Could they create a fingerprint of the application logging in using the request headers and user agent and watch for a grater than n% change in that fingerprint

Could they create a fingerprint of the application logging in using the request headers and user agent and watch for a grater than n% change in that fingerprint? Obviously a hacker could just copy the applications headers...