Systems and methods for continuous user authentication

A system for continuously authenticating a user, the system comprising:

• a hardware processor configured to:
• receive, at a computing device, initial authentication credentials of the user, the initial authentication credentials enabling access to a service via the computing device;
• while the service is being accessed, continuously determine whether an unauthorized user has replaced the user in accessing the service by:
• identify a user option selected for interacting with the service;
• select, based on a type of the user option, a first set of usage attributes that can be used to monitor the user option, wherein the first set of usage attributes is selected for user options of a first type and a second set of usage attributes is selected for user options of a second type;
• receive a plurality of data streams capturing usage attributes of the service, wherein each data stream of the plurality of data streams is of a different data type;
• compare the first set of usage attributes with historic usage attributes associated with the user;
• and
• apply a respective weight to each respective usage attribute of the first set of usage attributes based on an exclusivity of the respective usage attribute to the user, wherein a first usage attribute is weighted higher than a second usage attribute for representing data unique to the user;
• detect that a discrepancy between the first set of usage attributes and the historic usage attributes exists based on determining that a first combined value of each respective weight for usage attributes that do not match between the first set of usage attributes and the historic usage attributes exceeds a second combined value of each respective weight for usage attributes that do match, wherein the discrepancy indicates that an unauthorized user has replaced the user;
• and
• determine that the unauthorized user has replaced the user and cease the access to the service via the computing device.

A non-transitory computer readable medium storing thereon computer executable instructions for continuously authenticating a user, comprising instructions for:

• receiving, at a computing device, initial authentication credentials of the user, the initial authentication credentials enabling access to a service via the computing device;
• while the service is being accessed, continuously determining whether an unauthorized user has replaced the user in accessing the service by:
• identifying a user option selected for interacting with the service;
• selecting, based on a type of the user option, a first set of usage attributes that can be used to monitor the user option, wherein the first set of usage attributes is selected for user options of a first type and a second set of usage attributes is selected for user options of a second type;
• receiving a plurality of data streams capturing usage attributes of the service, wherein each data stream of the plurality of data streams is of a different data type;
• comparing the first set of usage attributes with historic usage attributes associated with the user;
• and
• applying a respective weight to each respective usage attribute of the first set of usage attributes based on an exclusivity of the respective usage attribute to the user, wherein a first usage attribute is weighted higher than a second usage attribute for representing data unique to the user;
• detecting that a discrepancy between the first set of usage attributes and the historic usage attributes exists based on determining that a first combined value of each respective weight for usage attributes that do not match between the first set of usage attributes and the historic usage attributes exceeds a second combined value of each respective weight for usage attributes that do match, wherein the discrepancy indicates that an unauthorized user has replaced the user;
• and
• determining that the unauthorized user has replaced the user and ceasing the access to the service via the computing device.