A review on the public benchmark databases for static keystroke dynamics <s> Acquisition Procedure <s> Keystroke dynamics--the analysis of individuals' distinctive typing rhythms--has been proposed as a biometric to discriminate legitimate users from impostors (whether insiders or external attackers). Anomaly detectors have reportedly performed well at this discrimination task, but there is room for improvement. Detector performance might be constrained by the widespread use of comparatively low-resolution clocks (typically 10---15 milliseconds). ::: ::: This paper investigates the effect of clock resolution on detector performance. Using a high-resolution clock, we collected keystroke timestamps from 51 subjects typing 400 passwords each. We derived the timestamps that would have been generated by lower-resolution clocks. Using these data, we evaluated three types of detectors from the keystroke-dynamics literature, finding that detector performance is slightly worse at typical clock resolutions than at higher ones (e.g., a 4.2% increase in equal-error rate). None of the detectors achieved a practically useful level of performance, but we suggest opportunities for progress through additional, controlled experimentation. <s> BIB001 </s> A review on the public benchmark databases for static keystroke dynamics <s> Acquisition Procedure <s> Even if the market penetration rate of biometric technologies is still far below its potential, many biometric systems are used in our daily real-life. One of the main reasons to its low proliferation is the lack of a generic and complete approach that quantifies the performance of biometric systems taking into account individuals' perception among the process. Among all the existing biometric modalities, authentication systems based on keystroke dynamics are particularly interesting. Many researchers proposed in the last decades some algorithms to increase the efficiency of this approach. Nevertheless, none significant benchmark is available and commonly used in the state of the art to compare them by using a similar and rigorous protocol. We propose in this paper: a benchmark testing suite composed of a database and a software that are available for the scientific community for the evaluation of keystroke dynamics based systems. Performance evaluation of various keystroke dynamics methods tested on the database is available in [1]. <s> BIB002 </s> A review on the public benchmark databases for static keystroke dynamics <s> Acquisition Procedure <s> Keystroke dynamics-the analysis of typing rhythms to discriminate among users-has been proposed for detecting impostors (i.e., both insiders and external attackers). Since many anomaly-detection algorithms have been proposed for this task, it is natural to ask which are the top performers (e.g., to identify promising research directions). Unfortunately, we cannot conduct a sound comparison of detectors using the results in the literature because evaluation conditions are inconsistent across studies. Our objective is to collect a keystroke-dynamics data set, to develop a repeatable evaluation procedure, and to measure the performance of a range of detectors so that the results can be compared soundly. We collected data from 51 subjects typing 400 passwords each, and we implemented and evaluated 14 detectors from the keystroke-dynamics and pattern-recognition literature. The three top-performing detectors achieve equal-error rates between 9.6% and 10.2%. The results-along with the shared data and evaluation methodology-constitute a benchmark for comparing detectors and measuring progress. <s> BIB003
• Among the public datasets, WEBGREYCB is the sole dataset to provide one password per user whereas it is the closer case to an operational scenario, where each user has its own password. • No dataset allowed individuals to correct their typing mistakes without re-typing the password from scratch. • Clock resolution is not often specified, whereas it is known to be important BIB001 . • As only one dataset provides the FTAR, it is hard to know if this high rate is normal for such a modality, or related to the acquisition scenario for this specific dataset. However, our experience with keystroke dynamics tends to prove that the FTAR is commonly high. Table 3 presents the description of the population of each dataset. Even if some papers BIB002 BIB003 give the distribution of some information on the population, these data are not publicly present for each individual of the datasets (i.e., we know the histogram of age, but not the age of each user). So, we are not able to analyze or correlate performances depending on these facts. We observe the following points: • Few datasets provide information about users, and when it is the case the population is not well balanced (e.g. there is not 50% of males and 50% of females). This is a problem because we do not know which kind 13 of population is really represented by the KDB. However, this issue is understandable and recurrent in biometric authentication studies. • Most of the time, the number of users involved in the study is quite small (less than 50, and even less than 25). UID program  shows that there is an also a big difference of size of iris of fingerprint datasets used in research experiments and with the number of users involved in real life, but these experimental datasets stays bigger than the ones for keystroke dynamics. However, due to the high error rates of keystroke dynamics, this modality could only applied on small size populations. Thus, it should be better if the number of users in a dataset would be in the same order of magnitude as the number of users of the future deployed system. This information should be specified in future works of this field. • The quantity of data provided by the datasets is really different, with regard to the number of users or samples per users.