An authentication method for use in a device and comprises monitoring a program behavior stream comprising a plurality of program observables that comprises a program observable. The method records the program observable and matches the recorded first program observable to a program model selected from a plurality of program models stored within a program store. A user model is selected from a plurality of user models stored within a user store corresponding to the program model. A user behavior stream corresponding to the program observable is monitored and a user observable contained in the user behavior stream is recorded. The user observable is correlated to the user model and an authentication state associated with the device is determined based on the correlating.