A system for monitoring actions performed on a data processing device by one or more users. The system comprises a plurality of user data processing devices including a mechanism for interacting with a user and a system monitor that can communicate with each user device and a database. In an exemplary embodiment, the monitor includes a plurality of software agents for carrying out specific functionality. These agents may be distributed over one or many different machines. Each user device includes at least one sensor for detecting events occasioned by interaction of a user with the data processing device. These sensors are operable to create a data structure representing a detected event, and communicate that data structure to the monitor. Once these structures are received, the monitor records them in the database. By analyzing the event data for specific users, user profiles can be created, which can be used to authenticate users.