Mouse path geometry

What it measures

The ratio of the total distance the cursor walked between two rest points to the straight-line distance from start to end. A curved path produces a ratio greater than 1; a perfectly straight path produces 1.0.

Hand-driven cursors curve. The ratio is rarely under 1.5 over a real reach across the screen, and often sits at 2–4× the straight-line distance. Scripted cursors — Selenium, Playwright, replay macros — emit point-to-point moves that approach 1.0.

Why it discriminates

A hand reaching for a target on screen is not running an optimal-path solver. It runs a motor program described by Fitts's law: a fast ballistic phase that aims roughly at the target, followed by one or more corrective sub-movements that close the gap, followed by a brief dwell as the hand stabilizes. The corrective sub-movements are the part that curves the path. The arm overshoots or undershoots, the visual system registers the error, the wrist and fingers issue a fresh micro-reach. Repeat until the cursor settles over the button.

Underneath those sub-movements sits a layer of muscle tremor and grip jitter that puts another 1–3 pixels of noise on every recorded sample even when the hand is "still." Trackpad input adds finger-rolling drift across the surface; mouse input adds the wrist's natural pendulum. Both produce a continuous record of small, non-straight motion — the literal signature of a motor system holding a tool.

A script has none of this. Selenium move_to_element issues a single coordinate update. Playwright's page.mouse.move with a high steps value can interpolate, but the interpolation is linear — every intermediate sample lies on the line between start and end. The cursor arrives at the target with zero overshoot, zero dwell, no correction. The walked distance equals the straight-line distance to within rounding error.

This is the physical asymmetry the signal exploits. Human motor control IS curvature; scripted control is, by default, a line. A determined adversary can synthesize curvature — see limitations — but the default behavior of every off-the-shelf automation library produces straight-line paths, because that's the cheapest thing to compute.

Research history

The motor-control foundation predates the field. Paul Fitts published "The information capacity of the human motor system" in 1954, establishing the log-time-distance relationship that still governs how target-acquisition is modeled. The corrective-sub-movement model — that a reach is not one ballistic shot but a ballistic phase plus visual feedback loops — was sharpened by Crossman and Goodeve in 1963 and remains the standard textbook account.

Mouse dynamics as a behavioral biometric is younger. Pusara and Brodley, at Purdue, published the first paper to treat cursor movement as an authentication signal in 2004 ("User Re-Authentication via Mouse Movements," ACM VizSec). Gamboa and Fred, at IST Lisbon, published a parallel approach in 2004 framed as continuous identity verification. Ahmed and Traore at Victoria followed in 2007 with a longer feature catalog and the first IEEE Transactions paper on mouse dynamics, formalizing the metrics that downstream work built on.

The 2010s saw a wave of papers refining the technique. Zheng, Paloski, and Wang (ACM CCS 2011) demonstrated that continuous mouse-based authentication could be operationally efficient. Feher and collaborators at Ben-Gurion (Information Sciences, 2012) ran a larger user study. Mondal and Bours (BIOSIG 2013) brought the continuous-authentication framing into mainstream biometrics venues. Antal and Egyed-Zsigmond (IET Biometrics, 2019) demonstrated intrusion-detection applications.

The field today sits between "well-replicated technique" and "fully solved problem." Mouse dynamics is used in production fraud-detection systems at large e-commerce and banking platforms — the signal works. It is younger and less universally adopted than keystroke dynamics. The open questions are about sampling rate sensitivity, cross-device transfer (trackpad vs. mouse vs. touch), and adversarial robustness against scripted curvature injection.

Key papers

• Fitts, P. M. (1954). "The information capacity of the human motor system in controlling the amplitude of movement." Journal of Experimental Psychology, 47(6), 381–391.
• Crossman, E. R. F. W., & Goodeve, P. J. (1963 / repub. 1983). "Feedback control of hand-movement and Fitts' Law." Quarterly Journal of Experimental Psychology, 35A, 251–278.
• Pusara, M., & Brodley, C. E. (2004). "User Re-Authentication via Mouse Movements." Proceedings of the ACM Workshop on Visualization and Data Mining for Computer Security (VizSec/DMSec).
• Gamboa, H., & Fred, A. (2004). "A behavioral biometric system based on human-computer interaction." Proceedings of SPIE 5404, Biometric Technology for Human Identification.
• Ahmed, A. A. E., & Traore, I. (2007). "A New Biometric Technology Based on Mouse Dynamics." IEEE Transactions on Dependable and Secure Computing, 4(3), 165–179.
• Zheng, N., Paloski, A., & Wang, H. (2011). "An Efficient User Verification System via Mouse Movements." Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS), 139–150.
• Feher, C., Elovici, Y., Moskovitch, R., Rokach, L., & Schclar, A. (2012). "User identity verification via mouse dynamics." Information Sciences, 201, 19–36.
• Mondal, S., & Bours, P. (2013). "Continuous Authentication using Mouse Dynamics." Proceedings of BIOSIG, 1–12.
• Antal, M., & Egyed-Zsigmond, E. (2019). "Intrusion detection using mouse dynamics." IET Biometrics, 8(5), 285–294.

The full bibliography across signals lives at Methodology → References.

Confidence level

Emerging

Mouse dynamics has a 20-year research track and is used in production fraud-detection systems at large e-commerce and banking platforms. The basic claim — that hand-driven cursors curve and scripted ones don't — is well-replicated and not in serious dispute.

It is less mature than keystroke dynamics, which has 40+ years of literature and broader operational deployment. The mouse-dynamics field has more variance in reported error rates because experimental setups differ more — task type, device type, sampling rate, and feature catalog all move the numbers.

Sampling rate is the load-bearing variable. Published studies typically sample at 60–125 Hz, matching browser mousemove event rates. Red Stet samples at roughly 60 Hz — within the lower band of that range. At 60 Hz the system resolves macroscopic curve geometry (was the path bent, or was it a line?) and traces fine-grained motion across rapid swipes, while leaving the highest-frequency biometric signatures (physiological micro-tremor, which needs finer temporal resolution than 16 ms samples provide) to the 125+ Hz systems.

The Red Stet implementation makes a calibrated claim against the published literature: enough rate to track real human curves but with conservative weight in the composite.

Known limitations

The signal has real failure modes. The defender reading this should know them.

Input device shifts the distribution

Trackpad paths and mouse paths are both curved — both are human — but their statistical distributions differ. Trackpad curves are tighter and more frequent; mouse curves are longer and more pendulum-shaped. The signal does not yet condition on device, so a writer who switches mid-session looks slightly different from one who doesn't.

Touch input produces no curves at all

A writer composing on a tablet or phone taps endpoints; there is no continuous cursor traversal between them. The analyzer excludes touch-drag samples from the path-complexity input (finger scrolling is not cursor traversal), so a touch-only session returns "no mouse activity" and the score falls back to a neutral 60. Touch composition is hand-driven work that this particular signal cannot see — the verifier's other signals (cadence, correction rate, paste patterns) carry the weight. Pen/stylus samples are included: a stylus is a hand-driven pointer.

Sampling rate caps what is measurable

Red Stet's roughly 60 Hz sampling resolves macroscopic path complexity and traces individual swipes accurately, but cannot capture the high-frequency micro-tremor that 125+ Hz biometric systems use. An adversary who shows up with a smooth, slow, broad arc may defeat the macroscopic check while the microscopic signatures that would expose them sit below the 60 Hz recorder's resolution.

Adversaries can inject fake jitter

A determined script can pre-compute a curved path with synthetic noise and replay it. Off-the-shelf automation libraries do not do this by default — straight lines are cheaper to compute — but the technique is documented in the bot-defense literature and is a known countermeasure against mouse-dynamics scoring. The signal raises the cost of automation; it does not stop a custom adversary.

Accessibility tools produce non-curved human paths

Head-tracking cursors, switch-input devices, and eye-gaze controllers move in patterns that look automation-like — direct, low-curvature, sometimes snap-to-target. The user is human; the path looks scripted. The signal alone would mis-flag this user; the composite reduces the harm by weighting the path-complexity score at 0.10 and combining with six other signals.

Stylus-on-tablet input has its own profile

A writer using a stylus on a Wacom or iPad with a pen produces paths that curve differently from either mouse or trackpad — palm pivot dominates over wrist pivot, and the curve frequencies shift. The Red Stet baseline corpus does not yet cover stylus extensively.

Short sessions don't accumulate enough samples

The implementation requires at least 8 valid points across segments where the straight-line distance is ≥20 px before it returns a usable ratio. A writing session under a minute of mouse activity won't clear that bar; the signal returns "not enough mouse activity" and the score falls back to neutral.

How Red Stet uses it computeCurComplexity

The recorder emits a cur event at roughly 60 Hz carrying the cursor's {x, y, t}. The verifier walks consecutive events, splits on any gap greater than 5 seconds — that gap marks "cursor parked, reappeared elsewhere" and shouldn't fold into one path — and computes, per segment, the total walked distance and the straight-line distance from the segment's first sample to its last.

Segments with a straight-line distance under 20 px are discarded. Below that threshold the ratio explodes from sub-pixel jitter and tells the verifier nothing about path shape. If fewer than 8 valid points survive across all segments, the function returns usable: false and the score falls back to a neutral 60.

When the function returns a usable ratio, the score is computed by linear map: ratio 1.0 (machine-like, perfectly straight) anchors at 0, ratio 4.0 (clearly hand-driven) anchors at 100, and intermediate ratios scale between. The score enters the composite at weight 0.10, alongside keystroke cadence (0.22), backspace rate (0.20), paste ratio (0.15), paste source (0.12), click-position snap (0.10), and thinking pauses (0.11).

One display honesty note: this signal currently contributes to the composite without a per-moment evidence surface. The verifier's moments timeline does not yet emit cursor-trajectory moments for live recordings — a sliding-window trajectory classifier is the planned next step — and the per-signal detail rows were replaced by the moments-first layout. So a reviewer sees mouse geometry's effect in the composite number but cannot yet click into a specific cursor path the way they can click into a paste or a cadence run. Until the trajectory moments ship, treat the mouse contribution as a session-level summary rather than inspectable evidence.

The 10% composite weight stays conservative even at 60 Hz. Mouse dynamics has more reported variance across published studies than keystroke dynamics; the weight reflects that.