Product 01 · Lava Sense
The attacker has the password.
They don't have the hands.
Lava Sense is continuous behavioral authentication for banks and fintechs. It watches how a session types and moves — never what it types — and tells your server whether to allow, step up, or block. Scored on-device, noised with differential privacy, delivered in one API call.
The problem
Credentials verify knowledge.
Fraud is a behavior.
SIM-swap & credential stuffing
Once an attacker controls the phone number or holds leaked credentials, every knowledge-based check passes. The session looks authenticated because it is.
Bots in the funnel
Scripted signups, promo abuse, and carding runs move with a mechanical regularity no human hand produces — if anyone is measuring.
Surveillance or blindness
Legacy behavioral biometrics vendors solve this by warehousing raw biometric data — a liability under NDPA and GDPR. Most institutions choose blindness instead.
How it works
Five lines to a verdict.
The SDK reduces a session's behavior to compact timing statistics in the browser — dwell times, flight times, per-key rhythm under opaque labels, pointer velocity signatures, correction rate. The first sessions enroll a per-device baseline; every session after that is scored live against it.
// 1. Capture behavior — raw events never leave the page
const sense = LavaSense.create({ apiBase, apiKey, appId });
sense.attachKeyboard(loginForm);
sense.attachPointer(document);
// 2. Before the money moves, ask for a verdict
const session = await sense.startSession();
await sense.submitFeatures(session.session_id);
const verdict = await sense.getVerdict(session.session_id);
// → { risk_score: 0.08, verdict: "ALLOW", ... }Accuracy, in public
Measured on the standard
academic benchmark.
The reference benchmark for keystroke dynamics is the CMU dataset of Killourhy & Maxion (DSN 2009): 51 subjects, 400 repetitions of the same password each, detectors ranked by equal-error rate against impostors seeing the password for the first time. We run our engine on the paper's exact protocol. Lower is better.
| Detector | Equal-error rate (mean ± sd) | |
|---|---|---|
| Best published detector — Manhattan (scaled), Killourhy & Maxion 2009 | 9.62% ± 6.94 | the number to beat since 2009 |
| Clean Lava production engine | 9.79% ± 8.24 | what scores your sessions today — statistically level with the published best |
| Clean Lava nearest-neighbor | 8.23% ± 5.86 | beats the published best — next-generation scorer, in evaluation |
npm run eval:km)
re-runs the paper's protocol on the
public CMU dataset
and reproduces these numbers exactly. Partners are welcome to verify.
Privacy guarantees
What never leaves
the browser.
These aren't policy promises — the SDK is readable JavaScript and the API has no endpoint that could accept the raw data.
- Keystroke contents. The SDK transmits only timings. Per-key averages are labeled with device-salted hashes, so which key was which — let alone what was typed — is unknowable to us.
- Raw event streams. Timing buffers are reduced to compact statistics locally and discarded. The events endpoint accepts counts, not contents.
- Device identity. A random, locally-generated ID, SHA-256-hashed before transmission. No fingerprinting, no IMEI, no cross-site anything.
- Un-noised scores. Every score in every response carries differential-privacy noise; the enrollment baseline can be erased with one API call.
See it yourself
Type in the demo.
Watch yourself get recognized.
The live demo runs the real engine: enroll a baseline with a few sessions, then try typing like someone else and watch the risk score move.