keystroke dynamics
Post on 11-Jan-2016
38 Views
Preview:
DESCRIPTION
TRANSCRIPT
Keystroke DynamicsJacob Wise and Chong Gu
Introduction
● People have “unique” typing patterns– “Unique” in the same way that fingerprints aren't
proven unique● Typing patterns could be used for authentication
– Stronger than password– Harder to copy– Can use challenge-response
● Inexpensive
Previous Work
● Neural Networks– Less mainstream approach– Papers co-authored by M.S. Obaidat
● “Traditional” Approach– Reference Signatures computed by calculating the Mean and
Standard Deviations
– Measures “distance” between Reference Signature and Test Signature
– Use digraph/trigraph
– Rick Joyce & Gopal Gupta (1990); F. Monrose & a. Rubin (1997); F. Bergadano, D. Bunetti, and C. Picardi (2002)
First problem - Collecting Data
● Built-in .NET DateTime class
– Precise only to about 10 milliseconds
● Methods from kernel32.dll
– About 15 significant digits (don't know for sure)
First Prototype
● Timing Data for all fields– User Name– Password– Full Name
● Mistakes not allowed● Signature object is
serialized and saved to a file
The World of Neural Networks
● User Name / Password / Full Name unsuitable
– Can't train a neural network on only positive examples
– Would need to collect break-in attempts by other users
● Hence the “Counterexample” option in the first prototype
● Everyone-Types-The-Same-Thing works better
– Hence the passage collection form...
The Passage Collection Form
Passage Analysis Form
● Tool to help analyze collected keystroke data
– Data is in .psig (PassageSignature) and .signature (Signature) files
● We hope this tool will be used and extended in future work on this project
● Tabs for BPN (Back-Propagation Network), more traditional analyses, and others that are yet to come
Passage Analysis Form
[neural networks]
● Explain BPN basics
● This started as just a first step
● Ended up taking the whole time to tune
“Traditional” Approach
● Reference Signature
– Computed by calculating the mean and standard deviation of samples each user has provided
– Based on Press Time or Flight Time
– Samples that are too far off (greater than a certain threshold above the mean) are discarded. The Means are recalculated.
● This value needs to be tuned
● 3 std results in 0.85% of samples being discarded
● 2 std results in 5% of samples being discarded
“Traditional” Approach - Reference Signatures based on Flight Time
User B's Reference Signature (F)
-0.1
-0.05
0
0.05
0.1
0.15
0.2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
key Press
Flig
ht
Tim
e
Series1
User A's Reference Signature (F)
-0.1
-0.05
0
0.05
0.1
0.15
0.2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
Key Presses
Flig
ht
Tim
e
Series1
“Traditional” Approach - Reference Signatures based on Press Time
User B's Reference Signature
0
0.05
0.1
0.15
0.2
0.25
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
Key Presses
Pre
ss T
ime
Series1
User C's Reference Signature
0
0.05
0.1
0.15
0.2
0.25
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
Key Presses
Pre
ss T
ime
Series1
“Traditional” Approach- Reference Signatures
• We have noticed that there is a bigger variance between users if we base our Reference Signatures on Flight Times.
Press Mean (phrase 1) unfiltered
0
0.05
0.1
0.15
0.2
0.25
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
Key Press
Pre
ss T
ime
Series1
Series2
Series3
Series4
Series5
Series6
Series7
Series8
Series9
Series10
Flight Mean (Phrase 1, filter = 2std)
-0.1
-0.05
0
0.05
0.1
0.15
0.2
0.25
0.3
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
Key Press
Flig
ht
Tim
e
Series1
Series2
Series3
Series4
Series5
Series6
Series7
Series8
Series9
Series10
“Traditional” approach- the Verifier
● Two approaches have been considered, but neither is up and running
– Comparing individual Press/flight time of test signature with the Mean Reference Signature. A press/flight time is considered to be valid if it is within x profile standard deviations of the mean reference digraph. (where x needs to be tuned)
– Comparing the magnitude of difference between the mean reference signature (M) and the test signature (T). A certain threshold for an acceptable size of the magnitude is required. A user with a bigger variability of his/her signatures, a bigger threshold value should be used.
● This approach has had some good results
● Again, the threshold value needs to be tuned.
Conclusion
● We have...
– Done lots of work but just barely scratched the surface
– Focused getting some usable analysis tools up and running
– Implemented fairly standard algorithms according to previous research
● There is a lot of work to be done!
Epilogue
● Papers that excite us and into which we didn't have time to seriously delve:
– “User Authentication through Keystroke Dynamics” Bergadano, Gunetti, Picardi (2002)
– “Password hardening based on keystroke dynamics” Monrose, Reiter, Wetzel (2001)
● Not just authentication
top related