User authentication through keystroke dynamics

ABSTRACT

Unlike other access control systems based on biometric features, keystroke analysis has not led to techniques providing an acceptable level of accuracy. The reason is probably the intrinsic variability of typing dynamics, versus other---very stable---biometric characteristics, such as face or fingerprint patterns. In this paper we present an original measure for keystroke dynamics that limits the instability of this biometric feature. We have tested our approach on 154 individuals, achieving a False Alarm Rate of about 4% and an Impostor Pass Rate of less than 0.01%. This performance is reached using the same sampling text for all the individuals, allowing typing errors, without any specific tailoring of the authentication system with respect to the available set of typing samples and users, and collecting the samples over a 28.8-Kbaud remote modem connection.

REFERENCES

• 1: Julian Ashbourn, Biometrics: advanced identity verification, Springer-Verlag, London, 2000
• 2: Ashbourn, J. 2000b. The distinction between authentication and identification. Paper available at the Avanti Biometric Reference Site. (homepage.ntlworld.com/avanti)
• 3: Axelsson, S. 2000a. Intrusion detection systems: A taxonomy and survey. Tech. Rep: 99-15. Dept. Computer Engineering, Chalmer University of Technology, Sweden, March. Paper available at www.ce.chalmers.se/staff/sax/taxonomy.ps.
• 4: Stefan Axelsson, The base-rate fallacy and the difficulty of intrusion detection, ACM Transactions on Information and System Security (TISSEC), v.3 n.3, p.186-205, Aug. 2000 [doi>10.1145/357830.357849]
• 5: S. Bleha , C. Slivinsky , B. Hussien, Computer-Access Security Systems Using Keystroke Dynamics, IEEE Transactions on Pattern Analysis and Machine Intelligence, v.12 n.12, p.1217-1222, December 1990 [doi>10.1109/34.62613]
• 6: Marcus Brown , Samuel Joe Rogers, User identification via keystroke characteristics of typed names using neural networks, International Journal of Man-Machine Studies, v.39 n.6, p.999-1014, Dec. 1993 [doi>10.1006/imms.1993.1092]
• 7: Brown, M. E. and Rogers, S. J. 1996. Method and apparatus for verification of a computer user's identification, based on keystroke characteristics. Patent Number 5,557,686, U.S. Patent and Trademark Office, Washington, D.C., Sept.
• 8: Burton, M. C. 2001. The value of web log data in use-based design and testing. J. Comput. Med. Commun. 6, 3. Also available at: www.ascusc.org/jcmc/vol6/issue3/burton.html
• 9: Commun. ACM, Special issue on Personalization. Volume 43, Number 8. 2000.
• 10: Brian D. Davison, A Web Caching Primer, IEEE Internet Computing, v.5 n.4, p.38-45, July 2001 [doi>10.1109/4236.939449]
• 11: S. M. Furnell , J. P. Morrissey , P. W. Sanders , C. T. Stockel, Applications of keystroke analysis for improved login security and continuous user authentication, Information systems security: facing the information society of the 21st century, Chapman & Hall, Ltd., London, UK, 1996
• 12: Gaines, R., Lisowski, W., Press, S., and Shapiro, N. 1980. Authentication by keystroke timing: Some preliminary results. Rand. Report R-256-NSF. Rand Corporation.
• 13: Garcia, J. 1986. Personal identification apparatus. Patent Number 4,621,334, U.S. Patent and Trademark Office, Washington, D.C., Nov.
• 14: Rick Joyce , Gopal Gupta, Identity authentication based on keystroke latencies, Communications of the ACM, v.33 n.2, p.168-176, Feb. 1990 [doi>10.1145/75577.75582]
• 15: J. Leggett , G. Williams, Verifying identity via keystroke characteristics, International Journal of Man-Machine Studies, v.28 n.1, p.67-76, January 1988 [doi>10.1016/S0020-7373(88)80053-1]
• 16: John Leggett , Glen Williams , Mark Usnick , Mike Longnecker, Dynamic identity verification via keystroke characteristics, International Journal of Man-Machine Studies, v.35 n.6, p.859-870, Dec. 1991 [doi>10.1016/S0020-7373(05)80165-8]
• 17: D. Mahar , R. Napier , M. Wagner , W. Laverty , R. D. Henderson , M. Hiron, Optimizing digraph-latency based biometric typist verification systems: inter and intra typist differences in digraph latency distributions, International Journal of Human-Computer Studies, v.43 n.4, p.579-592, Oct. 1995 [doi>10.1006/ijhc.1995.1061]
• 18: Testing Intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory, ACM Transactions on Information and System Security (TISSEC), v.3 n.4, p.262-294, Nov. 2000 [doi>10.1145/382912.382923]
• 19: Fabian Monrose , Aviel Rubin, Authentication via keystroke dynamics, Proceedings of the 4th ACM conference on Computer and communications security, p.48-56, April 01-04, 1997, Zurich, Switzerland [doi>10.1145/266420.266434]
• 20: Fabian Monrose , Michael K. Reiter , Susanne Wetzel, Password hardening based on keystroke dynamics, Proceedings of the 6th ACM conference on Computer and communications security, p.73-82, November 01-04, 1999, Kent Ridge Digital Labs, Singapore [doi>10.1145/319709.319720]
• 21: Obaidat, M. S. and Macchairolo, D. T. 1994. A multilayer neural network system for computer access security. IEEE Trans. Syst. Man, and Cybernet. Part B: Cybernet. 24, 5, 806--812.
• 22: M. S. Obaidat , Balqies Sadoun, A simulation evaluation study of neural network techniques to computer user identification, Information Sciences: an International Journal, v.102 n.1-4, p.239-258, Nov. 1997 [doi>10.1016/S0020-0255(97)00016-9]
• 23: Obaidat, M. S. and Sadoun, B. 1997b. Verification of computer users using keystroke dynamics. IEEE Trans. Syst. Man, and Cybernet. Part B: Cybernet. 27, 2, 261--269.
• 24: Mike Perkowitz , Oren Etzioni, Towards adaptive Web sites: conceptual framework and case study, Artificial Intelligence, v.118 n.1-2, p.245-275, April 2000 [doi>10.1016/S0004-3702(99)00098-3]
• 25: Mike Perkowitz , Oren Etzioni, Adaptive Web sites, Communications of the ACM, v.43 n.8, p.152-158, Aug. 2000 [doi>10.1145/345124.345171]
• 26: James Pitkow, In search of reliable usage data on the WWW, Selected papers from the sixth international conference on World Wide Web, p.1343-1355, September 1997, Santa Clara, California, United States
• 27: Polemi, D. 2000. Biometric techniques: review and evaluation of biometric techniques for identification and authentication, including an appraisal of the areas where they are most applicable. Report prepared for the European Commission DG XIII-C.4 on the Information Society Technologies (IST) (Key action 2: New Methods of Work and Electronic Commerce). Report available at: www.cordis.lu/infosec/src/stud5fr.html.
• 28: Eugene Volokh, Personalization and privacy, Communications of the ACM, v.43 n.8, p.84-88, Aug. 2000 [doi>10.1145/345124.345155]
• 29: Vora, P., Reynolds, D., Dickinson, I., Erickson, J., and Banks, D. 2001. Privacy and Digital Rights Management. World Wide Web Consortium Workshop on Digital Rights Management for the Web. Also available at: www.w3.org/2000/12/drm-ws/pp/hp-poorvi.html.
• 30: Umphress, D. and Williams, G. 1985. Identity verification through keyboard characteristics. Internat. J. Man-Mach. Stud. 23, 263--273.
• 31: Young, J. R. and Hammon, R. W. 1989. Method and Apparatus for Verifying an Individual's Identity. Patent Number 4,805,222, U.S. Patent and Trademark Office, Washington, D.C., Feb.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Authentication

General Terms:
Experimentation, Human Factors, Performance, Security

Keywords:
Biometric techniques, keystroke analysis