A Comprehensive Review of Keystroke Dynamics-Based Authentication Mechanism

Securing keystroke dynamics from replay attacks

This book is on biometric authentication and proposes to use keystroke dynamics to avoid password-based authentication problems such as shared or stolen. The difficulties concerning password-based are that most users option for simple passwords. They prefer using similar passwords spanning distinct applications (Vance, 2010). Keystroke dynamics is known to overcome these circumstances. Keystroke dynamics measures the rhythms that a person exhibits while typing on a keyboard. In this sense, keystroke dynamics is a behavioural biometric modality, as well as signature dynamics, gait and voice (Klevans and Rodman, 1997; Monrose and Rubin, 2000; Impedovo and Pirlo, 2007; Moustakas et al., 2010). Among the advantages of keystroke dynamics in comparison to other modalities, it can be mentioned here that it is a low-cost modality: indeed, neither extra sensor nor device is required (Giot et al., 2011; Bours, 2012). The counterpart to this low cost and ease of use is the worst performances compared to those obtained with morphological biometric modalities such as fingerprint, face and iris (Wildes, 1997; Maio and Jain, 2009). The rather worse performances of keystroke dynamics (in comparison to other modalities) can be explained by the large intra-class variability of the users’ behaviour. Indeed, the way of typing continuously evolves when time elapses. One way to handle this variability is to consider additional information in the decision process. Future perspectives of these security procedures could be a new paradigm in cybersecurity applications.

Nowadays, people become more connected to the internet using their mobile devices. They tend to use their critical and sensitive data among many applications. These applications provide security via user authentication. Authentication by passwords is a reliable and efficient access control procedure, but it is not sufficient. Additional procedures are needed to enhance the security of these applications. Keystroke dynamics (KSD) is one of the common behavioral based systems. KSD rhythm uses combinations of timing and non-timing features that are extracted and processed from several devices. This work presents a novel authentication approach based on two factors: password and KSD. Also, it presents extensive comparative analysis conducted between authentication systems based on KSDs. It proposes a prototype for a keyboard in order to collect timing and non-timing information from KSDs. Hence, the proposed approach uses timing and several non-timing features. These features have a demonstrated significant role for improving the performance measures of KSD behavioral authentication systems. Several experiments have been done and show acceptable level in performance measures as a second authentication factor. The approach has been tested using multiple classifiers. When Random Forest classifier has been used, the approach reached 0% error rate with 100% accuracy for classification.

These days, mobile devices have very sensitive and personal data that needs to be secured. Mobile devices use authentication techniques to protect data from unauthorized access. Consequently, many authentication mechanisms were proposed and many techniques were applied. One of these mechanisms is the analysis of the typing rhythm. It is also known as keystroke dynamics which enhances the password-based authentication by identifying the users based on their typing rhythms. This paper proposes a new authentication mechanism using keystroke dynamics. The dataset which is used in this research consists of 71 features for 42 users with 2142 records. The proposed method consists of two stages; firstly, applying some statistical methods on the 71 features in order to result with valuable new features, then the second stage is to use the existing features with the resulted features with the Random Forest machine learning algorithm. Experimental results showed an accuracy of 94.26%.

Security on smartphones has become a substantial topic since the amount of security relevant data and information stored on them has been increasing. While the password is commonly used as a traditional approach for user authentication, it suffers from a security-usability trade-off dilemma. Accordingly, the keystroke dynamics authentication approach can provide ease of use to the user as well as robust security. This paper investigates the feasibility of utilising user-typing behaviours on touchscreen keypads for the authentication process via free-text keystroke dynamics. In constructing the timing vectors, three timing features are used: hold time, flight time and digraph duration. Additionally, Euclidian and Manhattan distances were utilised to find the degree of similarity between the user's login data and user's profile. An Android application was developed and evaluated through an experimental study. Thus, we achieved a very encouraging result, as we were able to show that applying the free-text method indeed influences the accuracy of user authentication on a touchscreen device.

Biometrics is the field that differentiates among various people based on their unique biological and physiological patterns such as retina, finger prints, DNA and keyboard typing patterns to name a few. Keystroke Dynamics is a physiological biometric that measures the unique typing rhythm and cadence of a computer keyboard user. This paper presents a Data Mining-based Keystroke Dynamics application for identity verification, and it reports the results of experiments comparing different approaches to Keystroke Dynamics. The methods compared were Decision Trees, a Naïve Bayesian Classifier, Memory Based Learning, and statistics-based Keystroke Dynamics.KeywordsData MiningData Mining TechniqueOnline ModeGoal VariableKeystroke DynamicsThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

As account compromises and malicious online attacks are on the rise, multi-factor authentication (MFA) has been adopted to defend against these attacks. OTP and mobile push notification are just two examples of the popularly adopted MFA factors. Although MFA improve security, they also add additional steps or hardware to the authentication process, thus increasing the authentication time and introducing friction. On the other hand, keystroke dynamics-based authentication is believed to be a promising MFA for increasing security while reducing friction. While there have been several studies on the usability of other MFA factors, the usability of keystroke dynamics has not been studied. To this end, we have built a web authentication system with the standard features of signup, login and account recovery, and integrated keystroke dynamics as an additional factor. We then conducted a user study on the system where 20 participants completed tasks related to signup, login and account recovery. We have also evaluated a new approach for completing the user enrollment process, which reduces friction by naturally employing other alternative MFA factors (OTP in our study) when keystroke dynamics is not ready for use. Our study shows that while maintaining strong security (0% FPR), adding keystroke dynamics reduces authentication friction by avoiding 66.3% of OTP at login and 85.8% of OTP at account recovery, which in turn reduces the authentication time by 63.3% and 78.9% for login and account recovery respectively. Through an exit survey, all participants have rated the integration of keystroke dynamics with OTP to be more preferable to the conventional OTP-only authentication.

Current authentication mechanisms have a barely addressed problem: they only authenticate a user at the login procedure. If a user leaves the desk without logging out or locking computer session, an intruder has an occasion to use the system. This paper proposes an authentication methodology that is both inexpensive and non-intrusive and authenticates users continuously while using a computer keyboard. The proposed methodology uses neural networks committee machines to recognize user’s typing pattern, which is a biometric behavioral characteristic. The continuous authentication prevents potential attacks when user leaves the desk without logging out or locking computer session. Some experiments are done to evaluate and calibrate the authentication committee.

Current technologies provide state of the art services but, at the same time, increase data exposure, mainly due to Internet-based applications. In view of this scenario, improved authentication mechanisms are needed. Keystroke dynamics, which recognizes users by their typing rhythm, is a cost-effective alternative. This technology usually only requires a common keyboard in order to acquire authentication data. There are several studies investigating the use of machine learning techniques for user authentication based on keystroke dynamics. However, the majority of them assume a scenario which the user model is not updated. It is known that typing rhythm changes over time (concept drift). Consequently, classification algorithms in keystroke dynamics have to be able to adapt the user model to these changes. This paper evaluates adaptation methods for an immune positive selection algorithm in a data stream context. Experimental results showed that they improved classification performance, mainly for false rejection rates.

Enhanced authentication mechanisms are currently needed in several situations. Mainly due to the widespread use of the Internet, data exposure became a source of growing concern. Commonly used login and password credentials may not provide enough security in this scenario, as they may be easily stolen or guessed in some cases. The use of biometrics is a prominent alternative for user authentication, such as by the use of keystroke dynamics. This biometric technology allows the recognition of users by their typing rhythm, which can be performed using data provided by a common keyboard. However, recent work has shown that typing rhythm changes over time. As a result, a static biometric model can become outdated, decreasing the predictive performance of the system. In light of this fact, there is a need for new techniques able to dynamically adapt user models over time. This paper evaluates, in a data stream context, algorithms proposed in the literature for user authentication based on keystroke dynamics. Modifications to these algorithms are also proposed and evaluated. A study of the behaviour of the algorithms over time under several aspects is also performed. According to our experiments, adaptive methods can improve predictive performance of user recognition by keystroke dynamics.

The need to secure sensitive data and computer systems from intruders, while allowing ease of access for authenticated users is one of the main problems in computer security. Traditionally, passwords have been the usual method for controlling access to computer systems but this approach has many inherent flaws. Keystroke Dynamics is a relatively new method of biometric identification and provides a comparatively inexpensive and low profile method of hardening the normal login and password process. This paper presents the feature subset selection in Keystroke Dynamics for identity verification, and it reports the results of experimenting Ant Colony Optimization technique on keystroke duration, latency and digraph for feature subset selection. Here, the Ant Colony Optimization is used to reduce the redundant feature values and minimize the search space. Optimum feature subset is obtained using keystroke duration values when compared with the other two feature values. Key words: Feature extraction, feature subset selection, mean and standarddeviation, ant colony optimization algorithm, keystroke dynamics.

"This paper explores the application of neural networks in multimodal biometric authentication systems, emphasizing the integration of multiple biometric modalities to enhance security, accuracy, and robustness against various attacks. Traditional authentication methods, such as passwords and single-modal biometrics, often suffer from vulnerabilities, including spoofing, environmental factors, and data breaches. To address these challenges, multimodal authentication systems combine several biometric traits, such as facial recognition, fingerprint scanning, voice recognition, and keystroke dynamics, to achieve higher reliability and resistance to security threats. The study provides an overview of public datasets used for training neural network-based biometric authentication models, including VoxCeleb, RAVDESS, MOBIO, and SDUMLA-HMT. These datasets contain diverse biometric information necessary for developing robust multimodal authentication systems. The paper evaluates the effectiveness of existing approaches using key performance metrics such as accuracy, false acceptance rate (FAR), false rejection rate (FRR), and area under the curve (AUC). Additionally, specialized metrics are considered, including failure to enroll rate (FTE), failure to acquire rate (FTA), and template stability (TS), which are crucial for real-world applications. The role of neural networks in multimodal biometric authentication is analyzed by examining state-of-the-art architectures, including convolutional neural networks (CNNs) and deep learning-based feature fusion methods. Various fusion levels—feature-level, score-level, and decision-level—are discussed to determine the optimal integration strategy for improving authentication performance. The results indicate that multimodal systems significantly outperform unimodal authentication methods by reducing vulnerability to spoofing and environmental variations. Experimental findings suggest that integrating multiple biometric traits enhances the system’s adaptability to dynamic conditions, reducing both false acceptance and false rejection rates. Despite these advantages, several challenges remain, including computational complexity, data privacy concerns, and the need for real-time processing capabilities. Future research should focus on optimizing multimodal fusion techniques, improving generalization across different datasets, and enhancing the security of biometric templates against adversarial attacks. Additionally, developing lightweight neural network architectures suitable for mobile and embedded systems is essential for the practical deployment of multimodal authentication technologies"

Many solutions have been proposed to avoid stress and data leakage caused by BYOD (Bring Your Own Device) trend, including Mobile Device Management and authentication methods. In this paper, we will deal with the second solution more precisely the keystroke dynamics. The behavioral biometric of keystroke dynamics authenticates users by analyzing their ways of typing and generate for each system user a unique biometric reference. The method is simple to implement and inexpensive, it requires only a personal computer keyboard. At the end of the paper, we will propose an algorithm in three phases to implement keystroke dynamics. The main goal of this paper isn't to explain how the dynamic keystroke works but rather to improve the algorithm of implementation of this technique.

Biometric authentication systems offer a secure and convenient method of verifying the identity of individuals based on their unique physiological or behavioral traits. This paper presents a comprehensive survey of biometric authentication systems, focusing on the principles, technologies, applications, challenges, and future directions in the field. The survey covers various biometric modalities, including fingerprint recognition, iris recognition, facial recognition, keystroke dynamics, voice recognition, and gait analysis. Key topics discussed include the use of multi-modal biometric systems, continuous authentication, machine learning, and AI in biometrics, and biometric encryption. The paper also explores the implementation of biometric authentication in access control systems, financial transactions, healthcare systems, and government and law enforcement. Challenges such as security and privacy concerns, spoofing and impersonation, scalability and integration, and ethical and legal issues are addressed. Future research opportunities include improving accuracy and reliability, enhancing security and privacy, addressing societal and ethical concerns, and integrating biometric authentication with the Internet of Things (IoT).

User authentication is an important problem for any restricted access computer system, especially with remote access. Constant spread of Internet makes efficient remote authentication a pressing issue while the distributed nature of interaction introduces additional difficulties. Authentication methods based on most biometrics techniques require dedicated hardware that is unhandy for remote applications. In contrast keystroke dynamics requires only limited dedicated software and does not require any dedicated hardware. The approach we propose is aimed at efficient user authentication with keystroke dynamics using short fixed text, that may for example occur simultaneously to logging process. We have tested the suggested approach on a large group of individuals, with data gathered over Internet using browser-based WWW application. The obtained results are promising and encourage further development in this area.