STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH

This invention was made with government support under contract FA8750-17-C-0014 awarded by the Department of the Air Force. The government has certain rights in the invention.

BACKGROUND

Passive user verification through behavioral biometrics is the process of affirming the identity of a user based upon the user's unique, natural interactions with a system. Typical security measures focus only on authentication and, thus, are often easily compromised (e.g. loss of token or password) or expensive (e.g. retinal scanning hardware), or they place undue burden on the end-user (e.g. multi-factor authentication) that, in turn, elicits unsafe practices (e.g. leaving a machine unlocked to avoid reauthentication). In contrast, behavioral biometrics can enhance existing authentication mechanisms, such as passwords, while constantly or continually verifying the user after login. These methods can be similarly applied to digital forensics to identify an attacker who has gained access to stolen credentials or otherwise gained unlawful access (e.g. zero-day exploit).

Most modern behavioral biometric approaches rely on manually engineered (“handcrafted”) features to generate signatures to represent a user's unique patterns. These features are domain-specific and are based upon experience, intuition, and, often, trial and error. While these features may work well in controlled, laboratory experiments, many are fragile, overly complex, and fail to be robust in practice. Keystroke dynamics research has demonstrated these points by showing the decline in equal error rate (EER) for various keystroke algorithms when tested on more realistic (in that they better represent typical computer activity) datasets.

The advent of deep learning has given rise to viable automatic feature extraction methods that derive latent features from high-dimensional problem spaces with little-to-no domain knowledge. This approach has often proven to be more effective than traditional handcrafted features, revolutionizing aspects of computer vision, speech recognition, and artificial intelligence. Within the domain of biometrics, learning and feature selection have produced advances in facial and speaker recognition, yet these methods have not been applied to behavioral biometrics with the same pervasiveness or level of success.

SUMMARY

Presented herein is an automatic feature extraction framework for behavioral biometric verification based on determinate vectors output from a deep neural network. Skilled artisans recognize that deep neural networks provide pattern recognition via the passage of input through various layers of simulated neural connections. Deep neural networks typically include input and output layers, with ‘hidden’ layer(s) in between. Deep learning is a type of machine learning that leverages artificial intelligence. The presented automatic feature extraction framework automatically extracts a latent feature space that effectively separates the uniquenesses of individuals. Aspects generalize determinate vectors as a framework that can be readily applied to two example, but very different, behavioral verification problems: keystroke and gait.

Additionally provided is an empirical evaluation across three distinct datasets that demonstrates that the determinate vector approach described herein is more robust and outperforms modern state-of-the-art (SOA) verification methods for these modalities at least with regard to EER and data requirements.

Shortcomings of the prior art are overcome and additional advantages are provided through the provision of a computer-implemented method. The method includes building a deep neural network for keystroke-based behavioral verification of user identity. The building includes receiving a plurality of recorded keystroke events, each recorded keystroke event of the plurality of recorded keystroke events comprising (i) an indication of whether the recorded keystroke event is a key press or a key release, (ii) a key identifier of the respective key pressed or released, and (iii) a timestamp of the recorded keystroke event; performing pre-processing of the plurality of recorded keystroke events, the pre-processing providing data structures representing sequential key events for processing by a deep neural network to extract local patterns, wherein the deep neural network comprises at least one convolution layer for feature detection; and training the deep neural network using the data structures representing sequential key events. The method further includes providing the trained deep neural network for keystroke-based behavioral verification of user identity based on determinate vectors output from the trained deep neural network.

Also provided are systems that are configured to perform the aforementioned methods, and computer program products storing instructions for execution to perform the aforementioned methods.

Additional features and advantages are realized through the concepts described herein.

