Abstract
Static, one-time authentication mechanisms such as passwords and PINs are increasingly inadequate for protecting mobile devices throughout an active session. Behavioral biometric continuous authentication (BBCA) addresses this gap by passively monitoring user-specific interaction patterns—keystroke dynamics, touch and swipe gestures, gait, and motion—to verify identity on an ongoing basis. This systematic review synthesizes 80 studies selected via a PRISMA-compliant protocol from IEEE Xplore, ACM Digital Library, Scopus, ScienceDirect, Web of Science, and SpringerLink (2017–2025). We examine behavioral and multimodal biometric modalities, machine learning approaches ranging from classical classifiers to deep sequence and transformer architectures, and their integration with intelligent personal agents, wearable devices, and IoT/edge infrastructures. Security analyses cover spoofing, adversarial and generative attacks, mimicry, and model-level threats including membership inference and reconstruction. Privacy-preserving mechanisms—cancelable biometrics, Bloom filter encodings, zero-knowledge proof protocols, federated learning, and blockchain-based identity management—are evaluated against practical trade-offs in energy consumption and latency on resource-constrained devices. Key research gaps are identified: the absence of standardized adversarial benchmarks, lack of end-to-end pipeline evaluations under simultaneous adversarial and privacy threat models, and limited user-centered studies on consent and acceptance of privacy-preserving mechanisms under frameworks such as GDPR. Recommended future directions combine adaptive multimodal fusion, privacy-preserving cryptography, energy-aware modality selection, and interdisciplinary human-centered evaluation to advance practical, resilient continuous authentication for mobile and assistant-enriched environments.