You could use the active sessions details that are stored in the system module. What you could do is when a user logins create a log object with the start time and finish time. You could then have a microflow and a scheduled event to check all the sessions that are active. You could then check the user logs to find one with a empty finish time. You could then take the current time and set the finish time. This way you will be able to record how long they have been on for by taking the difference between the finish time and the start time. I haven't done this myself and i am sure there are better ways of doing it. But this is the first way that came to my head. In order to use the active sessions you may need to turn it on in the configurations. To do this put this in the Custom section in the settings:
PersistentSessions = true
It is easy to loop all active sessions in Java, even when persistent sessions are not enabled. See the User Statistics Module in the appstore for an example.