A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> This paper describes a simple, software based keyboard monitoring system for the IBM PC for the continuous analysis of the typing characteristics of the user for the purpose of continuous authentication. By exploiting the electrical characteristics of the PC keyboard interface together with modifications to the internal system timer, very accurate measurements can be made of keystroke interval and duration, including measurements of rollover. Rollover patterns, particularly when typing common diphthongs, can be highly characteristic of individual users and provide quite an accurate indication of the users identity. <s> BIB001 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> This work describes a clustering-based system to enhance user authentication by applying fuzzy techniques to biometric data in order to deter password sharing. Fuzzy c-means is used to train personal, per-keyboard profiles based on the keystroke dynamics of users when entering passwords on a keyboard. These profiles use DES encryption taking the actual passwords as key and are read at logon time by the access control mechanism in order to further validate the identity of the user. Fuzzy values obtained from membership functions applied to the input (i.e., keystroke latencies) are compared against profile values, and a match, within a certain precision threshold /spl gamma/, will grant access to the user. With this technique, even when user A shares password P/sub A/ with user B, B will still be denied access unless he is capable of mimicking the keystroke dynamics of A. We describe the motivation, design, and implementation of a prototype whose results indicate the accuracy level and feasibility of the approach. <s> BIB002 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> Keystroke dynamics can be useful to ascertain personal identity even after an authentication phase has been passed, provided that we are able to deal with the typing rhythms of free text, chosen and entered by users without any specific constraint. In this paper we present a method to compare typing samples of free text that can be used to verify personal identity. We have tested our technique with a wide set of experiments on 205 individuals, obtaining a False Alarm Rate of less than 5p and an Impostor Pass Rate of less than 0.005p. Different trade-offs are, however, possible. Our approach can rely on what is typed by people because of their normal job, and a few lines of text, even collected in different working sessions, are sufficient to reach a high level of accuracy, which improves proportionally to the amount of available information: As a consequence, we argue that our method can be useful in computer security as a complementary or alternative way to user authentication and as an aid to intrusion detection. <s> BIB003 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> We propose a biometric verification method using biometric feature in keystroke operation for ATM (automatic teller machine) user authentication. In the proposed method, ATM user authentication is performed by using the 10 types of biometric feature of hand-shape which are extracted from keystroke motion in ATM operation. Moreover, we calculate the similarity between current ATM operator and genuine user in consideration of key-press timing. The proposed method can improve the safety of the present situation without special additional operation, physical load and psychological burden. <s> BIB004 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> Biometric security systems enable more secure authentication methods to access a computer system's resources. This paper presents a biometric security system based on keystroke dynamics that enable hardening or strengthening the password verification process by comparing the captured keystroke dynamics information with the user's templates stored in a template database. The system uses the statistical information about keystroke latencies of users as a measure to differentiate different users. It uses a classifier that resembles a neural network as the structure. <s> BIB005 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> The purpose of this study is to evaluate the performance of static keystroke analysis as a complimentary and transparent security solution in the context of perimeter defense and facility access. A biometric keypad prototype was developed to evaluate the classification accuracy using temporal keystroke characteristics and feature points extracted from pressure sensors embedded within the keypad. A novel method is proposed to improve keystroke classification accuracy by analyzing 3 pressure related characteristics: amplitude or peak, peak area, and peak sharpness. <s> BIB006 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> abstract Keystroke dynamics are becoming a well-known method for strengthening username- and password-based credential sets. The familiarity and ease of use of these traditional authentication schemes combined with the increased trustworthiness associated with biometrics makes them prime candidates for application in many web-based scenarios. Our keystroke dynamics system uses Breiman’s random forests algorithm to classify keystroke input sequences as genuine or imposter. The system is capable of operating at various points on a traditional ROC curve depending on application-specific security needs. As a username/password authentication scheme, our approach decreases the system penetration rate associated with compromised passwords up to 99.15%. Beyond presenting results demonstrating the credential hardening effect of our scheme, we look into the notion that a user’s familiarity to components of a credential set can non-trivially impact error rates. <s> BIB007 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> In the internet age, security is a major concern as identity thefts often cause detrimental effects. Masquerading is an important factor for identity theft and current authentication systems using traditional methods woefully lack mechanisms to detect and prevent it. This paper presents an application independent, continual, non-intrusive, fast and easily deployable user re-authentication system based on behavioral biometrics. These behavioral attributes are extracted from the keyboard and mouse operations of the user. They are used to identify and non-intrusively authenticate the user periodically. To extract suitable user attributes, we propose a novel heuristic that uses the percentage of mouse-to-keyboard interaction ratio and interaction quotient (IQ). In the re-authentication process, every time, the current behavior of the user is compared with the stored “expected” behavior. All deviations are noted and after a certain deviation threshold is reached, the system logs the user out of the current session. The underlying heuristic prevents imposters from misusing the system. Experimental results show that the proposed heuristic can greatly improve the accuracy of application-based and application independent systems to 96.4% and 82.2% respectively. <s> BIB008 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> Traditionally users are authenticated based on a username and password. However, a logged station is still vulnerable to imposters when the user leaves her computer without logging off. Keystroke dynamics methods can be useful to continuously verify a user, after the authentication process has successfully ended. Within the last decade several studies proposed the use of keystroke dynamics as a behavioral biometric tool to verify users. We propose a new method, for compactly representing the keystroke patterns by joining similar pairs of consecutive keystrokes. The proposed method considers clustering di-graphs based on their temporal features. The proposed method was evaluated on 10 legitimate users and 15 imposters. Encouraging results suggest that the proposed method detection performance is better than that of existing methods. Specifically we reach a False Acceptance Rate (FAR) of 0.41% and a False Rejection Rate (FRR) of 0.63%. <s> BIB009 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> Online examinations pose a unique problem for distance-based education, in that it can be very difficult to provide true user authentication. Due to the inherent anonymity of being online, compared to taking an examination in a classroom environment, students may attempt to artificially boost their scores in online examinations by having another individual take the exam for them, which a typical user/password authentication scheme cannot detect. This paper discusses and presents a method for providing continuous biometric user authentication in online examinations via keystroke dynamics. <s> BIB010 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> The 2008 federal Higher Education Opportunity Act requires institutions of higher learning to make greater access control efforts for the purposes of assuring that students of record are those actually accessing the systems and taking exams in online courses by adopting identification technologies as they become more ubiquitous. To meet these needs, keystroke and stylometry biometrics were investigated towards developing a robust system to authenticate (verify) online test takers. Performance statistics on keystroke, stylometry, and combined keystroke-stylometry systems were obtained on data from 40 test-taking students enrolled in a university course. The best equal-error-rate performance on the keystroke system was 0.5% which is an improvement over earlier reported results on this system. The performance of the stylometry system, however, was rather poor and did not boost the performance of the keystroke system, indicating that stylometry is not suitable for text lengths of short-answer tests unless the features can be substantially improved, at least for the method employed. <s> BIB011 </s> A Survey of Keystroke Dynamics Biometrics <s> Static versus Dynamic. <s> Cloud security is a major concern that may delay its widespread adoption. User access control (UAC) is the core component of security in cloud computing environment, aiming to ensure that stored data are allowed to be accessed only by authenticated/authorized users. As a typical behavioural biometrics, keystroke dynamics provides a promising UAC solution. The most challenging issue that hinders the wide deployment of keystroke is the high verification error rate. Gunetti et al. proposed a classical n-graph-based keystroke verification method (GP method), which can achieve a low False Acceptance Rate (FAR). However, the GP method suffers from a high False Rejection Rate (FRR) and a severe scalability issue. Thus, GP is not a feasible solution for computing cloud application where scalability is a big issue. In this paper, two keystroke verification approaches (nGdv-V and nGdv-C) are proposed to overcome GP's shortcomings. To reduce high FRR, we designed a new correlation measure using n-graph equivalent feature (nGdv) that enables more accurate recognition for genuine users. Moreover, correlation-based hierarchical clustering is proposed to address the scalability issue. The experimental results show that the nGdv-C can produce much lower FRR while achieving almost the same level of FAR as that of the GP method. Furthermore, 1250 times (when using nGdv-V) and three times (when using nGdv-C(17,4)) authentication speed gains have been achieved. <s> BIB012
Keystroke dynamics coexist within two different modes of authentication. Static authentication mode attempts to verify user at the initial instance of user interaction with the system. These include the attempt of using keystroke dynamics biometrics to supplement password for security login BIB007 BIB005 , physical access control BIB006 , automated teller machine BIB004 , and password sharing prevention BIB002 . Dynamic authentication mode deals with a different demand in computer security. The goal is to ensure that the authorized identity is still whom they claimed to be after initial login procedure. It is also referred to as continuous BIB001 BIB009 or reauthentication BIB008  advantage over static authentication is the ability to continuously ensure the validity of a legal user throughout the interaction period. It is also usually capable of working in silent mode, which will not cause any or minimal inconvenience to the user. Possible application may include online examination BIB010 BIB011 and account activity monitoring BIB012 . Dynamic authentication was also recommended by BIB003 to be used for password recovery and intrusion detection purposes. Although dynamic authentication has gained momentum in recent years, the number of researches is still evidently small (10%) compared to static authentication (83%). Among the probable reasons may be the complexity of experiment setup and less application as compared to static authentication.