. [12] introduced a neural network model for estimating the number of syllables from audio signals. The system generalizes well across languages. However, it is limited to counting tasks and does not provide precise segmentation or textual support.

2.2.2. Revisiting Syllables for Language Modeling (2020)

Oncevay and Rojas [13] evaluated syllabic language models on 20 languages. Results show comparable perplexity to character-based models with shorter sequences, favoring efficiency. However, the models require offline syllabators, making real-time integration difficult.

2.2.3. ItGraSyll (2024)

Borgo et al. [14] developed an Italian annotated resource for syllabation and lexical accent prediction. Their neural model achieves 98.4% word-level accuracy and 99.8% for syllable boundaries. However, this method is limited to Italian and does not support dynamic typing.

2.2.4. LSTM with ASR Embeddings (2024)

Pascual et al. [15] introduced a method to detect syllable boundaries in speech using internal representations from an Automatic Speech Recognition (ASR) system. Their system achieves a Word Correction Rate (WCR) above 90% on Romance languages. Its main limitation is its dependence on ASR models and its inapplicability to text-based typing.

In summary, while these approaches confirm the potential of neural models for syllabation, they also reveal a critical gap: to the best of our knowledge, no current approach supports real-time (online) syllabation from keyboard typing, i.e., the detection of syllable boundaries at each new keystroke without access to the full word. This capability is essential for continuous and transparent authentication.

Traditional keystroke dynamics models rely on low-level metrics such as dwell time and flight time [5]. Despite their simplicity and low implementation cost, these systems achieve only moderate performance, especially in unconstrained environments. Acien et al. [4] report an average EER of 12.7% on real-world data, rising to 25% in free-typing scenarios. For instance, in the French corpus, loanwords such as “week-end” or “wifi”? as well as poly-syllabic words like “organisation”? introduce segmentation ambiguities due to non-canonical syllabic boundaries and atypical phonotactic structures. These cases occasionally lead to boundary shifts in the predicted syllable stream, particularly under high typing speed, thereby highlighting the inherent limitation of purely rhythm-based segmentation in the presence of linguistic irregularities.

Recent models based on LSTMs or autoencoders improve robustness but remain based on poorly expressive feature vectors, as they ignore the underlying linguistic structure [3]. Keystroke dynamics are treated as a stochastic sequence of mechanical pressures, without accounting for the user’s cognitive rhythm. These metrics suffer from several structural limitations.

First, they are heavily influenced by contextual factors: fatigue, mood, keyboard ergonomics, body posture, and even ambient noise. These elements cause significant intra-individual variability, which undermines the temporal stability of the biometric profile [3].

Second, traditional metrics do not account for the cognitive structure of typing. They treat input as a mechanical sequence of events, ignoring higher-level linguistic processes such as lexical planning or mental segmentation into syllables [7][8]. This limits their ability to faithfully reflect user intent.

Third, their discriminative power is limited in the face of trained impostors. Studies show that an informed attacker can mimic standard keystroke timings with sufficient accuracy to fool systems relying solely on latency metrics [16]. Moreover, recent studies report EERs often exceeding 10 Finally, traditional approaches offer limited integration potential into modern adaptive security architectures, such as ABAC systems, due to the lack of structured or interpretable signals.

Each keystroke is represented as a pair ( c i , p i ) , where c i is the character typed and p i is its temporal position in the sequence. Two distinct embedding spaces are used:

A symbolic embedding E c : A → ℝ d c , where A is the character alphabet. A positional embedding E p : ℕ → ℝ d p , which captures the sequential structure.

The final input representation is obtained by concatenating both embeddings:

This encoding strategy allows the model to retain both the linguistic identity of the character and its local positional context, enhancing the robustness and precision of the segmentation [17].

To capture local patterns such as digrams and syllabograms, a series of sliding-window convolutions is applied:

Each convolution W k extracts features from a local context of size k . The outputs of all convolutions are then concatenated to form a comprehensive feature vector:

This multi-scale mechanism is inspired by neural architectures used in linguistic structure recognition, such as those in NER or POS tagging [18].

The z i vectors are passed through a unidirectional LSTM to model sequential dependencies. At each time step t , the hidden and cell states are updated as follows:

The unidirectional design ensures that the model only uses past information, making it suitable for real-time applications. The hidden state h t ∈ ℝ h captures the accumulated syllabic context up to position t .

To refine the segmentation decision, MIES-TR incorporates a centered local attention mechanism over a fixed-size window of size w :

This causal attention dynamically weights the influence of recent positions, focusing on critical transitions typically associated with syllable boundaries [19].

Syllabic Boundary Detection Head

Finally, a dense layer projects the contextual vector c t into a binary output space:

The output y ^ t ∈ [ 0 , 1 ] represents the probability that a syllable boundary follows the current keystroke. The model is trained using binary cross-entropy loss:

where y t is the ground truth (1 if a boundary follows, 0 otherwise). This architecture enables real-time decision-making, with an operational latency of less than 30 ms per keystroke, meeting the requirements for continuous authentication.

Real-time behavioral biometric processing imposes strict technical constraints: decisions must be made immediately after each keystroke, with minimal delay, no access to future input, and tolerance for natural human errors. MIES-TR was designed with these principles in mind, both in its neural architecture and software implementation. Below are the key design choices that ensure compliance with real-time constraints.

3.5.1. Strict Causality and Unidirectionality

A real-time model can only rely on data already observed. MIES-TR ensures this by using a causal unidirectional LSTM, instead of bidirectional architectures like BiLSTM or Transformers [17]. This means each prediction y ^ t is based solely on past keystrokes { c 1 , ⋯ , c t } , which aligns with the causality requirement in continuous authentication environments [4].

3.5.2. Low Latency and Instant Decision-Making

Latency refers to the time between the input c t and the output y ^ t . To maintain a smooth user experience, it must remain below the natural typing rhythm (200 ms). Studies such as Teh et al. [3] show that perceived responsiveness degrades beyond 100 ms. MIES-TR is optimized to produce output in under 30 ms per keystroke on standard CPUs, thanks to a linear O ( w ⋅ d ) architecture, where w is the attention window size and d is the context dimension.

3.5.3 Sliding Window for Incremental Segmentation

Online segmentation relies on a fixed-size sliding window that allows for continuous boundary evaluation without storing the entire sequence. This is inspired by cognitive models of rhythmic planning in writing [7], where writing is structured syllable by syllable.

3.5.4. Bounded Memory and Efficient State Management

Traditional sequential models often require recomputing or storing all previous states. MIES-TR avoids this by maintaining only the current LSTM state and a circular context window of attention states. This reduces memory usage to O ( w ) , enabling execution on devices with limited resources such as basic PCs and mobile devices. Additionally, a partial rollback mechanism is implemented: if a typing error is detected (e.g., via a backspace key), only the most recent states are recomputed, limiting computational cost without compromising coherence. To handle typing errors efficiently without restarting the entire decoding process, a partial rollback mechanism is implemented at the recurrent and attention levels. Concretely, when an inconsistency or rejection signal is detected, the model reverts only the last k hidden states of the LSTM and trims the corresponding attention window. This is achieved by popping the last k elements from the hidden-state buffer and resetting the attention context accordingly, while preserving earlier stable states. This strategy enables localized correction with constant-time complexity relative to the rollback depth, ensuring real-time responsiveness without full sequence recomputation.

3.5.5. Decision Stabilization and Noise Filtering

To prevent small irregularities (e.g., fatigue, distraction, typos) from causing segmentation errors, MIES-TR applies temporal smoothing: the y ^ t outputs are filtered using a weighted moving average. This method is inspired by human motor control models that filter temporal noise to preserve stable perception [20]. This robustness mechanism improves accuracy without sacrificing responsiveness, making it particularly useful in free-typing scenarios, where users naturally vary in rhythm and pressure.

3.5.6. CPU Optimization and Embedded Adaptability

Thanks to its fully causal, local-windowed architecture and the absence of complex autoregressive components (e.g., Transformers), MIES-TR runs efficiently on standard CPUs. This makes it suitable for deployment on workstations, embedded systems, or secure mobile applications. Experiments on ARM processors at 1.8 GHz show an average keystroke latency of 27 ms.

Two main corpora were used:

Lexique3 [21]: a lexical database of 140,000 French words annotated with syllables according to standard phonotactic rules. This resource supports supervised learning of syllabic segmentation within a linguistically grounded framework.User Corpus: a custom dataset collected from 25 French-speaking users, each typing an average of 300 words selected randomly but representative of the lexical distribution of the French language. Sequences were automatically annotated using a reference syllabator and then manually verified by two linguistic experts to ensure boundary validity. The inter-annotator agreement reached 97.2%.

This dual approach allows the model to be evaluated on both theoretical linguistic data (Lexique3) and real typing data rich in behavioral variability and contextual noise.

Experiments were conducted on a standard workstation (Intel i5, 2.3 GHz, 8 GB RAM), simulating a real-time typing environment. The pipeline was instrumented to introduce an average input delay of 180 ms between keystrokes, consistent with measurements from the literature [3][4].

No offline or retrospective processing was allowed: segmentation decisions were emitted in streaming, after each keystroke, simulating a continuous authentication environment.

The model was trained on 80% of the corpus and validated on the remaining 20%, with strict user separation to avoid behavioral overfitting. Each input was a sequence of typed characters, labeled with a binary sequence indicating the presence of a syllable boundary.

The model was optimized using the Adam optimizer (learning rate = 0.001), with a batch size of 32 and early stopping after 5 epochs without improvement. Embeddings were randomly initialized and learned jointly during training.

Segmentation performance was assessed using the following metrics:

Precision: proportion of positively detected boundaries that are correct.Recall: proportion of actual syllable boundaries that are successfully detected.F1-Score: harmonic mean of precision and recall.Average Latency: time between keystroke and segmentation decision.Sequence Accuracy (SeqAcc): proportion of fully and correctly segmented words.

These metrics enable a fine-grained assessment of the model’s accuracy, robustness, and responsiveness.

In accordance with CNIL recommendations and best research practices [22][23], all user data were collected anonymously. Each participant signed an informed consent form and was informed of the purpose and processing of the data.

Keystrokes were pseudonymized and did not include passwords or sensitive content. The study protocol was approved by the local ethics committee (Ref. UDS/IRB/23-047). No background behavioral monitoring was activated during data collection.

This protocol ensures a reliable and reproducible evaluation of the MIES-TR model, combining linguistic grounding, realistic usage simulation, rigorous methodological validation, and strict adherence to research ethics.

Table 1 and Figure 2 below present the average results obtained on the user corpus using 5-fold cross-validation, across several key metrics:

Table 1. Syllabic segmentation results on the user corpus (real-time setting).

Figure 2. Comparison of syllabic segmentation performance between MIES-TR and existing approaches. MIES-TR shows an optimal balance between precision, recall, F1-score, and word-level accuracy, while meeting real-time processing constraints.

MIES-TR significantly outperforms methods based on classical keystroke metrics, while approaching the performance of offline models. The trade-off between accuracy and immediacy of decision-making is a strong asset for dynamic security applications.

The model achieves an average decision latency of 27 ms (standard deviation: 4.2 ms), measured between the arrival of a character c t and the production of y ^ t as shown in Figure 3. This is well below the human perceptual threshold for interaction fluidity (100 - 150 ms) [24], ensuring a seamless user experience.

Figure 3. Comparison of average processing latencies per keystroke across models. MIES-TR exhibits significantly lower latency (27 ms), making it compatible with real-time interaction constraints, unlike offline models such as BiLSTM or Transformer, whose latencies exceed perceptual thresholds for human users [24].

In contrast, Transformer-based syllabation architectures [13] require full input to produce reliable segmentation, with average latencies exceeding 600 ms (non-causal), making them unsuitable for real-time use.

MIES-TR maintains stable performance despite variability across users. The F1-score ranges from [87.1% to 92.5%] depending on the user profile, demonstrating strong generalization capabilities Figure 4. Perturbed typing (due to fatigue or delays) leads to a controlled degradation, with the contextual stabilization mechanism reducing the impact of isolated false positives.

Previous studies on keystroke dynamics have shown that intra-individual variability in inter-key latencies can exceed 20% [4][5], explaining the weak performance of traditional GMM or SVM-based approaches on this task.

Figure 4. Variation of F1-score among the 25 users in the experimental corpus. A stable overall performance with moderate variance confirms MIES-TR’s ability to generalize effectively across diverse typing styles. These results demonstrate the model’s robustness to inter-user variability, a key requirement for behavioral biometric systems in real-world conditions [4][5].

The results confirm our initial hypothesis: the syllable is a relevant biometric unit, combining linguistic structure and motor consistency. By capturing syllabic dynamics at each keystroke, MIES-TR successfully models a stable and hard-to-imitate behavioral signature. However, some limitations remain:

The model depends on the quality of syllabic annotations, which can be ambiguous in certain poly-syllabic or loanwords; It does not yet fully account for pre-processing typing errors (auto-correction, backspace); The evaluation is based on dictated text; future extensions to free typing would be needed to assess real contextual robustness.

Overall, MIES-TR represents a significant advancement in real-time behavioral biometrics. It combines linguistic rigor, neural efficiency, and embedded compatibility, offering a solid foundation for continuous authentication in secure interactive systems.

Modern access control systems increasingly rely on adaptive and contextual approaches, especially through Attribute-Based Access Control (ABAC). In this paradigm, access to resources is determined not only by static identifiers (name, role), but also by dynamic attributes that reflect the current state of the environment or the user at the time of the request.

6.1.1. Syllabic Dynamics as a Contextual Attribute

The MIES-TR model generates a continuous stream of binary decisions indicating syllable boundaries, from which a behavioral vector can be dynamically constructed. By aggregating these decisions over a sliding temporal window (e.g., 10 - 20 keystrokes), we derive a contextual rhythmic profile r t .

Mahalanobis distance is particularly well-suited for comparing syllabic rhythm profiles as it accounts for correlations between temporal features and normalizes scale variations across users, which is essential in behavioral biometrics where intra-user variance is structured. Cosine similarity, on the other hand, is invariant to amplitude scaling and captures the directional consistency of rhythmic patterns. Both measures have been widely adopted in keystroke dynamics and rhythm-based authentication due to their robustness to session variability and noise. This profile can be compared to the user’s reference model using a dissimilarity measure, producing a trust score s t :

This score can then be used as a dynamic attribute in an ABAC policy:

This approach enables access decisions that are no longer static but contextual, continuous, and sensitive to behavioral impersonation.

6.1.2. Example of ABAC Integration

Consider a hospital information system. An authenticated doctor may access a patient record only if: They are logged in from an internal IP address, Their role is “primary physician” and the biometric score s t computed by MIES-TR over the last 20 keystrokes exceeds a threshold τ = 0.87 . This condition can be formalized using the following ABAC rule:

permit if (role == "medecin") and (location == "intranet") and (bio_score > 0.87)

6.1.3. Benefits for Cybersecurity

This integration offers several key advantages

Session hijacking detection: A sudden drop in s t can signal an unauthorized takeover of an active session.Adaptive access control: The system can dynamically adjust access levels (e.g., read-only, edit, alert) based on behavioral reliability.Enhanced audit and traceability: Access logs now include a probabilistic behavioral dimension, improving forensic analysis and accountability.

6.1.4. Compliance with Security Standards

The approach aligns with NIST guidelines on dynamic and adaptive access in Zero Trust architectures [25]. It enriches the ABAC model without altering its logical core, simply by adding a dynamic behavioral attribute dimension.

In summary, integrating MIES-TR into an ABAC framework provides a natural gateway to intelligent, adaptive, and user-centered security systems. It enhances access control granularity while maintaining transparency and non-intrusiveness—key requirements for daily use in high-security environments.

The MIES-TR model opens up several innovative research paths, both in algorithmic design and in behavioral cybersecurity applications. These perspectives aim to extend its utility, enhance robustness, and facilitate its adoption in real-world, high-security environments.

6.2.1. Generalization to Free and Multitask Typing

Current results were obtained in a semi-controlled setting (dictated or suggested text). A natural evolution is to evaluate and adapt MIES-TR to free typing environments, where users generate spontaneous content in multitask contexts (e.g., typing with interruptions, corrections, reformulations, etc.).

This will require the integration of additional modules for handling special events (backspace, auto-complete, keyboard suggestions), as well as modeling dynamic contextual memory [26].

6.2.2. Multilingual Adaptation and Orthographic Invariance

Another promising avenue is the extension of the model to languages with different syllabic structures (e.g., Arabic, Japanese, Bantu languages), or even multilingual settings. The use of a universal pre-syllabation pipeline (such as “espeak-ng” or “Unisyn”) combined with a local neural correction layer could enable rapid adaptation [13].

Additionally, the segmentation could be made more robust to spelling variations or typographical errors by integrating phonetic or syllabic embeddings [27].

6.2.3. Multimodal Biometric Fusion

MIES-TR could be combined with other behavioral modalities such as mouse trajectory, scrolling speed, eye movement (via webcam), or cognitive pause analysis. This multimodal biometric fusion approach, previously explored in mobile settings [28], would increase resilience to imitation attacks and improve behavioral anomaly detection.

6.2.4. Embedded and IoT Implementation

The structural simplicity of MIES-TR—its unidirectional sequential processing and lack of dependency on full-word context—makes it suitable for deployment on embedded systems such as smart keyboards, secure USB sensors, or distributed authentication terminals. Compilation to lightweight frameworks like TensorFlow Lite or ONNX would enable execution on ARM microcontrollers (e.g., Raspberry Pi, ESP32), with acceptable real-time performance (latency < 30 ms) [29].