Behavioral Drift & Liveness Detection

Relevant source files

The following files were used as context for generating this wiki page:

• hooks/use-drift-detection.ts
• backend/routes/drift.py
• lib/drift-detection-service.ts
• RISK_ADJUSTMENT_GUIDE.md
• TESTING_CHECKLIST.md

Introduction

Behavioral Drift and Liveness Detection is a sophisticated security layer within the BankChase platform designed to distinguish between legitimate user behavioral changes and potential fraudulent activity. By utilizing statistical methods such as Exponential Weighted Moving Average (EWMA) and CUSUM-style deviation scoring, the system tracks a smoothed baseline of user signals to identify gradual habit shifts versus sudden mean shifts that suggest unauthorized access.

Sources: RISK_ADJUSTMENT_GUIDE.md:5-10, TESTING_CHECKLIST.md:75-80

The system integrates biometric validation and video-based liveness detection to verify the physical presence of the user during high-drift events. This multi-signal risk fusion approach combines voice match confidence, liveness scores, and behavioral drift results to determine the overall risk level and recommend appropriate authentication challenges.

Sources: RISK_ADJUSTMENT_GUIDE.md:32-40, TESTING_CHECKLIST.md:81-83

System Architecture & Data Flow

Detection Logic Flow

The system processes raw behavioral features and biometric signals through a hybrid detection service to produce a risk assessment.

This diagram represents the high-level flow from signal extraction to the final authentication decision.
Sources: RISK_ADJUSTMENT_GUIDE.md:14-25, RISK_ADJUSTMENT_GUIDE.md:46-52

Hybrid Detection Service

The DriftDetectionService employs three distinct algorithmic approaches to ensure robust detection:

1. EMA-based Detection: Monitors a smoothed baseline for every signal to account for gradual evolution.
2. CUSUM Statistical Control: Specialized in detecting sudden shifts in the mean of behavioral data.
3. Distance-based Detection: Uses a Mahalanobis-like distance to evaluate changes across multiple signals simultaneously.

Sources: RISK_ADJUSTMENT_GUIDE.md:14-22, lib/drift-detection-service.ts

Risk Adjustment & Decisioning

Multi-Signal Risk Fusion

The computeOverallRisk function aggregates various security signals using a weighted model to generate a final risk score (0-1).

Signal	Weight	Description
Behavioral Drift	35%	Most critical signal; tracks habit deviations.
Voice Match	25%	Biometric confidence score.
Liveness Score	25%	Verification of physical presence via video.
Fraud History	15%	Historical risk profile of the user.

Sources: RISK_ADJUSTMENT_GUIDE.md:32-44

Authentication Decisions

Risk scores are mapped to specific actions to balance security and user experience.

Thresholds and corresponding authentication decisions used by the getAuthDecision function.
Sources: RISK_ADJUSTMENT_GUIDE.md:46-56

Implementation Details

API Integration

The system exposes endpoints for real-time drift detection and baseline management. The detection endpoint evaluates features against the stored baseline.

Endpoint: POST /api/drift/detect

{
  "user_id": "uuid",
  "features": {
    "avg_pause_duration": 0.52,
    "pitch_variation": 0.18,
    "tempo_wpm": 145
  },
  "confidence": 0.92
}

Sources: RISK_ADJUSTMENT_GUIDE.md:118-132, backend/routes/drift.py

Adaptive Learning vs. Escalation

The system distinguishes between legitimate drift (e.g., aging or habit change) and suspicious patterns through "Adaptive Learning."

• Legitimate Drift: Triggered by high-confidence matches (>0.85). It results in an increased update_alpha to faster re-baseline the user's data.
• Suspicious Drift: Triggered by sudden changes or multiple consecutive events (threshold $\ge 3$). This boosts the risk multiplier and flags the session for manual review.

Sources: RISK_ADJUSTMENT_GUIDE.md:85-98

Configuration Parameters

The behavior of the detection engine is controlled via the DEFAULT_CONFIG structure.

Parameter	Default	Effect of Tuning
drift_score_threshold	0.7	Initial trigger for detection logic.
max_drift_threshold	0.75	Lowering increases strictness and escalations.
consecutive_drift_escalation	3	Number of drift sessions before mandatory escalation.
risk_boost_multiplier	1.25	Magnitude of risk increase per suspicious event.

Sources: RISK_ADJUSTMENT_GUIDE.md:100-116

Summary

Behavioral Drift and Liveness Detection provides a dynamic security perimeter by continuously evaluating user interactions against historical baselines. By combining statistical drift analysis with physical liveness checks, the system effectively mitigates fraud while allowing for natural user evolution through adaptive learning mechanisms.

Sources: RISK_ADJUSTMENT_GUIDE.md:5-12, RISK_ADJUSTMENT_GUIDE.md:215-220