Authentication using username and password has been used in general to manage access to the system. In this way, it can be arranged that only authorized people can access a system. However, it does not rule out the possibility of several spoofing attacks. To solve this problem, user behavior can be used instead of password. Given that user behavior is unique, the behavior can be used for the authentication process. One of the authentication processes is to use weblogs continuously, as proposed by Leslie et al. However, the method used by Leslie et al. still has a drawback, that with the Leslie method, only the role of the user is identified. So, if an attack occurs, the identity of the attacker cannot be known. To overcome this problem, a continuous authentication method is proposed using web logs and user attributes such as user id, datetime, event, category and product. This method can be used when in the middle of access the behavior of the user is di?erent from the actual user. That is, when a user enters the system and 50% of the products accessed are the same as the repository that has been stored on the system for that user. By using this method, the user’s identity can be identified immediately after the role is known. In addition, by using the proposed method, the accuracy of user identity authentication obtained is on average 95.08% which means it is greater than the accuracy of user role authentication using the Leslie method which is 46%.