Three Cheriton researchers won the Best Paper Award at the Association for Computing Machinery’s (ACM) Symposium on Access Control Models and Technologies (SACMAT), a leading cybersecurity and privacy conference.

SACMAT brings together researchers and practitioners to discuss novel approaches for access control, a security measure that determines who can access, use or interact with protected systems. Scanning your badge to enter your workplace or typing your username and password to log in to your Instagram account are examples of access control. Biometrics are another widely used form of access control, relying on a person’s unique physical or behavioural characteristics. Many devices use biometric authentication, from fingerprint scans to voice recognition.  

The team, composed of master’s alumni Aswad Tariq (MMath ’25) and Alexandru Bara (MMath ’25), and Professor Urs Hengartner, received the award for their research on behavioural biometrics. Unlike traditional biometrics, behavioural biometrics measure and analyze patterns in a user’s behaviour, such as their typing speed, keystroke dynamics, and mouse movements. Typically, these patterns are consistent and challenging to imitate, making behavioural biometrics effective tools for fraud detection and prevention. They are also often perceived as less invasive than physical biometric methods.  

The team (L to R: Aswad Tariq, Alexandru Bara and Professor Urs Hengartner) investigated whether behavioural biometrics are used to protect or invade customers’ privacy. 

“In this research, we aim to raise awareness and open the discussion on behavioural biometrics in practice,” says the paper’s lead author, Aswad. “For example, some of these behavioural biometric domains are already on public blocklists, so a free privacy extension blocks them and nothing on the site breaks. So, who is this actually protecting?” 

Despite their promise, little is known about how widely behavioural biometrics are used across the web. Are organizations using them to verify customers’ identities and prevent fraud, or are they also being used to collect and monetize their data? This uncertainty raises significant security and privacy concerns.

“While we can’t say for sure what this behavioural biometrics data is used for, it is concerning that the data is transmitted to third parties in some cases,” says Professor Hengartner.

Aswad and his colleagues set out to address this gap by conducting the first large-scale study of behavioural biometric prevalence on the web. They began by creating a dataset of 232 behavioural biometric scripts from 18 vendors. Then they developed LoginGPT, a state-of-the-art web crawler that can effectively detect login webpages containing these scripts. The researchers also leveraged static taint analysis_, a method that tracks how data flows through a program from its start and endpoints. In this case, it traces code scripts for behavioural biometrics. To distinguish scripts used for authentication from those intended for customer tracking, the team employed supervised machine learning models. Using these approaches, they analyzed behavioural biometric prevalence across 9,502 American banks and CrUX Top 100k websites.

The researchers discovered that banking login pages and general websites with discoverable login pages were 2.6 to 3.5 times more likely to deploy behavioural biometric scripts than banking homepages and general website landing pages. These scripts were found on 15.8% of banking login pages and 1.8% of general websites with discoverable login pages. Since login pages are where users enter private information, these results suggest that behavioural biometrics are used primarily for cybersecurity purposes. Overall, the research shows that behavioural biometrics are an increasingly important cybersecurity tool, especially for fraud prevention in financial and e-commerce services. The findings also highlight the need for further research and for policymakers to explore the effectiveness and appropriate use of these technologies.

“This is an important first step toward better understanding the future of authentication and how companies are working to keep users safe on the web,” says Alexandru. “Although we cannot confirm for sure, it is a good sign for user safety that these scripts are more likely to appear on login and banking pages. However, their presence also raises important questions about how this data is collected and used.”

Notably, the researchers developed a holistic and novel research framework that combines machine learning, vision-language models, and static analysis techniques. For example, their web crawler significantly outperformed existing tools for login page detection. This can be attributed to LoginGPT’s vision-language models, which handle multilingual websites, complex navigation flows, and modern interactive elements with visual cues that keyword-based crawlers might miss.  

This award-winning research was published in SACMAT '26: Proceedings of the 31st ACM Symposium on Access Control Models and Technologies. The research also formed part of Aswad Tariq’s master’s thesis.