An Anomaly Detector for Keystroke Dynamics Based on Medians Vector Proximity

This paper presents an anomaly detector for keystroke dynamics authentication, based on a statistical measure of proximity, evaluated through the empirical study of an independent benchmark of keystroke data. A password typing-rhythm classifier is presented, to be used as an anomaly detector in the authentication process of genuine users and impostors. The proposed user authentication method involves two phases. First a training phase in which a user typing profile is created through repeated entry of password. In the testing phase, the password typing rhythm of the user is compared with the stored typing profile, to determine whether it is a genuine user or an impostor. The typing rhythm is obtained through keystroke timings of key-down / key-up of individual keys and the latency between keys. The training data is stored as a typing profile, consisting of a vector of median values of elements of the feature set, and as a vector of standard deviations for the same elements. The proposed classifier algorithm computes a score for the typing of a password to determine authenticity. A measure of proximity is used in the comparison between feature set medians vector and feature set testing vector. Each feature in the testing vector is given a binary score of 1 if it is within a proximity distance threshold from the stored median of that feature, otherwise the score is 0. The proximity distance threshold for a feature is chosen to be the standard deviation of that feature in the training data. The typing of a password is classified as genuine if the accumulated score for all features meet a minimum acceptance threshold. Analysis of the benchmark dataset using the proposed classifier has given an improved anomaly detection performance in comparison with results of 14 algorithms that were previously tested using the same benchmark.