ZeroTrustX

Behavioral biometrics and AI-driven zero-trust access control that verifies identity beyond passwords — stopping breaches at the door.

Comment

Inspiration

Every 39 seconds, a cyberattack occurs somewhere in the world. In 2025 alone, over 3,000 data breaches exposed more than 30 billion records — and 81% of them involved weak or stolen passwords. We were inspired by a real incident: a friend's startup lost $50,000 because an attacker used a stolen password to access their AWS console. Traditional MFA wasn't enough — the breach happened after authentication.

We asked ourselves: "What if identity verification didn't stop at the login screen?" What if the system continuously verified who you are based on how you behave — your typing rhythm, mouse movements, and device fingerprint — not just what you know?

That's how ZeroTrustX was born: a Zero-Trust Access Control platform that uses behavioral biometrics and AI to verify identity continuously, stopping breaches even when credentials are compromised.

What it does

ZeroTrustX is a real-time, AI-powered zero-trust security platform that goes beyond traditional passwords and OTPs. Here's what it delivers:

🔐 Core Features

Feature Description
Behavioral Biometrics Analyzes typing dynamics (keystroke latency, rhythm) and mouse movement patterns to create a unique user behavioral profile.
Continuous Authentication Instead of one-time login, the system verifies identity throughout the session. If behavior deviates, access is instantly restricted.
Device Fingerprinting Generates a unique fingerprint for each device (browser, OS, screen resolution, fonts, timezone) to detect unauthorized devices.
AI Risk Scoring Engine Real-time ML model assigns a risk score (0-100) to every action. Scores above 75 trigger automatic step-up authentication or session termination.
Zero-Trust Dashboard Admin panel showing live user sessions, risk scores, anomaly alerts, and access logs with geographic visualization.
Adaptive MFA Smart multi-factor authentication that only triggers when risk scores exceed thresholds — reducing friction for legitimate users.

🎯 Use Case Example

An employee logs in from their laptop at 9 AM. ZeroTrustX learns their typing speed (65 WPM, 120ms average key delay) and mouse patterns. At 2 PM, an attacker uses stolen credentials from a different device. Even with the correct password, the system detects:

  • Different typing rhythm (risk +30)
  • New device fingerprint (risk +25)
  • Unusual mouse behavior (risk +20)

Total risk score: 85 → Session blocked instantly, admin alerted.

How we built it

We architected ZeroTrustX as a microservices-based platform optimized for real-time processing during the 24-hour hackathon.

🏗️ Architecture

┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐ │ React Frontend │────▶│ Node.js API │────▶│ MongoDB Atlas │ │ (Admin Dashboard│ │ (Express + JWT) │ │ (User Profiles │ │ + Client SDK) │ │ │ │ + Event Logs) │ └─────────────────┘ └──────────────────┘ └─────────────────┘ │ │ ▼ ▼ ┌─────────────────┐ ┌──────────────────┐ │ WebSocket Layer │◀────│ Python ML │ │ (Real-time Risk │ │ Microservice │ │ Score Updates) │ │ (FastAPI + │ │ │ │ scikit-learn) │ └─────────────────┘ └──────────────────┘ plain

🛠️ Tech Stack

Layer Technology Purpose
Frontend React.js, Tailwind CSS, Recharts Admin dashboard, real-time risk visualization
Backend API Node.js, Express, JWT Authentication, session management, REST API
ML Engine Python, FastAPI, scikit-learn Behavioral analysis, risk scoring model
Database MongoDB Atlas User profiles, behavioral baselines, audit logs
Real-time Socket.io Live risk score updates to dashboard
Deployment Vercel (Frontend), Render (Backend) 24-hour hackathon-ready deployment

🔬 ML Model Details

We built a Random Forest Classifier trained on behavioral features:

  • Keystroke features: Flight time (key-up to key-down), Dwell time (key-down to key-up), typing speed variance
  • Mouse features: Average velocity, acceleration patterns, click-to-movement ratio
  • Device features: Screen resolution, timezone, browser canvas fingerprint

The model was trained on synthetic data generated to simulate 50+ user profiles with normal vs. anomalous behavior patterns.

Challenges we ran into

⏱️ Time Constraint: Real-time Processing

Processing behavioral data in real-time without lag was critical. Our initial approach sent every keystroke to the server, causing 500ms+ delays. We solved this by implementing client-side buffering — collecting 10 seconds of behavioral data, extracting features locally via a lightweight JavaScript library, then sending compressed feature vectors to the ML microservice.

🧠 Limited Training Data

With only 24 hours, we couldn't collect real user behavioral data. We built a synthetic data generator in Python that simulates realistic typing and mouse patterns with configurable variance, allowing us to train and validate our model with 5,000+ synthetic sessions.

🔗 Cross-Origin & WebSocket Reliability

Socket.io connections dropped intermittently during demo testing. We implemented automatic reconnection with exponential backoff and fallback to HTTP polling, ensuring the admin dashboard always shows live data.

🎨 Balancing Security vs. UX

Aggressive risk scoring blocked legitimate users during testing. We fine-tuned thresholds using a dynamic calibration phase — the first 2 minutes of each session learns the user's baseline without enforcement, then switches to active monitoring.

Accomplishments that we're proud of

🏅 Built a Working Zero-Trust System in 24 Hours

We didn't just build a concept — we built a fully functional prototype with real-time behavioral analysis, risk scoring, and an admin dashboard. During our demo, we simulated an attack live: the system detected anomalous behavior and blocked the session in under 2 seconds.

🤖 Custom ML Model with Synthetic Training Pipeline

We created an end-to-end ML pipeline from data generation to model deployment. Our Random Forest model achieves:

  • 94.3% accuracy on synthetic test data
  • False positive rate: 3.2% (legitimate users rarely blocked)
  • False negative rate: 2.1% (attackers rarely slip through)

📊 Real-time Dashboard with Live Risk Visualization

The admin dashboard updates in real-time via WebSocket, showing:

  • Active sessions with color-coded risk scores (green/yellow/red)
  • Geographic access map
  • Anomaly timeline with detailed reasoning ("Typing rhythm deviation: +25 risk")

🚀 Successfully Deployed End-to-End

Both frontend and backend are live and accessible, with the ML microservice handling concurrent sessions — proving the architecture scales beyond a hackathon prototype.

What we learned

🔍 Technical Insights

  • Behavioral biometrics is powerful but nuanced — small calibration differences drastically affect accuracy. We learned the importance of a "learning phase" before enforcement.
  • Microservices architecture pays off — separating the ML engine from the API layer allowed our frontend and backend teams to work in parallel without blocking each other.
  • Synthetic data can be surprisingly effective — when designed with realistic variance distributions, it enables rapid ML prototyping without waiting weeks for real user data.

🤝 Team Collaboration

  • Divide and conquer, but integrate early — We split into frontend, backend, and ML teams, but held integration checkpoints every 4 hours. This prevented the "last-minute merge nightmare."
  • Demo-driven development — We defined our final demo scenario in Hour 1 and built backward from there. This kept us focused on features that actually impress judges.

🎯 Domain Knowledge

  • We deep-dived into zero-trust architecture principles (NIST 800-207) and learned that true zero-trust isn't a product — it's a philosophy of "never trust, always verify." ZeroTrustX embodies this by verifying identity continuously, not just at the perimeter.

What's next for ZeroTrustX

🚀 Immediate Improvements (Post-Hackathon)

  1. Real User Study: Partner with a local SME to collect genuine behavioral data and retrain our model for production-grade accuracy.
  2. Mobile SDK: Extend behavioral biometrics to mobile (touchscreen swipe patterns, accelerometer data) for BYOD security.
  3. Integration APIs: Build plugins for Okta, Azure AD, and Google Workspace to make adoption seamless for enterprises.

🌐 Vision

We envision ZeroTrustX becoming the industry standard for continuous authentication. In a world where passwords are stolen daily, the only true security is verifying the human behind the device. Our goal is to reduce credential-based breaches by 90% within the next 3 years.

💼 Business Model

  • Freemium SaaS: Free for teams up to 10 users; enterprise pricing for SSO integration and advanced analytics.
  • Target Market: FinTech startups, healthcare providers, and remote-first companies handling sensitive data.

"In a world of stolen passwords, trust behavior — not credentials."

— Team ZeroTrustX

Share this project:

Updates

Submission history