A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Abstract : The growing use of computers to store sensitive, private, and classified information makes it increasingly important to be able to determine with a very high degree of confidence the identity of an individual seeking access to the computer. This report summarizes preliminary efforts to establish whether an individual can be identified by the statistical characteristics of his or her typing. Can people be identified by the way they type? To investigate this question, an experiment was carried out at Rand, in which seven professional typists were each given a paragraph of prose to type, and the times between successive keystrokes were recorded. This procedure was repeated 4 months later with the same typists and the same paragraph of prose. By examining the probability distributions of the times each typist required to type certain pairs of successively typed letters (digraphs), the authors found that of the large number of digraphs represented in most ordinary paragraphs, there were five which, considered together, could serve as a basis for distinguishing among the subjects. The implications of this finding are that touch typists appear to have a typing "signature," and that this method of distinguishing subjects might provide the basis for a computer authentication system. <s> BIB001 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> The variables that help make a handwritten signature a unique human identifier also provide a unique digital signature in the form of a stream of latency periods between keystrokes. This article describes a method of verifying the identity of a user based on such a digital signature, and reports results from trial usage of the system. <s> BIB002 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> An approach to securing access to computer systems is described. By performing real-time measurements of the time durations between the keystrokes when a password is entered and using pattern-recognition algorithms, three online recognition systems were devised and tested. Two types of passwords were considered: phrases and individual names. A fixed phrase was used in the identification system. Individual names were used as a password in the verification system and in the overall recognition system. All three systems were tested and evaluated. The identification system used 10 volunteers and gave an indecision error of 1.2%. The verification system used 26 volunteers and gave an error of 8.1% in rejecting valid users and an error of 2.8% in accepting invalid users. The overall recognition system used 32 volunteers and gave an error of 3.1% in rejecting valid users and an error of 0.5% in accepting invalid users. > <s> BIB003 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> This paper presents techniques to verify the identity of computer users using the keystroke dynamics of computer user's login string as characteristic patterns using pattern recognition and neural network techniques. This work is a continuation of our previous work where only interkey times were used as features for identifying computer users. In this work we used the key hold times for classification and then compared the performance with the former interkey time-based technique. Then we use the combined interkey and hold times for the identification process. We applied several neural network and pattern recognition algorithms for verifying computer users as they type their password phrases. It was found that hold times are more effective than interkey times and the best identification performance was achieved by using both time measurements. An identification accuracy of 100% was achieved when the combined hold and intekey time-based approach were considered as features using the fuzzy ARTMAP, radial basis function networks (RBFN), and learning vector quantization (LVQ) neural network paradigms. Other neural network and classical pattern algorithms such as backpropagation with a sigmoid transfer function (BP, Sigm), hybrid sum-of-products (HSOP), sum-of-products (SOP), potential function and Bayes' rule algorithms gave moderate performance. <s> BIB004 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> More than ever before the Internet is changing computing as we know it. Global access to information and resources is becoming an integral part of nearly every aspect of our lives. Unfortunately, with this global network access comes increased chances of malicious attack and intrusion. In an effort to confront the new threats unveiled by the networking revolution of the past few years reliable, rapid, and unintrusive means for automatically recognizing the identity of individuals are now being sought. In this paper we examine an emerging non-static biometric technique that aims to identify users based on analyzing habitual rhythm patterns in the way they type. ©2000 Elsevier Science B.V. All rights reserved. <s> BIB005 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> The progress in the field of human-computer interaction with hand held electronic devices, such as, personal digital assistants (PDAs) and mobile phones searches for new interaction techniques. Proximity sensing extends the concept of computer-human interaction beyond actual physical contact with a device. In this paper, a virtual keyboard implementation is presented and keystroke recognition experiments with the keyboard utilizing proximity measurements are described. An infrared (IR) transceiver array is used for detecting the proximity of a finger. Keystroke recognition accuracy is examined with k-nearest neighbor (k-NN) classifier while a multilayer perceptron (MLP) classifier is designed for online implementation. Experiments and results of keystroke classification are presented for both classifiers. The recognition accuracy, which is between 78% and 99% for k-NN classifier and between 69% and 96% for MLP classifier, depends mainly on the location of a specific key on the keyboard area. <s> BIB006 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Unlike other access control systems based on biometric features, keystroke analysis has not led to techniques providing an acceptable level of accuracy. The reason is probably the intrinsic variability of typing dynamics, versus other---very stable---biometric characteristics, such as face or fingerprint patterns. In this paper we present an original measure for keystroke dynamics that limits the instability of this biometric feature. We have tested our approach on 154 individuals, achieving a False Alarm Rate of about 4p and an Impostor Pass Rate of less than 0.01p. This performance is reached using the same sampling text for all the individuals, allowing typing errors, without any specific tailoring of the authentication system with respect to the available set of typing samples and users, and collecting the samples over a 28.8-Kbaud remote modem connection. <s> BIB007 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> This work describes a clustering-based system to enhance user authentication by applying fuzzy techniques to biometric data in order to deter password sharing. Fuzzy c-means is used to train personal, per-keyboard profiles based on the keystroke dynamics of users when entering passwords on a keyboard. These profiles use DES encryption taking the actual passwords as key and are read at logon time by the access control mechanism in order to further validate the identity of the user. Fuzzy values obtained from membership functions applied to the input (i.e., keystroke latencies) are compared against profile values, and a match, within a certain precision threshold /spl gamma/, will grant access to the user. With this technique, even when user A shares password P/sub A/ with user B, B will still be denied access unless he is capable of mimicking the keystroke dynamics of A. We describe the motivation, design, and implementation of a prototype whose results indicate the accuracy level and feasibility of the approach. <s> BIB008 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Computer authentication is a critical component of most computer systems -especially those used in e-commerce activities over the Internet. Global access to information makes security, namely the authentication process, a critical design issue in these systems. In what concerns to authentication, what is required is a reliable, hardware independent and efficient security system. In this paper, we propose an extension to a keystroke dynamics based security system. We provide evidence that completely software based systems can be as effective as expensive and cumbersome hardware based systems. Our system is a behavioral based system that captures the normal typing patterns of a user and uses that information, in addition to standard login/password security to provide a system that is user friendly and very effective at detecting imposters. The results provide a means of dealing with enhanced security that is growing in demand in Web based applications based on e-commerce. <s> BIB009 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Current keystroke dynamics applications have tackled the problem of traditional knowledge-based static password verification, but the problem of spontaneous password verification persists. The intent of this study was to examine the predictive strength of typing patterns for spontaneous passwords. The typing patterns of an individual typing at a DELLreg keyboard on a DELL OptiPlexreg GX260 machine were recorded. Variables collected included keystroke press time and keystroke latency. Computed performance measures included false match rates (FMR) and false non match rates (FNMR) at various threshold levels <s> BIB010 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Security is a critical component of most computer systems - especially those used in E-commerce activities over the Internet. Global access to information makes security a critical design issue in these systems. Deployment of sophisticated hardware based authentication systems is prohibitive in all but the most sensitive installations. What is required is a reliable, hardware independent and efficient security system. In this paper, we propose an extension to a keystroke dynamics based security system. We provide evidence that completely software based systems based on keystroke input dynamics can be as effective as expensive and cumbersome hardware based systems. Our system is behavioral based that captures the typing patterns of a user and uses that information, in addition to standard login/password security to provide a system that is user-friendly and very effective at detecting imposters. <s> BIB011 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> This paper presents a new approach for biometric authentication based on keystroke dynamics through numerical keyboards. The input signal is generated in real time when the user enters with target string. Five features were extracted from this input signal (ASCII key code and four keystroke latencies) and four experiments using samples for genuine and impostor users were performed using two pattern classification technics. The best results were achieved by the HMM (EER=3.6%). This new approach brings security improvements to the process of user authentication, as well as it allows to include biometric authentication in mobile devices, such as cell phones. <s> BIB012 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> The effect of parametric equalization of time interval histograms (key down-down intervals) on the performance of keystroke-based user verification algorithms is analyzed. Four algorithms are used throughout this analysis: a classic one for static (structured) texts, a second one, also proposed in literature, for both static and arbitrary (free) text, a new one for arbitrary text based verification, and an algorithm recently proposed, where keystroke timing is indirectly addressed in order to compare user dynamics. The algorithms performances are presented before and after time interval histogram equalization, and the results corroborate with the hypothesis that the nonlinear memoryless time interval transform proposed here, despite its simplicity, can be a useful and almost costless building block in keystroke-based biometric systems. <s> BIB013 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> In traditional Point of Sales (POS) device, the legitimate user is mainly authenticated by PIN (Personal ::: Identification Number). PIN method has drawbacks like easy to be forgotten. Fingerprint technology, ::: as the most viable biometrics in the special and restricted hardware environment of POS device, has ::: been used to increase user convenience. However, due to inherent problems, fingerprint alone can ::: hardly replace PIN in many high secure applications. Although keystroke pattern as one kind of ::: biometrics is in research for years, no real satisfied results have been got due to its inherent great ::: variability. In this paper, we proposed an innovative method by adapting and increase keystroke ::: pattern technology to POS device and applications. Together with fingerprint system, the adapted ::: keystroke pattern recognition system constitute a multibiometric system, which helps achieve an ::: increase in performance, and provide anti-spoofing measures by making it difficult for an intruder to ::: spoof multiple biometric traits simultaneously. Since this approach is a combination of partially featurebased ::: and partially knowledge-based, it can be a more deployable alternative to strengthen existing ::: PIN and pure biometric authentication methods. Experimental results support that this approach can ::: be better trade-off of the security and user convenience. <s> BIB014 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> A long-text-input keystroke biometric system was developed for applications such as identifying perpetrators of inappropriate e-mail or fraudulent Internet activity. A Java applet collected raw keystroke data over the Internet, appropriate long-text-input features were extracted, and a pattern classifier made identification decisions. Experiments were conducted on a total of 118 subjects using two input modes - copy and free-text input - and two keyboard types - desktop and laptop keyboards. Results indicate that the keystroke biometric can accurately identify an individual who sends inappropriate email (free text) if sufficient enrollment samples are available and if the same type of keyboard is used to produce the enrollment and questioned samples. For laptop keyboards we obtained 99.5% accuracy on 36 users, which decreased to 97.9% on a larger population of 47 users. For desktop keyboards we obtained 98.3% accuracy on 36 users, which decreased to 93.3% on a larger population of 93 users. Accuracy decreases significantly when subjects used different keyboard types or different input modes for enrollment and testing. <s> BIB015 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> In pattern recognition, Bayes classifier is considered a powerful tool in the decision making process as its gives the lowest probability of committing a classification error. This has been highlighted in a number of previous works. The diversity in algorithm parameters, criteria used and number of users involved as well as the evaluation method makes the task of comparing their results and selecting an appropriate system a very thorny one. The purpose of this paper is four fold: to study the different approaches reported using a true password, to establish how normalization and using a single variance/mean impact on the results, using a maximum number of features does necessarily improve performance and finally demonstrate that performance optimization is feasible through careful selection of features and approach taken. <s> BIB016 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Keystroke dynamics based authentication (KDA) verifies a user based on the typing pattern. During enroll, a few typing patterns are provided, which are then used to train a classifier. The typing style of a user is not expected to change. However, sometimes it does change, resulting in a high false reject. In order to achieve a better authentication performance, we propose to continually retrain classifiers with recent login typing patterns by updating the training data set. There are two ways to update it. The moving window uses a fixed number of most recent patterns while the growing window uses all the new patterns as well as the original enroll patterns. We applied the proposed method to the real data set involving 21 users. The experimental results show that both the moving window and the growing window approach outperform the fixed window approach, which does not retrain a classifier. <s> BIB017 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Research in keystroke dynamics has largely focused on the typing patterns found in fixed text (e.g. userid and passwords). In this regard, digraphs and trigraphs have proven to be discriminative features. However, there is increasing interest in free-text keystroke dynamics, in which the user to be authenticated is free to type whatever he/she wants, rather than a pre-determined text. The natural question that arises is whether digraphs and trigraphs are just as discriminative for free text as they are for fixed text. We attempt to answer this question in this paper. We show that digraphs and trigraphs, if computed without regard to what word was typed, are no longer discriminative. Instead, word-specific digraphs/trigraphs are required. We also show that the typing dynamics for some words depend on whether they are part of a larger word. Our study is the first to investigate these issues, and we hope our work will help guide researchers looking for good features for free-text keystroke dynamics. <s> BIB018 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> It is well known that Keystroke Dynamics can be used as a biometric to authenticate users. But most work to date use fixed strings, such as userid or password. In this paper, we study the feasibility of using Keystroke Dynamics as a biometric in a more general setting, where users go about their normal daily activities of emailing, web surfing, and so on. We design two classifiers that appropriate for one-time and continuous authentication. We also propose a new Goodness Measure to compute the quality of a word used for Keystroke Dynamics. From our experiments we find that, surprisingly, non-English words are better suited for identification than English words. <s> BIB019 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Biometrics technology has emerged as the desired solution for a range of secure applications where a person's identity must be determined. Biometrics is currently controlling network and physical access in numerous high risk areas, including airport customs and immigration desks, financial malls among others. This paper compares applications of neural networks to the field of hardened password mechanism in a typical workplace environment. <s> BIB020 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> The keystroke patterns produced during typing have been shown to be unique biometric signatures. Therefore, these patterns can be used as digital signatures to verify the identity of computer users remotely over the Internet or locally at a specific workstation. In particular, keystroke recognition can enhance the username and password security model by monitoring the way that these strings are typed. To this end, this paper proposes a novel up--up keystroke latency (UUKL) feature and compares its performance with existing features using a Gaussian mixture model (GMM)-based verification system that utilizes an adaptive and user-specific threshold based on the leave-one-out method (LOOM). The results show that the UUKL feature significantly outperforms the commonly used key hold-down time (KD) and down--down keystroke latency (DDKL) features. Overall, the inclusion of the UUKL feature led to an equal error rate (EER) of 4.4% based on a database of 41 users, which is a 2.1% improvement as compared to the existing features. Comprehensive results are also presented for a two-stage authentication system that has shown significant benefits. Lastly, due to many inconsistencies in previous works, a formal keystroke protocol is recommended that consolidates a number of parameters concerning how to improve performance, reliability, and accuracy of keystroke-recognition systems. <s> BIB021 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> On-the-fly keyboard user authorization is certainly an interesting option for standard security procedures for high-security computer systems. Unauthorized access to logged-in workstation could threaten the security of data and systems. Conventional authorization methods (passwords, fingerprint scans) verify user identity only during logging process, leaving system vulnerable to user replacement afterwards. Procedures overcoming this peril are often invasive (constant visual monitoring) or uncomfortable (frequent identity verification with user cooperation). A possible solution for constant authorization without these drawbacks is to identify the keyboard user while typing. The approach we propose is based on two extracted keystrokes features: 'flight' and 'dwell'. We have tested the suggested solutions on individual group resembling a medium-sized company. The obtained results are promising. <s> BIB022 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> In the internet age, security is a major concern as identity thefts often cause detrimental effects. Masquerading is an important factor for identity theft and current authentication systems using traditional methods woefully lack mechanisms to detect and prevent it. This paper presents an application independent, continual, non-intrusive, fast and easily deployable user re-authentication system based on behavioral biometrics. These behavioral attributes are extracted from the keyboard and mouse operations of the user. They are used to identify and non-intrusively authenticate the user periodically. To extract suitable user attributes, we propose a novel heuristic that uses the percentage of mouse-to-keyboard interaction ratio and interaction quotient (IQ). In the re-authentication process, every time, the current behavior of the user is compared with the stored “expected” behavior. All deviations are noted and after a certain deviation threshold is reached, the system logs the user out of the current session. The underlying heuristic prevents imposters from misusing the system. Experimental results show that the proposed heuristic can greatly improve the accuracy of application-based and application independent systems to 96.4% and 82.2% respectively. <s> BIB023 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> We present in this paper a study on the ability and the benefits of using a keystroke dynamics authentication method for collaborative systems. Authentication is a challenging issue in order to guarantee the security of use of collaborative systems during the access control step. Many solutions exist in the state of the art such as the use of one time passwords or smart-cards We focus in this paper on biometric based solutions that do not necessitate any additional sensor. Keystroke dynamics is an interesting solution as it uses only the keyboard and is invisible for users. Many methods have been published in this field. We make a comparative study of many of them considering the operational constraints of use for collaborative systems. <s> BIB024 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Keystroke dynamics-based authentication (KDA) is to verify a user's identity using not only the password but also keystroke dynamics. With a small number of patterns available, data quality is of great importance in KDA applications. Recently, the authors have proposed to employ artificial rhythms and tempo cues to improve data quality: consistency and uniqueness of typing patterns. This paper examines whether improvement in uniqueness and consistency translates into improvement in authentication performance in real-world applications. In particular, we build various novelty detectors using typing patterns based on various strategies in which artificial rhythms and/or tempo cues are implemented. We show that artificial rhythms and tempo cues improve authentication accuracies and that they can be applicable in practical authentication systems. <s> BIB025 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Keystroke dynamics-the analysis of typing rhythms to discriminate among users-has been proposed for detecting impostors (i.e., both insiders and external attackers). Since many anomaly-detection algorithms have been proposed for this task, it is natural to ask which are the top performers (e.g., to identify promising research directions). Unfortunately, we cannot conduct a sound comparison of detectors using the results in the literature because evaluation conditions are inconsistent across studies. Our objective is to collect a keystroke-dynamics data set, to develop a repeatable evaluation procedure, and to measure the performance of a range of detectors so that the results can be compared soundly. We collected data from 51 subjects typing 400 passwords each, and we implemented and evaluated 14 detectors from the keystroke-dynamics and pattern-recognition literature. The three top-performing detectors achieve equal-error rates between 9.6% and 10.2%. The results-along with the shared data and evaluation methodology-constitute a benchmark for comparing detectors and measuring progress. <s> BIB026 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> In this paper, we present a novel keystroke dynamic recognition system by means of a novel two-layer fusion approach. First, we extract four types of keystroke latency as the feature from our dataset. The keystroke latency will be transformed into similarity scores via Gaussian Probability Density Function (GPD). We also propose a new technique, known as Direction Similarity Measure (DSM), which measures the absolute difference between two sets of latency. Last, four fusion approaches coupled with six fusion rules are applied to improve the final result by combining the scores that are produced by GPD and DSM. Best result with equal error rate of 1.401% is obtained with our two-layer fusion approach. <s> BIB027 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> This paper describes a novel technique to strengthen password authentication system by incorporating multiple keystroke dynamic information under a fusion framework. We capitalize four types of latency as keystroke feature and two methods to calculate the similarity scores between the two given latency. A two layer fusion approach is proposed to enhance the overall performance of the system to achieve near 1.401% Equal Error Rate (EER). We also introduce two additional modules to increase the flexibility of the proposed system. These modules aim to accommodate exceptional cases, for instance, when a legitimate user is unable to provide his or her normal typing pattern due to reasons such as hand injury. <s> BIB028 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Keystroke dynamics is a set of computer techniques that has been used successfully for many years for authentication mechanisms and masqueraders detection. Classification algorithms have reportedly performed well, but there is room for improvement. As obtaining real intruders keystrokes is a very difficult task, it has been a common practice to use normal users to capture keystroke data in previous work. Our research presents a novel approach to intruder classification using real intrusion datasets and focusing on intruders behavior. We compute six distance measures between sessions to cluster them using both modified K-means and Subtractive Clustering algorithms. Our distance measures use features that came from the relation between intruders sessions, instead of using features from each user only. The performance evaluation of our experiments showed that results are promising and intruders can be successfully classified with acceptable error rates. <s> BIB029 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> A major challenge in anomaly-detection studies lies in identifying the myriad factors that influence error rates. In keystroke dynamics, where detectors distinguish the typing rhythms of genuine users and impostors, influential factors may include the algorithm itself, amount of training, choice of features, use of updating, impostor practice, and typist-to-typist variation. ::: ::: In this work, we consider two problems. (1) Which of these factors influence keystroke-dynamics error rates and how? (2) What methodology should we use to establish the effects of multiple factors on detector error rates? Our approach is simple: experimentation using a benchmark data set, statistical analysis using linear mixed-effects models, and validation of the model's predictions using new data. ::: ::: The algorithm, amount of training, and use of updating were strongly influential while, contrary to intuition, impostor practice and feature set had minor effect. Some typists were substantially easier to distinguish than others. The validation was successful, giving unprecedented confidence in these results, and establishing the methodology as a powerful tool for future anomaly-detection studies. <s> BIB030 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> We have investigated several characteristics of keystroke dynamics in Japanese long-text input. We performed experiments with 189 participants, classified into three groups according to the number of letters they could type in five minutes. In this experimental study, we extracted feature indices from the keystroke timing for each alphabet letter and for each two-letter combination composed of a consonant and vowel in Japanese text. Taking into account two identification methods using Weighted Euclidean Distance (WED) and Array Disorder (AD), we proposed WED+AD method for authentication on the basis of keystroke data in Japanese long-text input. By evaluating the authentication performance of individuals in the three groups, the effectiveness of the method was found to correspond to the typing skill level of the group. <s> BIB031 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> The 2008 federal Higher Education Opportunity Act requires institutions of higher learning to make greater access control efforts for the purposes of assuring that students of record are those actually accessing the systems and taking exams in online courses by adopting identification technologies as they become more ubiquitous. To meet these needs, keystroke and stylometry biometrics were investigated towards developing a robust system to authenticate (verify) online test takers. Performance statistics on keystroke, stylometry, and combined keystroke-stylometry systems were obtained on data from 40 test-taking students enrolled in a university course. The best equal-error-rate performance on the keystroke system was 0.5% which is an improvement over earlier reported results on this system. The performance of the stylometry system, however, was rather poor and did not boost the performance of the keystroke system, indicating that stylometry is not suitable for text lengths of short-answer tests unless the features can be substantially improved, at least for the method employed. <s> BIB032 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Heterogeneous and aggregate vectors are the two widely used feature vectors in fixed text keystroke authentication. In this paper, we address the question ''Which vectors, heterogeneous, aggregate, or a combination of both, are more discriminative and why?'' We accomplish this in three ways - (1) by providing an intuitive example to illustrate how aggregation of features inherently reduces discriminability; (2) by formulating ''discriminability'' as a non-parametric estimate of Bhattacharya distance, we show theoretically that the discriminability of a heterogeneous vector is higher than an aggregate vector; and (3) by conducting user recognition experiments using a dataset containing keystrokes from 33 users typing a 32-character reference text, we empirically validate our theoretical analysis. To compare the discriminability of heterogeneous and aggregate vectors with different combinations of keystroke features, we conduct feature selection analysis using three methods: (1) ReliefF, (2) correlation based feature selection, and (3) consistency based feature selection. Results of feature selection analysis reinforce the findings of our theoretical analysis. <s> BIB033 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Continuous user authentication with keystroke dynamics uses characters sequences as features. Since users can type characters in any order, it is imperative to find character sequences (n-graphs) that are representative of user typing behavior. The contemporary feature selection approaches do not guarantee selecting frequently-typed features which may cause less accurate statistical user-representation. Furthermore, the selected features do not inherently reflect user typing behavior. We propose four statistical-based feature selection techniques that mitigate limitations of existing approaches. The first technique selects the most frequently occurring features. The other three consider different user typing behaviors by selecting: n-graphs that are typed quickly; n-graphs that are typed with consistent time; and n-graphs that have large time variance among users. We use Gunetti's keystroke dataset and k-means clustering algorithm for our experiments. The results show that among the proposed techniques, the most-frequent feature selection technique can effectively find user-representative features. We further substantiate our results by comparing the most-frequent feature selection technique with three existing approaches (popular Italian words, common n-graphs, and least frequent n-graphs). We find that it performs better than the existing approaches after selecting a certain number of most-frequent n-graphs. <s> BIB034 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Biometric methods are individual characteristics that cannot be used by imposters to enter in a secured system. Key stroke dynamics is a biometric utilizing the typing rhythm of the user. Key stroke dynamics is classified in two classes: (a) Fixed text based and (b) Free text based. We are proposing a novel technique for free text keystroke dynamics. In this method, keys are classified into two halves (left - right) and four lines (total eight groups) and then timing vectors (of flight time) are obtained between these key groups. Timing vectors are used to distinguish the legitimate user from imposters. The results obtained are very encouraging and supporting the approach followed in this work. <s> BIB035 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Cloud security is a major concern that may delay its widespread adoption. User access control (UAC) is the core component of security in cloud computing environment, aiming to ensure that stored data are allowed to be accessed only by authenticated/authorized users. As a typical behavioural biometrics, keystroke dynamics provides a promising UAC solution. The most challenging issue that hinders the wide deployment of keystroke is the high verification error rate. Gunetti et al. proposed a classical n-graph-based keystroke verification method (GP method), which can achieve a low False Acceptance Rate (FAR). However, the GP method suffers from a high False Rejection Rate (FRR) and a severe scalability issue. Thus, GP is not a feasible solution for computing cloud application where scalability is a big issue. In this paper, two keystroke verification approaches (nGdv-V and nGdv-C) are proposed to overcome GP's shortcomings. To reduce high FRR, we designed a new correlation measure using n-graph equivalent feature (nGdv) that enables more accurate recognition for genuine users. Moreover, correlation-based hierarchical clustering is proposed to address the scalability issue. The experimental results show that the nGdv-C can produce much lower FRR while achieving almost the same level of FAR as that of the GP method. Furthermore, 1250 times (when using nGdv-V) and three times (when using nGdv-C(17,4)) authentication speed gains have been achieved. <s> BIB036 </s> A Survey of Keystroke Dynamics Biometrics <s> Statistical Approach. <s> Previous efforts in continuous cyber-behavioral verification have considered only zero-effort impostor attacks. Taking continuous verification with keystroke dynamics as a case in point, we demonstrate that forgery attempts created using snooped information (stolen keystroke timing information in our case) have alarmingly high success rates. In our experiments, with as little as 50 to 200 snooped keystrokes (roughly, less than two lines of text typed in a typical email), we were able to create forgeries that had as high as 87.75 percent success rates against verifier configurations that showed less than 11 percent “zero-effort” impostor pass rates. We performed experiments using keystroke data from 50 users who typed approximately 1300 to 2900 keystrokes of free text during three different periods. Our experiments consisted of two parts. In the first part, we conducted zero-effort verification experiments with two verifiers (“R” and “S”) and obtained EERs between 10 and 15 percent under various verifier configurations. In the second part, we replayed 10,000 forged impostor attempts per user and demonstrated how the zero-effort impostor pass rates became meaningless when impostor attempts were created using stolen keystroke timing information. <s> BIB037
Statistical methods are the common choices not only at the infancy stage of keystroke dynamics research BIB001 BIB002  but also in present work BIB031 BIB032 BIB033 . The popularity is directly related to the simplicity, ease of implementation, and low overhead. Among the common generic statistical measures include mean, median and standard deviation BIB010 BIB011 BIB009 , statistical -test BIB001 , and -nearest neighbor BIB006 BIB005 BIB023 . Probabilistic modeling is another variant of statistical approach that holds the assumption that each keystroke feature vector follows Gaussian distribution [20] . The main concept is that what is the likelihood of a given keystroke profile belonging to a particular class or individual who is registered in the database. Some widely used modeling techniques include Bayesian BIB016 BIB003 BIB024 , Hidden Markov Model BIB012 BIB013  , Gaussian Density Function BIB028 BIB021 BIB025 , and weighted probability [20, BIB014 . Meanwhile, cluster analysis is the technique of collecting similar characteristics pattern vectors together. The aim is to gather information about keystroke feature data in order to form a relatively homogeneous cluster  . Feature data categorized within a homogeneous cluster are very similar to each other but highly dissimilar to other clusters. K-mean BIB017 BIB034 BIB029 and fuzzy c-means BIB008 fall within this category. The most popular method is simply by using distance measure as shown in Figure 8 . In distance measure, the pattern of the claimant login attempt is calculated to determine the similarity/dissimilarity associated with a reference pattern in the database. Common measure used to compute distance score introduced in the literature included but is not limited to Euclidean BIB015  BIB035 , Manhattan BIB026 BIB022 BIB030 , Bhattacharyya BIB018 BIB019 , Mahalanobis  , degree of disorder BIB007 BIB036 BIB037 , and direction similarity measure BIB027 . to identify and classify pattern and make correct decision based on data provided. Subdomain under this category includes but not restricted to neural networks, decision tree, fuzzy logic, and evolutionary computing. Neural network is a technique that mimics the biological neurons for information processing. Neural network is capable of providing an estimation of the parameters without precise knowledge of all contributing variables BIB020 . A classical neural network structure consists of an input layer, output layer, and at least one hidden layer BIB004 . Sample data is iteratively fed into the network to produce some outputs based on the current state of its initial predetermined weights. These outputs are compared to the true output, and an error value is computed. This value is then propagated backwards through the network so that the weights can be recalculated at each hidden layer to reduce the error value. The sequence is reiterated until the overall error value falls below a predefined threshold.