PaperlayerView exact revision on arXiv

Source-linked AI summary

BEACON: A Multimodal Dataset for Learning Behavioral Fingerprints from Gameplay Data

Ishpuneet Singh, Gursmeep Kaur, Uday Pratap Singh Atwal, Guramrit Singh, Gurjot Singh, Maninder Singh

arXiv:2605.10867v2cs.CRcs.AIcs.CVcs.LGcs.NI

TL;DR

Continuous authentication needs fine-grained behavioral data collected under realistic cognitive and motor demands, but existing benchmarks are often small, unimodal, or poorly synchronized. BEACON addresses this gap with a large multimodal Valorant gameplay dataset and baseline evaluations, achieving 70.82% identification accuracy with 4.31% EER using 60-second mouse-and-keyboard fusion.

  • Problem

    Point-of-entry authentication leaves post-login sessions vulnerable, motivating seamless continuous authentication for interactive digital environments.

  • Method

    BEACON synchronizes multimodal telemetry from competitive Valorant gameplay across diverse players and evaluates mouse, keyboard, and combined inputs for user identification.

  • Results

    70.82% identification accuracy with 4.31% EER was achieved by Var-CNN using 60-second mouse-and-keyboard fusion.

  • Takeaways & Limitations

    Mouse-derived motor signatures were the most discriminative unimodal feature, while early fusion of complementary modalities further improved identification.

  • Takeaways & Limitations

    BEACON captures behavioral signatures at a single point in time, so longitudinal collection is needed to model behavioral drift.

Abstract

from arXiv · show

Continuous authentication in high-stakes digital environments requires datasets with fine-grained behavioral signals under realistic cognitive and motor demands. But current benchmarks are often limited by small scale, unimodal sensing or lack of synchronised environmental context. To address this gap, this paper introduces BEACON (Behavioral Engine for Authentication & Continuous Monitoring), a large-scale multimodal dataset that captures diverse skill tiers in competitive Valorant gameplay. BEACON contains approximately 430 GB of synchronised modality data (461 GB total on-disk including auxiliary Valorant configuration captures) from 79 sessions across 28 distinct players, estimated at 102.51 hours of active gameplay, including high-frequency mouse dynamics, keystroke events, network packet captures, screen recordings, hardware metadata, and in-game configuration context. BEACON leverages the high precision motor skills and high cognitive load that are inherent to tactical shooters, making it a rigorous stress test for the robustness of behavioral biometrics. The dataset allows for the study of continuous authentication, behavioral profiling, user drift and multimodal representation learning in a high-fidelity esports setting. The authors release the dataset and code on Hugging Face and GitHub to create a reproducible benchmark for evaluating next-generation behavioral fingerprinting and security models.

1 Introduction and Related Work

BEACON addresses the need for seamless, non-intrusive security in high-engagement digital environments by introducing a large-scale multimodal behavioral dataset for authentication and profiling. It captures synchronized gameplay signals from real competitive sessions and is publicly released to support machine-learning and cybersecurity research.

  • Motivation: Interactive digital platforms expand the human-computer-interaction threat surface, making strong, seamless, and non-intrusive security solutions essential.The passage highlights competitive esports, real-money gaming, and persistent online environments as increasingly important high-engagement settings.
  • Contribution: BEACON introduces a large-scale multimodal dataset designed to bridge gaps in existing behavioral-authentication research.BEACON is presented as the Behavioral Engine for Authentication & Continuous Monitoring and as a foundational cybersecurity asset.
  • Related work and scope: BEACON covers mouse, key, network, and game modalities for authentication and profiling at event- and packet-level granularity.The dataset includes timestamped X/Y coordinates, clicks, key timings, raw network packets, and raw video frames, with CSV, PCAP, and MP4 formats.
  • Dataset scale: 461 GB total on-disk data spans 79 real-world sessions and 28 distinct players, including auxiliary Valorant configuration captures.The synchronized modality data itself comprises approximately 430 GB.
  • Collected signals: Over 90 million mouse events, approximately 498,000 keystrokes, and over 114 million network packets were collected during live competitive gameplay.A custom-built, low-latency logging architecture safely captured these behavioral and network signals.
  • Availability: The dataset is released on Hugging Face to equip machine-learning and cybersecurity research with a reproducible behavioral-data resource.The passage explicitly identifies the Hugging Face release and frames BEACON as intended to support subsequent research.

2 The BEACON Architecture and Data Collection

BEACON uses a nonintrusive standalone logger to collect synchronized multimodal Valorant gameplay telemetry under controlled and home-based conditions. Its architecture combines static environmental capture, concurrent dynamic monitoring, absolute timestamps, and scalable upload handling.

  • Design objectives and setting: BEACON records multimodal gameplay telemetry without degrading frame rate, interrupting players, or interfering with normal game execution.Valorant was selected for its fast pace, competitive pressure, and split-second decision demands; most participants were recorded in a controlled lab, while others contributed from home.
  • Logger architecture: The standalone BEACON logger runs alongside gameplay and creates a dedicated, time-stamped data_[timestamp] output directory.The workflow begins with consent and dependency checks, then captures static hardware and environmental context before gameplay monitoring starts.
  • Dynamic telemetry: Four concurrent monitoring threads capture keyboard events, mouse dynamics, raw network traffic, and screen data without blocking the main game loop.Keyboard records press/release timing, dwell times, and inter-key latencies; mouse captures trajectories, clicks, scrolling, speed, and acceleration; network packets support temporal alignment with server-side activity.
  • Cross-modality temporal alignment: All recorded events use host POSIX time, enabling post-hoc alignment of mouse, keyboard, packet-capture, and screen-recording timelines without explicit synchronization markers.The shared Unix-epoch clock provides a single temporal reference across heterogeneous modalities.
  • Data transfer and validation: The upload pipeline uses client-side caching, chunked HTTPS transmission, API-gateway ingestion, and server-side validation for multi-gigabyte session artifacts.Chunked transfer addresses browser limits affecting large files such as video and PCAP data.

3 Dataset Characteristics and Exploratory Data Analysis

BEACON combines large-scale synchronized gameplay telemetry with exploratory analyses showing extreme modality-density imbalance and distinct, separable player behavior across sensorimotor signals. Its session files include documented recording irregularities that affect modality counts.

  • Dataset scale: 430 GB of synchronized data, 461 GB total on-disk, spans 79 Valorant sessions, 28 participants, and approximately 102.51 hours of active gameplay.The collection includes over 90 million sensorimotor events and over 114 million network packets.
  • Collection caveats: Screen recordings are absent in 7 sessions, while split-part recordings and one duplicated-timestamp folder produce 74 video files and 80 files for several other modalities.The deviations arise from intentionally disabled pilot capture, capture-utility failures, split recordings, and duplicated recording timestamps.
  • Modality characteristics: Mouse telemetry exceeds keystroke dynamics by two orders of magnitude because continuous camera movement and crosshair adjustments are polled more frequently than tactical key presses.This distribution reflects the motor demands and interaction structure of first-person-shooter gameplay.
  • Exploratory patterns: Keyboard interactions concentrate around W-A-S-D, SHIFT, and SPACE, while mouse-switch usage varies across players with roles and physical habits.The heatmaps indicate both game-structure-driven regularities and player-dependent interaction patterns.
  • Exploratory patterns: Distinct horizontal bands in cross-modality Z-score heatmaps show that players maintain highly individualised behavioral profiles across features such as mouse speed and key press rate.These patterns support the dataset’s use for behavioral profiling and continuous authentication.
  • Authentication viability: Comparing user P002 with all other players reveals profound separability across multiple sensorimotor dimensions, consistent with high inter-user and low intra-user variance.This separability is identified as a critical requirement for continuous authentication.

4 Results

BEACON’s baseline evaluates six Website Fingerprinting architectures on a 28-class identification task using mouse and keyboard telemetry, while excluding PCAP and screen recordings. Var-CNN achieved the strongest reported result in 60-second fusion, whereas ARES failed to converge.

  • Baseline setup: The baseline transformed asynchronous telemetry into a 28-class identification task evaluated with six state-of-the-art Website Fingerprinting architectures.The evaluated models were ARES, BAPM, NetCLR, TCN, TMWF, and Var-CNN.
  • Baseline setup: The evaluation used 80% of the data for validation and 20% as a held-out final test set.
  • Baseline setup: PCAP and screen recordings were excluded from the baselines, which focused on mouse and keyboard separability rather than exhaustive multimodal benchmarking.Network- and video-based identification were left as open directions.
  • Identification results: 70.82% accuracy with a 4.31% EER was the best result, achieved by Var-CNN through early fusion of both modalities in the 60-second setup.This was the global maximum identification accuracy reported across configurations.
  • Identification results: 0.00% accuracy was obtained by ARES across all configurations because the architecture failed to converge.

5 Discussion

The discussion identifies information density as the fundamental driver of biometric separability in BEACON. Continuous sensorimotor signals show strong discriminability, while transactional network data require structural adaptation to represent their multidimensional variance.

  • Information density and separability: Information density is identified as the fundamental driver of biometric separability in high-fidelity behavioral modelling.The discussion frames this as a primary finding from experiments on BEACON.
  • Information density and separability: Mouse inputs show a pronounced performance advantage over keyboard inputs, with cursor trajectories, velocity profiles, and acceleration derivatives providing dense continuous signals.The passage attributes the modality difference to the higher frequency and information density of mouse dynamics.
  • Information density and separability: P002’s sensorimotor features occupy tight operational boundaries relative to global dataset variance, consistent with strong biometric discriminability.Figure 5 presents this as an inter-user separability analysis.
  • Modality representation: Encrypted network traffic requires substantial structural re-engineering to represent the overlapping, multidimensional variance of continuous human sensorimotor output.The passage contrasts transactional, bursty network timing with dense and continuous behavioral signals.

6 Limitations

BEACON is a depth-focused FPS biometrics dataset rather than a population-scale authentication benchmark. Its current release does not exhaustively benchmark all modalities and captures behavioral signatures at only one point in time, limiting longitudinal drift modeling.

  • Dataset scope: 28 participants make BEACON a depth-focused FPS biometrics dataset rather than a population-scale authentication benchmark.The cohort is positioned for detailed behavioral biometric study, not population-scale authentication evaluation.
  • Benchmarking scope: Exhaustive multimodal benchmarking is outside the scope of this initial dataset release and remains an open direction for the community.The released modalities are intentionally not benchmarked exhaustively in the paper.
  • Temporal coverage: Longitudinal collection over months or years is required to model behavioral drift as users gain skill or undergo physical changes.The dataset captures signatures at a single point in time.

7 Conclusion

BEACON introduces a large-scale, synchronized multimodal esports telemetry dataset for advancing behavioral biometrics. Its scale and high-fidelity gameplay context provide a platform for evaluating continuous authentication under extreme cognitive load.

  • Dataset contribution: BEACON is a novel large-scale multimodal dataset designed to advance behavioral biometrics through high-fidelity esports telemetry.The study introduces the dataset as its central contribution.
  • Dataset scale: 430 GB of synchronized modality telemetry spans 79 real-world sessions and 28 distinct players.The total on-disk size is 461 GB including the stated telemetry and other stored data.
  • Authentication evaluation: BEACON provides a rigorous platform for evaluating continuous authentication under extreme cognitive load.This evaluation setting is enabled by synchronized telemetry collected from real-world esports sessions.

8 Future Scope · A Ethics Statement

Future work targets adversarial robustness, improved feature and temporal modeling, and multimodal fusion. The ethics statement emphasizes informed consent, anonymization, sensitive-content safeguards, dual-use restrictions, and compliance with game-platform terms.

  • 8 Future Scope: Future work will characterize vulnerability to mimicry attacks and AI-driven bots that emulate target aim-path curvature, while developing liveness detection for human-versus-synthetic interactions.The proposed direction focuses on distinguishing authentic human behavior from replicas.
  • 8 Future Scope: Future work will also explore expanded feature engineering and sliding-window architectures with varying overlap ratios to improve baseline performance.These changes are proposed as direct avenues for further baseline improvement.
  • A Ethics Statement: Participants were adults who gave informed written consent before each session, including explicit acknowledgment that mouse, keyboard, network, screen, and hardware telemetry would be captured.Data collection followed the host institution’s human-subjects research guidelines, and the released dataset is anonymized through a modality-specific pipeline.
  • A Ethics Statement: Screen recordings may incidentally capture personal content, but participants could request termination and deletion, while release-side video processing masks sensitive surfaces and identifying in-game elements.Examples include desktop notifications, taskbar items, and browser tabs visible during alt-tabs; no webcam or microphone data are included.
  • A Ethics Statement: BEACON supports defensive research such as continuous authentication, anti-cheat, and bot or mimicry detection, while discouraging covert profiling, cross-service re-identification, and uninformed worker monitoring.The statement identifies behavioral biometrics as inherently dual-use because the same signals can enable tracking and surveillance.
  • A Ethics Statement: BEACON contains Valorant-derived gameplay artefacts without proprietary assets, decrypted protocol data, or anti-cheat internals, and researchers must independently verify Riot Games’ terms compliance.Compliance depends on each researcher’s specific use case.

B Extended Data Pipeline and Secure Ingestion Details … D Feature Engineering Dictionary

BEACON combines a four-stage secure ingestion pipeline with multimodal exploratory analysis showing substantial inter-user variation in keyboard, mouse, and network behaviors. The paper also defines 33 engineered mouse and keyboard features for machine-learning baselines.

  • B Extended Data Pipeline and Secure Ingestion Details: The data pipeline comprises client-side collection, local buffering, upload-portal processing, and server-side validation and storage.This architecture was designed to manage BEACON’s massive multimodal data scale.
  • B Extended Data Pipeline and Secure Ingestion Details: Sessions are recorded locally, then uploaded through a custom portal using chunked transfers that preserve folder paths and HTTPS/TLS security.The protocol targets gigabyte-scale artifacts such as .mp4 and .pcap files.
  • C Extended EDA: Statistical Distributions of Modalities: Across 28 participants, sensorimotor and system-feature distributions were analyzed to assess low intra-user variance and high inter-user variance for continuous authentication.These variance patterns provide the statistical foundation for behavioral-biometric profiling.
  • C.1 Keyboard Dynamics Distribution: Keyboard features distinguish physiological dexterity and tactical pacing: dwell_mean_ms medians range from about 50–100 ms to above 200 ms, while keys_per_min and wasd_ratio remain individually tight.The analyzed keyboard features also include ability_key_ratio.
  • C.2 Mouse Telemetry Distribution: Mouse telemetry captures individualized aiming mechanics through event_rate_hz and speed_mean, alongside action frequencies represented by clicks_per_min and scrolls_per_min.Divergent median speeds indicate distinct physical aiming and hardware-related signatures across participants.
  • C.3 Network Telemetry Distribution: Network telemetry links physical intent to system execution: outbound packet density reflects behavioral throughput, while inter-arrival timing contributes environmental fingerprinting.High-APM players generate denser UDP bursts than passive players holding strategic angles.
  • D Feature Engineering Dictionary: 33 statistical features were engineered across mouse and keyboard modalities to structure asynchronous raw telemetry within temporal windows for machine-learning baselines.Table 3 documents the naming convention and description of each extracted feature.

E Definition of Evaluation Metrics

BEACON evaluation uses four standard metrics to characterize model reliability, sensitivity, discrimination, and error distribution. These include EER, d-prime, ROC AUC, and closed-world identification accuracy.

  • Equal Error Rate (EER): EER is the threshold where FAR and FRR are equal; lower EER indicates less overlap between legitimate-player and imposter behavioral distributions.It is presented as the most critical metric for biometric security systems.
  • d-prime (d′): d-prime (d′) measures the standardized distance between genuine-user and imposter distributions using the difference between hit-rate and false-alarm Z-scores.Higher d′ indicates a stronger behavioral signal relative to background noise.
  • ROC AUC: ROC AUC summarizes class discrimination across all thresholds, with 1.0 denoting a perfect classifier and 0.5 indicating random-chance performance.It provides a single-figure measure of receiver-operating-characteristic performance.
  • Accuracy (%): Accuracy (%) is the percentage of 10s–60s temporal windows in which the closed-world identification task correctly identifies the player among 28 participants.This metric measures specific-player identification across the available participants.

F Baseline Evaluation Metrics: Detailed Results · G Baseline Evaluation Performance Curves · G.1 Unimodal Mouse Dynamics

The baseline evaluation reports complete 28-class identification results across architectures, temporal windows, and modalities, while performance curves examine biometric separability across 10s, 30s, 45s, and 60s windows. Unimodal mouse dynamics perform strongly even at short observation durations, supported by high-frequency cursor telemetry and individualized movement patterns.

  • F Baseline Evaluation Metrics: Detailed Results: Table 4 reports quantitative results for the 28-class user identification task across all evaluated architectures, temporal windows, and modalities.The table provides the complete baseline metric results for the identification benchmark.
  • G Baseline Evaluation Performance Curves: The performance-curve appendix analyzes six evaluated Website Fingerprinting architectures and visualizes the trade-offs among 10s, 30s, 45s, and 60s observation windows.The analysis connects temporal observation length with resulting biometric separability.
  • G.1 Unimodal Mouse Dynamics: Mouse telemetry provides a continuous, high-fidelity sensorimotor stream that produces significantly higher identification benchmarks.The result is attributed to the richness and continuity of mouse-derived behavioral signals.
  • G.1 Unimodal Mouse Dynamics: Even at 10s resolution, mouse dynamics achieve identification accuracies exceeding 50%.Figure 10 highlights rapid convergence between Var-CNN and NetCLR at this short observation duration.
  • G.1 Unimodal Mouse Dynamics: The >500Hz cursor polling rate supplies sufficient samples to model aim-path curvature and acceleration profiles.These traits are described as highly individualized in high-skill FPS environments, explaining the strong short-window identification performance.

G.2 Unimodal Keyboard Dynamics … NeurIPS Paper Checklist

BEACON shows that keyboard-only identification is difficult at short observation windows, while mouse–keyboard fusion improves separability. The datasheet documents the dataset’s composition, collection, preprocessing, uses, release safeguards, maintenance, and reproducibility and ethics disclosures.

  • G.2 Unimodal Keyboard Dynamics: Keyboard dynamics are the most challenging modality, with identification accuracy below 40% because sparse tactical-bind events create feature-poor short windows.Longer 60s windows capture idiosyncratic typing rhythms, including dwell times and inter-key intervals.
  • G.3 Multi-modal Early Fusion (Combined): Mouse–keyboard fusion provides the dataset’s upper bound of biometric separability, reducing EER to 4.31% at 60s as keyboard ratios stabilize mouse-based distinctiveness.The ARES model failed across all evaluated pages with the engineered feature vectors.
  • H Datasheet for the BEACON Dataset; H.1 Motivation; H.6 Uses: BEACON is a synchronised multimodal Valorant dataset released for passive continuous behavioral authentication and related behavioral-biometric research.Its intended applications include profiling, drift analysis, multimodal fusion, mimicry and bot detection, FPS performance modeling, and gameplay-aware network analysis.
  • H.2 Composition: 79 sessions from 28 participants contain canonical screen, network, mouse, keyboard, and hardware artefacts, with documented missing recordings, split videos, and timestamp irregularities.Sessions per participant range from 1 to 19, with a mean of approximately 2.8; seven sessions lack screen recordings and two yielded split-part videos.
  • H.3 Collection Process; H.4 Hardware Configurations: Data were collected with concurrent keyboard, mouse, packet, and 25-fps screen monitors, plus a hardware snapshot at session start, during unconstrained laboratory or home gameplay sessions with informed consent.Most sessions used two standardized laboratory configurations, while a minority used participants’ home machines; mouse DPI, polling rate, and sensitivity were not centrally captured.
  • H.5 Preprocessing, Cleaning, and Labelling: Preprocessing applies documented conservative filters, excluding mouse speeds outside [0, 12,000] px/s and keystroke dwell durations outside [0, 5,000] ms from feature computation.Published analyses use whole-session CSV files and derived feature-summary tables.
  • H.6 Uses; H.7 Distribution: The dataset’s single-institution cohort, shared-lab emphasis, narrow age range, skewed gender distribution, and unmodelled patch drift constrain generalization and prohibit unqualified real-world re-identification.The public release anonymizes participant identities and scrubs machine-level identifiers; raw PCAPs and unredacted hardware data are not redistributed.
  • H.8 Maintenance; NeurIPS Paper Checklist: The paper reports no theoretical results, specifies experimental settings and compute resources, releases data and logger code, documents consent and anonymization, acknowledges dual-use risks, and states that LLMs assisted only manuscript writing.Experiments used fixed chronological splits and deterministic runs without error bars; the checklist also notes that no monetary compensation was provided and future releases will preserve versioned snapshots and support withdrawal.
Loading 2605.10867v2…