Faced with both identity theft and the theft of means of authentication, users of digital services are starting to look rather suspiciously at online systems. To increase access security it is necessary to introduce some new factor of implicit authentication such as user behavior analysis. A behavior is made up of a series of observable actions and taken as a whole, the most frequent of these actions amount to habit. The challenge is to detect identity theft as quickly as possible and, reciprocally, to validate a legitimate identity for as long as possible. To take up this challenge, we introduce in this paper a closed set-based learning classifier. This classifier is inspired by classification in concept lattices from positive and negative examples and several works on emerging patterns. We also rely on the tf-idf parameter used in the context of information retrieval. We propose three heuristics named H c tf −idf , H c sup and H c supM in to select closed patterns for each class to be described. To compute performance of our models we have followed an experimental protocol described in a previous study which had the same purpose. Then, we compared the results from our own dataset of web navigation connection logs of 3, 000 users over a six-month period with the heuristic H sup introduced in this study. Moreover, to strengthen our analysis, we have designed and set up one model based on the naive Bayes classifier to be used as a reference statistical tool.