What characterises a behaviour-based authentication factor ("something you do")?

It relies on how the subject typically behaves, for example a dynamic signature pattern, typing speed and rhythm, gait or voice pattern.

Instead of a static body feature, the system learns a pattern of actions:

• Dynamic signature: not the image of the signature but the pressure, speed and stroke order while signing.
• Keystroke dynamics: the timing between keys and how long each key is held.
• Gait: the way someone walks, measured for example by a phone's motion sensors.
• Voice pattern: the characteristics of speech.

What makes behaviour special is that it can be measured passively and continuously. A system can keep checking during a session whether the typing still looks like the account owner, instead of checking only once at login. The downside is variability: behaviour changes with fatigue, stress, injury or a new keyboard, so these methods have higher error rates and are often used as a risk signal (triggering a step-up check) rather than as a stand-alone factor.

NIST does not list behaviour as a separate factor; it counts behavioural characteristics as biometrics.

Go deeper:

• Keystroke dynamics (Wikipedia) — the science of typing rhythm and its use for authentication.