Search

In the realm of global computer security, safeguarding sensitive data and computer systems stands as an ongoing challenge. Striking the delicate balance between convenient access for legitimate users and thwarting imposter attacks is imperative. Traditional authentication methods, primarily reliant on username and password schemes, have been the longstanding cornerstone of cyber system authentication. Yet, this conventional approach is marred by inherent vulnerabilities, including password exchange, shoulder surfng, brute force attacks, dictionary attacks, speculation, phishing, and emerging threats. In response to these shortcomings, biometrics technology has emerged as a reliable alternative for authentication and verification, with Keystroke Dynamics being a well-established method. This research advances Keystroke Dynamics-based authentication through cutting-edge technologies, including machine learning, deep learning, and neural networks. A quantitative assessment demonstrates remarkable results—Machine Learning achieves 99.9% accuracy with the Random Forest model, Deep Learning combines CNN with GRU to reach 99.31% accuracy, and the DBN model registers at 98.01%. In the realm of neural networks, Bi-CNN and FFM-NN excel, with accuracy rates of 96.8% and 94.7%, respectively. These findings lay the foundation for robust, secure authentication systems, ensuring the protection of sensitive data and computer assets in our interconnected world. [ABSTRACT FROM AUTHOR]

• A valid user modeling method which combines stable centroids and centroid fluctuation ranges. • A data cleaning algorithm in order to remove abnormal data. • A fixed centroid clustering algorithm by using the stable cluster centroids as the initial centroids. • An authentication method based on fluctuation ranges of centroid positions. User authentication of mobile devices is an important means to protect data security and user privacy. Low overhead, high accuracy and continuous authentication are challenging problems in user authentication. Aiming at the disadvantages of current authentication methods based on keystroke dynamics such as low accuracy and one-time authentication, this paper proposes a new authentication method named UIKI (User Identity authentication method based on clusters of Keystroke time Intervals). UIKI consists of the valid user modeling phase and the runtime user authentication phase. In the valid user modeling phase, UIKI uses a clustering algorithm to find the stable centroids and the fluctuation range of a valid user's centroid positions. In the runtime user authentication phase, UIKI clusters the data to be authenticated with the stable centroids as the initial centroids, and compares the results of clustering with the stable centroids and the centroid fluctuation range of the valid user to determine whether the input data are from the valid user. Experimental results prove that UIKI has the average FAR (False Accept Rate) of 0.082 and the average FRR (False Reject Rate) of 0.052, which can effectively authenticate a user's identity. UIKI has the advantages of high accuracy, low overhead and continuous authentication, which is suitable for the user authentication of mobile devices. [ABSTRACT FROM AUTHOR]

The increasing prevalence of the internet in our daily lives has made cybersecurity and banking security crucial concerns. Traditional methods such as passwords, fingerprints, and face recognition are becoming replicable and susceptible to hacking. To address this issue, we developed innovative biometric keystroke dynamics for personal authentication utilizing friction electric sensors. A single-electrode triboelectric nanogenerator utilizes the skin as a positive friction layer, allowing direct contact with the sensor. This arrangement enables the detection of subtle mechanical changes during pressing. To mitigate the impact of sweat and organic pollutants, a bionic rose petal friction layer is incorporated, ensuring consistent output and long-term effectiveness. The sensor efficiently converts mechanical keystroke actions into electrical signals for individuals and transmits them to an artificial neural network-based AI system. By utilizing a self-powered sweat- and dirt-proof biometric authentication system, along with the LSTM neural network algorithm, we have achieved an impressive accuracy rate of 97%. This system provides a promising security layer against password cracking and user privacy vulnerabilities. [Display omitted] • Biometric keystroke dynamic is proposed to enhance security and accuracy in verifying personal identity. • A single electrode tribo-sensor surpasses previous active sensing devices in sensitivity and flexibility. • The bionic rose petal friction layer mitigates sweat and organic contaminants, ensuring stable and long-term efficacy. [ABSTRACT FROM AUTHOR]

Related works for applying keystroke dynamics (KD) on free text identification indicated that applying KD can improve the accuracy of personal authentication on free text. As the result, this paper proposes a new biometrics, i.e., the keystroke clusters map (KC-Map), by clustering users' keystrokes in order to effectively enhance the accuracy of personal authentication in free text. Since KC-Map is conducted via clustering, it is not suitable for traditional classifiers. In order to tackle this problem, the paper further proposes a keystroke clusters map similarity classifier (KCMS classifier). Experimental results positively show that the proposed KC-Map and KCMS classifier can efficiently improve the accuracy of personal authentication on free text with up to 1.27 times. In addition, one of the huge disadvantages on the current approaches in free text identification is that users are generally required to be trained for several months. Longer training time makes free text identification more impractical. Another motivation of this paper is to explore whether it is possible to shorten the training time into an acceptable range. Experimental results show that, to achieve relatively fair identification accuracy, users only need to carry out about 20 min for training. • This paper proposes a new biometrics which is obtained by using the technique in data mining. • This paper also proposes a new classifier to effectively enhance the accuracy of personal authentication on free text. • Experimental results positively show that the proposed methods can efficiently improve the accuracy of personal authentication on free text. [ABSTRACT FROM AUTHOR]

Abstract Human-machine interfaces enable the exchange of information between people and machines, which plays a crucial role in artificial intelligence. In this field, sensors based on magnetism, electricity, mechanics, and optics are used to construct interactive interfaces and have an important role in sensing human behavior. Here, we present a vibration sensor based human-machine interface (HMI) with an unlimited sensing area on a ubiquitous surface by detecting and positioning an external vibration source. To accurately perceive an external minute vibration, we proposed triboelectric vibration sensors (TVS) designed by mimicking the ampulla in the lateral line of a fish. Imitating the cilia wrapped in the ampulla structure, the tribo-pair of TVS were designed as nanowire arrays and hemispherical pore structures. It achieved a high force sensitivity of 0.97 V/N when the force is less than 1 N and a broad frequency range from 1 to 3 kHz. Given the excellent performance of the TVS, an in-plane vibration source detection and location system was developed, which utilizes the time difference in the arrival estimation method based on correlation analysis. As a demonstration, a TVS-based intelligent virtual digital keyboard was developed by sensing and locating the position of the keystroke for interactive input and importer authentication according to the bionic features. Furthermore, a customized multifunctional desktop interactive system was established by functionalizing an ordinary table for convenient electrical appliance control. In this way, ordinary surfaces such as tables, walls, and doors have the potential to be converted into multifunctional interactive interfaces. The proposed TVS-based HMI in this work can be immediately and extensively adopted in a variety of applications for portable computer peripherals, cyber security, and intelligent home systems. Graphical abstract Human-machine interfaces enable the exchange of information between people and machines, which plays a crucial role in artificial intelligence. In this study, a triboelectric vibration sensor (TVS) based human-machine interface with an unlimited sensing area was developed on a ubiquitous surface. Imitating the cilia wrapped in the ampulla structure in the lateral line of a fish, the TVS was designed as hierarchical structure with nanowire arrayed and hemispherical porous tribo-pair and achieved a high vibration sensing performance. Moreover, by locating/positioning the tapping/knocking point on TVS mounted surface, a TVS-based intelligent digital keyboard and a customized multifunctional desktop interactive system were developed for interactive input and smart home. Image 1 Highlights • Attribute to the elegant hierarchical structure of the TVS mimicked the ampulla in lateral line of a fish, a high pressure sensitivity of 0.97 V/N, a broad frequency range from 1 to 3 kHz, and a minimum detection of 0.01 N had been achieved. Enable it to perceive minute vibration caused by tapping/knocking. •By locating/positioning the tapping/knocking point on TVS mounted surface, ubiquitous daily surfaces can be converted to an intelligent sensing interface. A vibration-based human-machine interface can be established by properly placing TVS on daily surfaces such as desktop and wall. Compared with the traditional touch screen which can only be in the area of sensors, the sensing area in this work is vastly expanded. •A TVS-based intelligent virtual digital keyboard and a customized multifunctional desktop interactive system were developed for interactive input and smart home. Specially, the identities of the importers using the intelligent digital keyboard can be authenticated by the bionic features extracted from the vibration signals. [ABSTRACT FROM AUTHOR]

Abstract Personal keystroke mode is difficult to imitate and can therefore be used for identity authentication. According to the keystroke data when a person inputs free text, the keystroke habit of the person can be learned. Detecting a user's keystroke habits as the user enters text can continuously verify the user's identity without affecting user input. This paper proposes to divide the user keystroke data into a fixed-length keystroke sequence, and convert the keystroke sequence into a keystroke vector sequence according to the time feature of the keystroke. A model of a recursive neural network plus a convolutional neural network is used to learn a sequence of individual keystroke vectors to obtain individual keystroke features for identity authentication. The model was tested using an open data set and the best False Rejection Rate(FRR) was 1.95%, False Acceptance Rate (FAR) was 4.12% and Equal Error Rate(EER) was 3.04%. [ABSTRACT FROM AUTHOR]

Applying machine learning (ML) methods to multi-factor authentication is becoming increasingly popular. However, there is no comprehensive methodology to evaluate biometric systems based on machine learning in the literature. This paper proposes a general methodology for evaluation the ML-based systems for impostor recognition/detection using biometric traits. This includes creation of learning and testing sets with appropriate size balance (proportion) between these sets, selecting the number of instances coming from different users, evaluation of the influence of the impostors number on their detection rate, and the impact of the number of records representing user's behavior. In addition, we propose how the real data (possibly affected by account takeover attempts) could be used to extend the enrollment data to support the impostor detection. The proposed approach was used for a systematic comparison of an extensive set of ML and statistical methods. For some of them, the false acceptance rate (FAR) close to zero and false rejection rate (FRR) smaller than 0.05 in a supervised experiment were accomplished, proving the merit of certain ML-based approaches. Moreover, using the method proposed in the paper, a classifier trained on experimental data achieved FAR below 0.05 on the real-world data collected at an actual financial web page. • General methodology for evaluating ML impostor recognition using biometric traits. • Evaluation of the influence of the impostors number on their detection rate. • Evaluation of the impact of the number of records representing user's behavior. • The proposed approach tested on ML methods reaching FAR and FRR smaller than 0.05. • Test-bed trained classifier achieved FAR < 0.05 on data from financial service. [ABSTRACT FROM AUTHOR]

Studying human behavior is of particular interest within the field of Human-Computer Interaction (HCI) as it can provide insight into human performance. Prior HCI research suggests that mouse and keyboard monitoring may provide a more complete picture of user behavior under high cognitive loads like decision making and developing tasks. In this exploratory study we investigate the potential correlation between mouse behavioral patterns or keystroke dynamics and a set of End-User Development (EUD) behavioral attributes. We conduct a field test on 30 end-users interacting with a modern web-based EUD tool for the construction of simple web forms. Our findings reveal the existence of several significant correlations between end-users’ behavioral attributes and mouse pattern metrics or keystroke dynamics during the development process. Mouse pattern metrics like random and straight movements, mouse hovers, etc., can be associated with perceived ease use, perceived usefulness, self-efficacy, willingness to learn or risk-perception. Similarly, some keystroke dynamics like key press speed and down-to-down time can be associated with perceived ease of use or self-efficacy. The findings of this work show a new interesting research direction and may motivate the EUD research community to study further the end-users’ mouse and keyboard behavior in today's web-based EUD systems. [ABSTRACT FROM AUTHOR]

This work attempts to recognize the gender of an unknown user with data derived only from keystroke dynamics. Keystroke dynamics, which can be described as the way a user is typing, usually amount to tens of thousands of features, each of them enclosing some information. The question that arises is which of these characteristics are most suitable for gender classification. To answer this question, a new dataset was created by recording users during the daily usage of their computer, the information gain of each keystroke dynamics feature was calculated, and five well-known classification models were used to test the feature sets. The results show that the gender of an unknown user can be identified with an accuracy of over 95% with only a few hundred features. This percentage, which is the highest found in the literature, is quite promising for the development of reliable systems that can alert an unsuspecting user to being a victim of deception. Moreover, having the ability to identify the gender of a user who types a certain piece of text is of significant importance in digital forensics. This holds true, as it could be the source of circumstantial evidence for “putting fingers on the keyboard” and for arbitrating cases where the true origin of a message needs to be identified. [ABSTRACT FROM AUTHOR]

Keystroke dynamics has been used to strengthen password-based user authentication systems by considering the typing characteristics of legitimate users. The main problem with login-based authentication systems is that they cannot authenticate users after login access is granted. To ensure continuous user authentication, keystroke dynamics collected from freely typed text during the login period has been utilized; however, the authentication performance was unsatisfactory. To enhance the performance of user authentication based on freely typed keystrokes, we propose a user-adaptive feature extraction method that captures individual users’ distinctive typing behaviors embedded in relative typing speeds for different digraphs. Based on experimental results obtained from 150 participants with more than 13,000 keystrokes per each user in two languages (Korean and English), the proposed method achieved the best equal error rate (0.44). Furthermore, the authentication performance was enhanced by 45.3% for Korean and 39.0% for English compared with the benchmark fixed feature extraction method. [ABSTRACT FROM AUTHOR]

• Discussing issues, strengths and limitations that associated with the biometric trait. • Identifying challenges and open research problems. Recent research has shown the possibility of using smartphones' sensors and accessories to extract some behavioral attributes such as touch dynamics, keystroke dynamics and gait recognition. These attributes are known as behavioral biometrics and could be used to verify or identify users implicitly and continuously on smartphones. The authentication systems that have been built based on these behavioral biometric traits are known as active or continuous authentication systems. This paper provides a review of the active authentication systems. We present the components and the operating process of the active authentication systems in general, followed by an overview of the state-of-the-art behavioral biometric traits that used to develop an active authentication systems and their evaluation on smartphones. We discuss the issues, strengths and limitations that associated with each behavioral biometric trait. Also, we introduce a comparative summary between them. Finally, challenges and open research problems are presented in this research field. [ABSTRACT FROM AUTHOR]

We consider the problem of differentiating users’ typing behavior patterns using machine learning algorithms with keystroke dynamics features. We have proposed mini-batch bagging (MINIBAG) method and attribute ranking of one-class naïve Bayes (AR-ONENB) algorithm. MINIBAG is motivated from bagging because MINIBAG chunks each attribute of the dataset into multiple sub-datasets during the preprocessing phase. Meanwhile, AR-ONENB sorts the attributes based on the time length during the preprocessing phase for effective classification. Both proposed algorithms have shown promising experimental results from various keystroke dynamics based user authentication benchmark tests. From the experimental results, it can be seen that MINIBAG facilitates machine learning algorithms to have an ensemble of multiple models from mini-batches. AR-ONENB, on the other hands, calculates log-likelihood value from keystroke index order for anomaly estimation, which exploits the observation that the user’s typing speed is unique. [ABSTRACT FROM AUTHOR]

In this paper we focus on a context independent continuous authentication system that reacts on every separate action performed by a user. We contribute with a robust dynamic trust model algorithm that can be applied to any continuous authentication system, irrespective of the biometric modality. We also contribute a novel performance reporting technique for continuous authentication. Our proposed approach was validated with extensive experiments with a unique behavioural biometric dataset. This dataset was collected under complete uncontrolled condition from 53 users by using our data collection software. We considered both keystroke and mouse usage behaviour patterns to prevent a situation where an attacker avoids detection by restricting to one input device because the system only checks the other input device. During our research, we developed a feature selection technique that could be applied to other pattern recognition problems. The best result obtained in this research is that 50 out of 53 genuine users are never inadvertently locked out by the system, while the remaining 3 genuine users (i. e. 5.7%) are sometimes locked out, on average after 2265 actions. Furthermore, there are only 3 out of 2756 impostors not been detected, i.e. only 0.1% of the impostors go undetected. Impostors are detected on average after 252 actions. [ABSTRACT FROM AUTHOR]

Keystroke production is influenced by a number of factors including linguistic context and structure. Previous studies in keystroke-based authentication have neglected to take these many of these into account. By incorporating the linguistic context under which keystrokes are produced, we are able to improve the accuracy of authentication experiments. We are able to reduce baseline EER by 36% on a dataset of 486 users, from a baseline of 0.0483 using only unigraph holds and digraph intervals to 0.0309 using linguistic context. Our EER results are further improved to 0.0232 by reducing the size of our feature-set through various methods of feature pruning. These results demonstrate the importance of context when authenticating a typist. [ABSTRACT FROM AUTHOR]

The main objective of this study is to propose a Keystroke dynamics (KD) based Parkinson's disease (PD) indicator using both fixed-text and free-text typing habits on conventional keyboards and homogeneous ensemble learning with several fully balanced bootstrapped training sets for more accurate and robust eHealth applications. Furthermore, this study addresses the six key hypotheses related to our main objective of understanding the risks in this screening process that were previously unknown but important for further improvement. For a predetermined window length, the Colin Bannard and neuroQWERTY MIT-CSXPD datasets were used to extract a series of key hold times and the time gaps between two consecutive presses and releases as a feature set. A wide range of statistical tools were employed to create a machine learning-ready feature arrangement for continuously generated patterns. A homogeneous ensemble learning approach was then developed using bootstrapping and under-sampling while retaining any rare samples. This model was validated using fifteen fixed-text and free-text inputs obtained from early-stage PD patients, De-novo PD patients, and healthy controls. In the leave-one-user-out cross-validation (LOUOCV) evaluation, the maximum observed area under curve (AUC) is 85.99% ± 0.41 for fixed-text input. However, for free-text inputs, AUC is 78.3% ± 0.86, with a sensitivity/specificity of 74.46%/82.13%. The AUC for detecting De-novo patients is 79.83% ± 1.26, which is somewhat lower than the AUC for determining the early stage of the disease, which is 83.81% ± 0.83. The proposed model is more robust, usable (covert way of data acquisition), fast, and has ease of integration into conventional desktops/laptops suitable for real-life eHealth that could help for better diagnosis, early detection in a home environment, future reference, and treatment or therapy management. However, the subject size, severity levels of the disease, typing duration, feature composition, error in typing, and machine learning (ML) method selection influence the performance of this model. Therefore, careful attention is necessary while designing PD indicators using the proposed approach. • Proposed homogeneous ensemble learning with fully balanced bootstrapped samples. • Model has been verified to determine Parkinson's disease using daily typing habits. • Model has been also verified for free-text and fifteen fixed-text typing inputs. • Attempted six key hypotheses to understand influencing factors for future research. • Compared XGBoost and other seven machine learning models in realistic evaluation. [ABSTRACT FROM AUTHOR]

Social media platforms present significant threats against underage users targeted for predatory intents. Many early research works have applied the footprints left by online predators to investigate online grooming. While digital forensics tools provide security to online users, it also encounters some critical challenges, such as privacy issues and the lack of data for research in this field. Our literature review investigates all research papers on grooming detection in online conversations by looking at the psychological definitions and aspects of grooming. We study the psychological theories behind the grooming characteristics used by machine learning models that have led to predatory stage detection. Our survey broadly considers the authorship profiling research works used for grooming detection in online conversations, along with predatory conversation detection and predatory identification approaches. Various approaches for online grooming detection have been evaluated based on the metrics used in the grooming detection problem. We have also categorized the available datasets and used feature vectors to give readers a deep knowledge of the problem considering their constraints and open research gaps. Finally, this survey details the constraints that challenge grooming detection, unaddressed problems, and possible future solutions to improve the state-of-the-art and make the algorithms more reliable. • Presents a comprehensive survey of child exploitation in chat logs. • Provides in-depth analysis of available datasets and grooming detection techniques. • Outlines challenges and future perspectives for online grooming detection. [ABSTRACT FROM AUTHOR]

The most dangerous threats faced by organizations are insider attacks. Since insiders are aware of the underlying system, handling insider attack is a most deterring task. The volume of attacks posed by insiders on cloud is very much higher than the traditional systems, as the attack vector and scope of the attack is high in cloud 1 . Insider attack affects the reputation and productivity of the organization and drags it into losses. Insiders may cause damage accidentally or intentionally. Proper management of privileges reduces the threats posed by insiders. So by properly managing privileges, insider threats can be reduced. This paper proposes a privilege management mechanism which manages the users by incorporating risk, trust into an access control mechanism to develop more scalable and flexible prevention mechanism against insider attacks. [ABSTRACT FROM AUTHOR]

Improved authentication mechanisms are needed to cope with the increased data exposure we face nowadays. Keystroke dynamics is a cost-effective alternative, which usually only requires a standard keyboard to acquire authentication data. Here, we focus on recognizing users by keystroke dynamics using immune algorithms, considering a one-class classification approach. In such a scenario, only samples from the legitimate user are available to generate the model of the user. Throughout the paper, we emphasize the importance of proper data understanding and pre-processing. We show that keystroke samples from the same user present similarities in what we call typing signature. A proposal to take advantage of this finding is discussed: the use of rank transformation. This transformation improved performance of classification algorithms tested here and it was decisive for some immune algorithms studied in our setting. [ABSTRACT FROM AUTHOR]

Currently people store more and more sensitive data on their mobile devices. Therefore it is highly important to strengthen the existing authentication mechanisms. The analysis of typing patterns, formally known as keystroke dynamics is useful to enhance the security of password-based authentication. Moreover, touchscreen allows adding features ranging from pressure of the screen or finger area to the classical time-based features used for keystroke dynamics. In this paper we examine the effect of these additional touchscreen features to the identification and verification performance through our dataset of 42 users. Results show that these additional features enhance the accuracy of both processes. [ABSTRACT FROM AUTHOR]

Keystroke dynamics is an important biometric branch for person authentication. Based upon keystroke dynamics, this paper designs an embedded password protection device, develops an online system, collects two public databases for promoting the research on keystroke authentication, exploits transformation methods to characterize keystroke dynamics, and provides benchmark results of several popular classification algorithms, one-class support vector machine, Gaussian classifier, and nearest neighbor classifier. [ABSTRACT FROM AUTHOR]

Abstract: This paper focuses on enhancing a username and password authentication scheme, which has some weaknesses because a username is publicly known and a password can be guessed. When an attacker knows or guesses a password correctly, the system is compromised. Therefore, this research focuses on this weakness and proposes an additional security token to this scheme by combining keystroke dynamics into the system. A username is typically not changed but a password is required to change frequently for a better security level. A username is typed frequently such that the familiar typing can be used as a behavioral biometrics of a user. Therefore, a keystroke dynamics profile is proposed using a trajectory dissimilarity technique to verify user's typing behavior on a username as an additional authentication token. Several features are mined for keystroke dynamics to create a trajectory profile, which gives the best results of 4% equal error rate (EER) or 96% authentication accuracy. [Copyright &y& Elsevier]

Abstract: Heterogeneous and aggregate vectors are the two widely used feature vectors in fixed text keystroke authentication. In this paper, we address the question “Which vectors, heterogeneous, aggregate, or a combination of both, are more discriminative and why?” We accomplish this in three ways – (1) by providing an intuitive example to illustrate how aggregation of features inherently reduces discriminability; (2) by formulating “discriminability” as a non-parametric estimate of Bhattacharya distance, we show theoretically that the discriminability of a heterogeneous vector is higher than an aggregate vector; and (3) by conducting user recognition experiments using a dataset containing keystrokes from 33 users typing a 32-character reference text, we empirically validate our theoretical analysis. To compare the discriminability of heterogeneous and aggregate vectors with different combinations of keystroke features, we conduct feature selection analysis using three methods: (1) ReliefF, (2) correlation based feature selection, and (3) consistency based feature selection. Results of feature selection analysis reinforce the findings of our theoretical analysis. [Copyright &y& Elsevier]

Abstract: Authentication is the process of determining whether someone or something is, in fact, who or what it is declared to be. As the dependence upon computers and computer networks grows, the need for authentication has increased. Biometrics is the science and technology of authentication by identifying the living individual''s physiological or behavioral attributes. Keystroke dynamics is a behavioral measurement and it utilizes the manner and rhythm in which each individual types. The approaches in keystroke dynamics can be categorized by the selection of features and the classification methods employed. The objective of this review paper is to summarize the well-known approaches used in keystroke dynamics in the last two decades. [Copyright &y& Elsevier]

Abstract: This paper describes a novel technique to strengthen password authentication system by incorporating multiple keystroke dynamic information under a fusion framework. We capitalize four types of latency as keystroke feature and two methods to calculate the similarity scores between the two given latency. A two layer fusion approach is proposed to enhance the overall performance of the system to achieve near 1.401% Equal Error Rate (EER). We also introduce two additional modules to increase the flexibility of the proposed system. These modules aim to accommodate exceptional cases, for instance, when a legitimate user is unable to provide his or her normal typing pattern due to reasons such as hand injury. [ABSTRACT FROM AUTHOR]

Keystroke dynamics-based authentication (KDA) is to verify a user’s identity using not only the password but also keystroke dynamics. With a small number of patterns available, data quality is of great importance in KDA applications. Recently, the authors have proposed to employ artificial rhythms and tempo cues to improve data quality: consistency and uniqueness of typing patterns. This paper examines whether improvement in uniqueness and consistency translates into improvement in authentication performance in real-world applications. In particular, we build various novelty detectors using typing patterns based on various strategies in which artificial rhythms and/or tempo cues are implemented. We show that artificial rhythms and tempo cues improve authentication accuracies and that they can be applicable in practical authentication systems. [Copyright &y& Elsevier]

Abstract: The effect of parametric equalization of time interval histograms (key down–down intervals) on the performance of keystroke-based user verification algorithms is analyzed. Three algorithms are used throughout this analysis: a classic one for static (structured) texts, a second one, also proposed in literature, for both static and arbitrary (free) text, and a new one for arbitrary text based verification. Their performances are reported before and after time interval histogram equalization, and the results corroborate with the hypothesis that the nonlinear memoryless time interval transform proposed here, despite its simplicity, can be a useful and almost costless building block in keystroke-based biometric systems. [Copyright &y& Elsevier]

In recent years, keystroke dynamics has gained popularity as a reliable means of verifying user identity in remote systems. Due to its high performance in verification and the fact that it does not require additional effort from the user, keystroke dynamics has become one of the most preferred second factor of authentication. Despite its prominence, it has one major limitation: keystroke dynamics algorithms are good at fitting a model to one user and one user only. When such algorithms try to fit a model to more than one user, the verification accuracy decreases dramatically. However, in real-world applications it is common practice for two or more users to use the same credentials, such as in shared bank accounts, shared social media profiles, and shared streaming licenses which allow multiple users in one account. In these cases, keystroke dynamics solutions become unreliable. To address this limitation, we propose a method that can leverage existing keystroke dynamics algorithms to automatically determine the number of users sharing the account and accurately support accounts that are shared with multiple users. We evaluate our method using eight state-of-the-art keystroke dynamics algorithms and three public datasets, with up to five different users in one model, achieving an average improvement in verification of 9.2% for the AUC and 8.6% for the EER in the multi-user cases, with just a negligible reduction of 0.2% for the AUC and 0.3% for the EER in the one-user cases. [ABSTRACT FROM AUTHOR]

• A novel user authentication model with freely typed text in mobile device is proposed. • Three sets of heterogeneous features are integrated to strengthen the authentication performance. • Lower than 0.02% of equal error rate can be achieved with only ten reference keystroke sets. • We make our dataset publicly available to contribute the research and industrial communities. Keystroke dynamics-based authentication (KDA) is one of the human behavioral biometric-based user authentication methods based on the unique typing pattern of a person. Previous KDA studies on mobile devices primarily focused on fixed-length text-based KDA, such as passwords and personal identification numbers. This can strengthen the login system and prevent abnormal usage of impostors based on certain attack methods, such as shoulder surfing and smudge attacks. However, this method possesses a limitation that continuous monitoring is not possible after login. To solve this problem, KDA based on freely typed text was studied; however, there are only a few studies on this technique. Further, the performance authentication based on these studies is insufficient for a real-world implementation. In this paper, we propose a novel freely typed text-based KDA method for mobile devices named FACT, i.e., user authentication on mobile devices based on free text, accelerator, coordinate, and time. We collected data from three different smartphone sensors while typing in two languages (English and Korean), and 17 variables were extracted for a set of keystroke data. A total of six authentication methods were employed and the proposed FACT yielded an equal error rate lower than 1% with only one reference keystroke set; moreover, it demonstrated a perfect protection capability while using Korean when more than four reference keystroke sets were used. To contribute to the research and industrial community, we have publicized our collected keystroke dataset so that anyone who conducts a KDA study or develops a KDA-related mobile service can use the dataset without any restrictions. [ABSTRACT FROM AUTHOR]

• Keystroke dynamics is a widely adopted verification technique in remote systems. • The use of keystroke dynamics algorithm can expose the users to credential theft. • Our goal was to design a method for keystroke dynamics obfuscation. • We use hierarchical bottom-up clustering with statistical heuristics scoring. Keystroke dynamics is one of the most widely adopted identity verification techniques in remote systems. It is based on modeling users' specific patterns of typing on the keyboard. When utilized in conjunction with the commonly used passwords, the use of keystroke dynamics can dramatically increase the level of security without interfering with the user experience. However, aspects of keystroke dynamics that applied on passwords, such as processing keystroke events and storing feature vectors or user models, can expose users to identity theft and a new set of privacy risks, thus questioning the added value of keystroke dynamics. In addition, common encryption techniques will be unable to mitigate these threats, since the user's behavior changes from one session to another. In this paper, we suggest key grouping as an obfuscation method to ensure keystroke dynamics privacy. When applied on the keystroke events, the key grouping dramatically reduces the possibility of password theft. To perform the key grouping optimally, we present a novel method which produces groups that can integrated with any keystroke dynamics algorithm. Our method divides the keys into groups using hierarchical clustering with dedicated statistical heuristics algorithm. We tested our method's key grouping output on five keystroke dynamics algorithms using a public dataset and managed to show a consistent improvement of up to 7% in the AUC over other, more intuitive key groupings and random key groupings. [ABSTRACT FROM AUTHOR]

• We propose an approach, which combines the techniques of keystroke dynamics, two new prediction methods, a new classifier, and a keyword-based detection mechanism to authenticate US English fraudulent instant messages. • To the best of our knowledge, this study is the first to apply keystroke dynamics to detect fraudulent instant messages. • Experimental results indicate that our proposed approach outperforms other relevant published methods, in terms of shorter training time, less false alarms, and comparable recognition accuracy. In recent years, many approaches that use keystroke dynamics in free text authentication have been proposed. The major drawback of the proposed approaches is that training generally requires several months, thereby resulting in low practicality. In this study, a method to detect U.S. English fraudulent messages by analyzing keyboard users' keystroke dynamics is proposed. To the best of our knowledge, this is the first study to apply keystroke dynamics to detect fraudulent instant messages. In the proposed system, each user requires only approximately 20 min of training in U.S. English keystroke dynamics. Furthermore, a voting-based statistical classifier is presented to improve the recognition accuracy of instant messages and prevent phishing messages. Experimental results indicate that the proposed approach outperforms other relevant published methods in terms of shorter training time, fewer false alarms, and comparable recognition accuracy. [ABSTRACT FROM AUTHOR]

Keystroke dynamics is a viable behavioral biometric technique for identity verification based on users' keyboard interaction traits. Keystroke dynamics can help prevent credentials from being abused in case of theft or leakage. But what happens if the keystroke events are eavesdropped and being replayed? Attackers that intercept keystroke dynamics authentication sessions of benign users can easily replay them from other sources unchanged or with minor changes and gain illegitimate privileges. Hence, even with its major security advantages, keystroke dynamics can still expose authentication mechanisms to replay attacks. Although replay attack is one of the oldest techniques to manipulate authentication systems, keystroke dynamics does not help preventing it. We suggest a new protocol for dynamics exchange based on choosing a subset of real and fake information snippets shared between the client and service providers to lure potential attackers. We evaluated our method on four state-of-the-art keystroke dynamics algorithms and three publicly available datasets and showed that we can dramatically reduce the possibility of replay attacks while preserving highly accurate user verification. • Keystroke dynamics is considered seamless and transparent. • Keystroke dynamics does not protect against replay attacks. • We suggest a more secure protocol for keystroke dynamics authentication. • The attacker will not be able to replay or semi-replay informations. • The calculation is done using the famous coupon collector problem with batch draw. [ABSTRACT FROM AUTHOR]