Keystroke dynamics

The behavioural biometric of Keystroke Dynamics uses the manner and rhythm in which an individual types characters on a keyboard or keypad.[2][3][4] The keystroke rhythms of a user are measured to develop a unique biometric template of the user's typing pattern for future authentication.[5] Keystrokes are separated into static and dynamic typing, which are used to help distinguish between authorized and unauthorized users.[6] Vibration information may be used to create a pattern for future use in both identification and authentication tasks.

Data needed to analyse keystroke dynamics is obtained by keystroke logging. Normally, all that is retained when logging a typing session is the sequence of characters corresponding to the order in which keys were pressed. Timing information is discarded. For example, when reading an email, the receiver cannot tell from reading the phrase "I saw three zebras!" whether:

• It was typed rapidly or slowly,
• The sender used the left shift key, the right shift key, or the caps-lock key to capitalize "I"
• The letters were all typed at the same pace or if there was a long pause before any characters while looking for that key, and
• The sender typed any letters wrong initially and then went back and corrected them or if they got them right the first time.

During the late nineteenth century, telegram operators began to develop unique "signatures" that could be identified simply by their tapping rhythm.[7] As late as World War II, the military transmitted messages through Morse Code. Using a methodology called "The Fist of the Sender," military intelligence identified that an individual had a unique way of keying in a message's "dots" and "dashes", creating a rhythm that could help distinguish ally from enemy.[8][9]

Keystroke dynamic information could be used to verify or even try to determine the identity of the person who is producing the keystrokes.[10] The techniques used to do this vary widely in sophistication, and range from statistical techniques to artificial intelligence (AI) approaches like neural networks.

The time to seek and depress a key (seek-time) and the time the key is held down (hold-time) may be very characteristic for a person, regardless of how fast they are typing overall. Most people have specific letters that take longer to find or get to than their average seek-time for all letters. Which letters vary dramatically and consistently for different people. Right-handed people may be statistically faster in getting to keys they hit with their right-hand fingers than with their left-hand fingers. Index fingers may be characteristically faster than other fingers, consistent for a user regardless of their overall speed.

In addition, sequences of letters may have characteristic properties for a user. In English, the use of "the" is very common, and those three letters may be known as a rapid-fire sequence. Common endings, such as "ing", may be entered far faster than the same letters in reverse order ("gni") to the degree that varies consistently by user. This consistency may hold and reveal common sequences of the user's native language even when they are writing entirely in a different language.

Common "errors" may also be quite characteristic of a user. There is a taxonomy of errors, such as the user's most common "substitutions", "reversals", "drop-outs", "double-strikes", "adjacent letter hits", "homonyms" and hold-length-errors (for a shift key held down too short or too long a time). Even without knowing what language the user is working in, these errors may be detected by looking at the rest of the text and what letters the user goes back and replaces.

Keystroke dynamics is part of a larger class of biometrics known as behavioural biometrics, a field in which observed patterns are statistical in nature. Because of this inherent uncertainty, a commonly held belief is that behavioural biometrics are not as reliable as biometrics used for authentication based on physically observable characteristics such as fingerprints or retinal scans or DNA. Behavioural biometrics use a confidence measurement in replacement of the traditional pass/fail measurements. As such, the traditional benchmarks of False Acceptance Rate (FAR) and False Rejection Rates (FRR) no longer have linear relationships.

The benefit to keystroke dynamics (as well as other behavioural biometrics) is that FRR/FAR can be adjusted by changing the acceptance threshold at the individual level. This allows for explicitly defined individual risk mitigation that physical biometric technologies could not achieve.

One of the major problems that keystroke dynamics runs into is that a user's typing varies substantially during a day and between different days and may be affected by any number of external factors.

Because of these variations, any system will make false-positive and false-negative errors. Some successful commercial products have strategies to handle these issues and have proven effective in large-scale use in real-world settings and applications.

Use of keylogging software may be in direct and explicit violation of local laws, such as the U.S. Patriot Act, under which such use may constitute wire-tapping.

• US patent 9430626, John D. Rome, Bethann G. Rome and Thomas E. Ketcham II, "User authentication via known text input cadence", issued 2012
• US patent 7509686, John C. Checco, "Method for providing computer-based authentication utilizing biometrics", issued 2009
• US patent 7206938, S. Blender and H. Postley, "Key sequence rhythm recognition system and method", issued 2007
• US patent 4621334, J. Garcia, "Personal identification apparatus", issued 1986
• US patent 4805222, J.R. Young and R.W. Hammon, "Method and apparatus for verifying an individual's identity", issued 1989
• P. Nordström, J. Johansson. Security system and method for detecting intrusion in a computerized system. Patent No. 2 069 993, European Patent Office, 2009.
• US patent 8230232, A. Awad and I. Traore, "System and method for determining a computer user profile from a motion-based input device", issued 2012

Because human beings generate keystroke timings, they are not well correlated with external processes. They are frequently used as a source of hardware-generated random numbers for computer systems.

Mental health symptoms such as depression and anxiety have also been correlated with keystroke timing features. [11]

• Fist (telegraphy)

• Vaas, Lisa (30 July 2015). "Websites can track us by the way we type—here's how to stop it". Naked Security. Sophos. Retrieved 2018-02-01.
• Walsh, Ray (1 November 2016). "Keyboard Privacy: Building Profiles from How We Type". BestVPN. Retrieved 2018-02-01.