Computer security forensics based on time-keyed changes in authentication credentials

Abstract

A method, computer program product, and system for dynamic authentication using keystrokes are disclosed. The method includes one or more processors recording corresponding keystroke sessions of multiple typing samples (continuous typing) of credentials associated with corresponding users among the multiple users for multiple users. The method also includes extracting a feature set that characterizes typing changes between the multiple typing samples. The method also includes detecting repeated typing of a credential among the credentials associated with a user among the multiple users. The method also includes extracting a feature set that characterizes typing changes between repetitions from the repeated typing of a credential. The method also includes comparing the feature set extracted from the repeated typing with the feature set extracted from the keystroke session set to estimate which user is the first user.

Description

Background Art

[0001] The present invention relates generally to the field of computer security, and more particularly to keystroke dynamics.

[0002] Keystroke dynamics is a highly researched topic in the field of behavioral biometrics. Keystroke dynamics identifies and measures the way and rhythm of a person typing on a keyboard (physical or virtual). For example, a keystroke dynamics system can distinguish different people by how fast they tend to type, whether they type all characters at the same speed or tend to pause before typing a specific character, how long they usually hold down each key, etc.

[0003] Authentication by keystroke dynamics typically involves a machine learning algorithm that uses multiple recorded keystroke sessions as features of the relevant user to train a model. A new keystroke session of the user (or someone who has influence over the user) can then be compared to the model by the machine learning algorithm. When the content of the new keystroke session sufficiently fits the model, the user's identity is authenticated. Summary of the invention

[0004] Aspects of the present invention disclose a method, computer program product, and system for using dynamic authentication with keystrokes. The method includes one or more processors recording corresponding keystroke sessions for multiple users of a computerized system, the keystroke sessions including multiple typing samples of credentials associated with corresponding users of the multiple users. The multiple typing samples are continuously typed by the corresponding users. The method also includes one or more processors extracting a feature set representing the typing changes between the multiple typing samples from each of the corresponding keystroke sessions. The method also includes one or more processors detecting an attempt by a first user to circumvent dynamic authentication with keystrokes by detecting repeated typing of a credential in the credentials associated with a certain user of the multiple users, and logging into the computerized system. The method also includes one or more processors extracting a feature set representing the typing changes between repetitions from a certain credential repeatedly typed by the first user. The method also includes one or more processors comparing the feature set extracted from the credentials repeatedly typed by the first user with the feature set extracted from the keystroke session set to estimate which user of the multiple users is the first user. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Exemplary embodiments are illustrated in the referenced drawings. Dimensions of components and features shown in the figures are generally chosen for convenience and clarity of presentation and are not necessarily shown to scale. The drawings are listed below.

[0006] Figure 1 is a block diagram of an exemplary system for estimating the identity of a user attempting to log into a system by circumventing a keystroke dynamic authentication function in accordance with an embodiment of the present invention.

[0007] Figure 2 is a flow chart of a method for estimating the identity of a user attempting to log into a system by circumventing a keystroke dynamic authentication function according to an embodiment of the present invention. DETAILED DESCRIPTION

[0008] Embodiments of the present invention recognize that an individual's keystroke dynamics are quite unique, enabling a security system to reliably authenticate a person's identity based on his or her measured keystroke dynamics. Therefore, some security systems use keystroke dynamics as an addition to traditional authentication techniques (such as passwords, tokens, two-factor authentication, etc.), or as a complete replacement for these techniques.

[0009] The foregoing examples of the related art and limitations related thereto are intended to be illustrative and not exclusive. Other limitations of the related art will become apparent to those skilled in the art after reading the specification and studying the drawings.

[0010] A technology is disclosed herein, embodied as a method, system, and computer program product for computer security forensics based on time-keyed changes in authentication credentials. Embodiments of the present invention are used to estimate the identity of a computer system user who attempts to log into a computerized system by circumventing keystroke dynamic authentication functionality.

[0011] Various embodiments of the present invention provide advantages when operating in conjunction with a type of keystroke dynamics authentication functionality that requires a user to type in credentials (e.g., username, password, etc.) and then analyzes the typed keystroke dynamics to decide whether to allow the user to log in. Assuming the credentials match the user's pre-defined credentials and the keystroke dynamics match a pre-built keystroke dynamics model for the user, the user is allowed to log in.

[0012] An attacker may attempt to circumvent this keystroke dynamic authentication functionality by first gaining access to the user's credentials (via means such as phishing, social engineering, guessing, etc.), and then attempting to log into the computerized system by typing in the credentials. When the login attempt fails, the attacker repeatedly types in the credentials, hoping that one of the next repetitions will be accepted as valid by the computerized system. As the attacker continuously types in the same credentials over and over again, the typing style will tend to evolve gradually and unconsciously, primarily due to the cognitive learning process ("learning curve") involved in repeatedly typing in the same string of characters.

[0013] While a computerized system can typically infer from this series of failed login attempts that an attack is ongoing, embodiments of the present invention recognize that the system still cannot easily identify the attacker beyond recording various common identifiers, such as the attacker's Internet Protocol (IP) address (which may be forged or otherwise useless for conclusive identification).

[0014] Furthermore, embodiments of the present invention may advantageously enable a computerized system to attribute an attack to a specific user of the computerized system, thereby helping to identify the attacker. The determination and attribution is based on the recognition that in many cases, attackers tend to register their own user accounts with a computerized system before launching an attack in order to study the security measures it employs and potentially also find suitable users to target.

[0015] Attribution of an attack to a particular user of a computerized system can exploit the fact that all users (including any potential attackers) provide multiple typing samples of their credentials at registration (or later during a credential change process). The keystroke dynamic authentication function uses the typing samples continuously entered by the user in a conventional manner to create a keystroke dynamic model for each user. For example, by determining how the user tends to type the characters of the credential. As a simplified example, if the user's credential is a password that reads "a1b", the keystroke dynamic authentication function can base the user's model on the average duration of pressing each of the characters "a", "1", and "b", the average interval between typing "a" and "1" and between typing "1" and "b", and / or other similar statistics tied to specific characters.

[0016] Embodiments of the present invention may make additional use of each user's typing samples beyond the standard use for creating a keystroke dynamics model. In addition, embodiments of the present invention extract a feature set from the samples that characterizes the typing changes between multiple typing samples. The feature is generated by what can be called a user's "learning curve" when the same credentials are repeatedly typed during registration (or credential change). A user's keystroke dynamics tend to change gradually with continuous typing, which is exactly what may happen when an attacker repeatedly enters the target user's credentials. Therefore, by comparing the time changes in the attacker's login attempts with the time changes previously recorded for each user, the attacker can potentially be identified as one of the users of the computerized system.

[0017] However, embodiments of the present invention recognize that matching an attacker's temporal typing changes with other users' typing changes is not straightforward, primarily because the attacker's own credentials (e.g., a password that reads "john2020") are almost always different from the target user's credentials (e.g., a password that reads "jane123"). Therefore, to facilitate such comparisons, embodiments of the present invention may perform a series of calculations that ultimately represent all users' feature sets in a uniform manner that is agnostic to both (a) the actual keys pressed to type each credential and (b) the length of each credential. For example, each feature set may be represented as a feature vector having a uniform length and identical structure.

[0018] Once such a unified feature set is available for all users, the computerized system can respond to the attack by also extracting such a unified feature set for the attacker's login attempt, and comparing the attacker's feature set with the feature sets of all or some of the users of the computerized system. For example, the comparison can include applying a machine learning algorithm to the feature set, or calculating a mathematical distance measure between the attacker's feature set and other feature sets.

[0019] In another aspect, to reduce the computational resources required for each such comparison, embodiments of the present invention may select a smaller subset of the users of the computerized system for comparison. For example, if the computerized system is a computerized system of a social network, the comparison may be performed only between users of the social network that are linked to the target user (e.g., "friends"). Similarly, any form of connection between users of the computerized system, such as past interactions or other means of indicating that the users are related, may be exploited in order to narrow the list of users to be compared with the attacker's feature set.

[0020] Reference now Figure 1 , which shows a block diagram of an exemplary computer system 100 configured to estimate the identity of a user attempting to log into the system 100 by circumventing a keystroke dynamic authentication function. The system 100 may include one or more hardware processors 102, a random access memory (RAM) 104, and one or more computer-readable storage devices 106.

[0021] Storage device(s) 106 may have program instructions and / or components stored thereon that are configured to operate hardware processor(s) 102. The program instructions may include one or more software modules, such as attacker identification module 108. The software components may include an operating system having various software components and / or drivers for controlling and managing general system tasks (e.g., memory management, storage device control, power management, etc.) and facilitating communications between various hardware and software components.

[0022] The system 100 may operate by loading the instructions of the attacker identification module 108 into the RAM 104 when they are executed by the processor(s) 102. The instructions of the attacker identification module 108 may cause the system 100 to record a user keystroke session for each of the users of the system during a registration process and / or a credential change process (block 110), and to extract a corresponding set of user features that characterizes typing changes between multiple typing samples of the keystroke session (block 112). In response to detecting an attack, the instructions of the attacker identification module 108 may cause the system 100 to extract a set of features that characterizes typing changes between repeated credential typings of the attacker (block 114), compare the features to a set of user features previously extracted for some or all of the users (block 112), and estimate the identity of the attacker among the system users (block 116).

[0023] The system 100 described herein is merely an exemplary embodiment of the present invention, and may in fact be implemented in hardware only, software only, or a combination of hardware and software. The system 100 may have more or fewer components and modules than shown, may combine two or more components, or may have a different configuration or arrangement of components. The system 100 may include any additional components that enable it to function as an operational computer system, such as a motherboard, a data bus, a power supply, a network interface card, a display, an input device (e.g., a keyboard, a pointing device, a touch-sensitive display), etc. (not shown). In addition, the components of the system 100 may be co-located or distributed, or the system may be run as one or more cloud computing "instances," "containers," and / or "virtual machines," as known in the art.

[0024] Reference now Figure 2 The flowchart of FIG. 1 discusses instructions of the attacker identification module 108, which illustrates an example of an embodiment of the present invention for evaluating an attacker who attempts to log into a user such as a computer by circumventing the keystroke dynamic authentication function. Figure 1 The system 100 is a method 200 for identifying a user in a computerized system.

[0025] The steps of method 200 may be performed in the order presented or in a different order (or even in parallel) as long as the order allows the necessary input to a certain step to be obtained from the output of an earlier step. In addition, unless otherwise specifically stated, the steps of method 200 are automatically performed (e.g., by Figure 1 system 100).

[0026] In step 202, method 200 records a typing session for each of a plurality of users of the system. Each such typing session may include a plurality of typing samples of credentials associated with the respective user, such as a username, an email address, a password, or any other multi-character credential (including one or more letters, numbers, symbols, etc.) selected by the user or assigned to the user by the system. In various embodiments, the system may prompt the user to type the credentials multiple times in succession (e.g., within a total duration limited to 5, 10, 20, 30, 40, 50, or 60 seconds, or any value between or exceeding these values), for example, in one or more fields provided in a graphical user interface (GUI) provided by the system. Method 200 may record each such typing of the user as a separate typing sample, such that the recorded typing session includes an ordered collection of typing samples typed in succession.

[0027] The user may enter the credentials on a computerized device connected to the system, for example, via a computer network such as a local area network (LAN) or the Internet. The user may enter the credentials using a physical keyboard or a virtual keyboard (e.g., facilitated by a touch screen or by an on-screen virtual keyboard operated using a pointing device) of his or her computerized device.

[0028] Based on step 202, method 200 can utilize the keystroke dynamic authentication function of the system to create a conventional keystroke dynamic model of the relevant user. In one embodiment, the keystroke dynamic authentication function is an aspect of the authentication system that method 200 can utilize according to various aspects of the present invention. Embodiments of the present invention can perform the conventional method of step 202, so it is not described here.

[0029] In step 204, method 200 extracts a set of features that characterize typing changes between a plurality of typing samples from each of the typing sessions. In various embodiments, the process of extracting features from the typing sessions in step 204 may include sub-steps 204a, 204b, and 204c, which are discussed in further detail below.

[0030] In sub-step 204a, method 200 calculates the directed graph waiting time between the keystroke events of each typing sample. As known in the field of keystroke dynamics, the directed graph waiting time is the time difference between two keystroke events. For example, such a keystroke event may include press to continuous press, press to continuous release, release to continuous release, and / or release to continuous press. In an exemplary embodiment, the keystroke event is key-agnostic, that is, the event only considers the continuous position of each pressed key in the typing sample, without considering the identity of the key itself (the specific letter, number or symbol entered). As a simplified example, based on the typing sample of the credential "a1b", the three characters are given serial numbers from 1 to 3 respectively; then, the nine directed graph waiting times can be calculated as follows:

[0031]

[0032] Table 1: Directed graph waiting time calculation for four keystroke event types

[0033] In order to take into account the fact that credentials of different users may have different lengths, method 200 does not need to use all of the calculated directed graph wait times of four exemplary keystroke event types. Instead, method 200 can reduce the calculated directed graph wait time to a single value for each keystroke event type. For example, method 200 can utilize the median or average value of the directed graph wait time of each keystroke event type as a representative value of the keystroke event type. With reference to the above example, if the press-to-continuous release wait time is 300ms (milliseconds) for key #1, 170ms for key #2, and 130ms for key #3, method 200 can utilize the average value 200ms or the median 170ms to represent the directed graph wait time of the keystroke event in the typing sample in a manner that is agnostic to the length of the credentials.

[0034] In another embodiment, method 200 may also calculate (for each typing sample) a directed graph wait time between the first of the keystroke events (in the above example, pressing key #1) and the last of the keystroke events (in the above example, releasing key #3). Even though this directed graph wait time is clearly dependent on the length of the credential typed, this value may still be a useful metric when comparing such directed graph wait times across all typed samples. For example, method 200 may utilize this value to observe that a particular user tends to type each successive sample 20% faster than the previous sample, as will be discussed further below.

[0035] In another embodiment, the method 200 may also calculate (for each typing sample) the directed graph waiting time between the first keystroke event in the keystroke events (in the above example, pressing key #1) and the last keystroke event in the keystroke events of the previous typing sample (not shown in the above example). In other words, this is the interval between each two consecutive typing samples. Naturally, the method 200 does not calculate the value for the initial typing sample in the typing session, but only the second and subsequent typing samples.

[0036] In addition to the above-mentioned directed graph waiting times, or in place of some of these directed graph waiting times, embodiments of the present invention can operate to calculate and utilize directed graph waiting times between other types of keystroke-related events in each typing sample. In addition, embodiments of the present invention can calculate various statistical measures of more than two keystroke events at a time.

[0037] In an example embodiment, when sub-step 204a is completed, each keystroke session is optionally represented as a feature matrix, where the rows are consecutive samples of the keystroke session and the columns are the corresponding features (i.e., the calculated various types of directed graph waiting times). An example of such a feature matrix is ​​shown in Table 2 below.

[0038] For example, assuming that a typing sample has six directed graph latencies (press to continuous press, press to continuous release, release to continuous press, first press to last release, and interval to previous typing sample), method 200 operates (via substep 204a) to provide six corresponding features. For example, if the system records a user typing their credentials ten times in a row, the feature matrix of the keystroke session is of order 10×6.

[0039] Feature 1 Feature 2 … Feature N Sample 1 Sample 2 … Sample N

[0040] Table 2: Characteristic matrix for a keystroke session. Column and row headers are shown for convenience only and need not be included in the actual matrix.

[0041] In sub-step 204b, for each of the typing sessions, method 200 may calculate a change in directed graph latency between at least some of the typing samples. The calculation of sub-step 204b may operate to detect temporal changes in how the respective user types the credentials along the typing session. Typically, the typing dynamics tend to change gradually as the user progresses along the sequence of typing samples. This change is typically the result of a user's rapid cognitive improvement in performing such a typing task.

[0042] Various embodiments of the present invention may perform calculations of changes in a pair-wise method, where each pair includes values ​​of features from two typing samples in the typing sample (directed graph waiting time). The samples may be continuously typed samples (e.g., sample 1 and sample 2) or non-continuously typed samples (e.g., sample 2 and sample 5). Another option is to aggregate feature values ​​from two or more typing samples (continuous or non-continuous) and compare the aggregate with feature values ​​from a single typing sample or even with another aggregate. For example, the aggregation may include statistical calculations such as averaging values. As another example, the aggregation may include comparing a feature in a sample (e.g., sample 1) with the same feature in each of several other samples (e.g., samples 2, 3, 4, and 5); then, the calculated change along the sample may be, for example, a rate of change, which may be linear, exponential, or even defined by a custom function (e.g., a polynomial function, a piecewise function, etc.).

[0043] It is worth noting that not all typing samples must participate in the calculation. For example, an embodiment of the present invention may determine in a specific scenario that the calculation based only on the first two typing samples and the last two typing samples adequately captures the most significant time changes along the keystroke session. In such a scenario, the previous sub-step 204a does not have to include the directed graph waiting time calculation for any unused typing samples.

[0044] The pairwise calculation of substep 204b may include at least one mathematical operation applied to the two values ​​of the pair. For example, the values ​​may be subtracted, added, multiplied, divided, raised to the power of each other, averaged, and / or the like. The method 200 may also operate to amplify the values, or linearly or exponentially attenuate the values ​​by some predetermined factor.

[0045] Then, in sub-step 204C, method 200 may generate a unified feature vector for each of the typing sessions. That is, method 200 may generate feature vectors with a length and structure that is unified across all typing sessions, which may uniformly ensure that representations of different users' typing sessions remain indifferent to credential lengths that vary across users.

[0046] The generation of each unified feature vector in sub-step 204c may include statistical processing of the calculated changes for the corresponding keystroke session. This processing may require the calculation of one or more statistical functions, such as standard deviation, mean, median, mean gradient, and / or histogram analysis of the changes calculated in the previous sub-step 204b, which are just a few examples of statistical functions that can be used. One or more other statistical functions known in the art may also be used, as long as they can meaningfully summarize the multiple calculated changes for each feature.

[0047] For each typing session, the statistical processing can produce a numerical value for each feature that represents the temporal change of the feature along the typing session. The numerical values ​​of all features of the typing session form a unified feature vector for the typing session. Since method 200 can uniformly apply sub-steps 204a, 204b, and 204c to all typing sessions, the resulting feature vector is indeed uniform in length (the number of features it contains) and structure (the types of features and their order in the vector).

[0048] Optionally, each feature vector also undergoes dimensionality reduction in order to compress it in a way that preserves its most important characteristics. For example, various embodiments of the present invention may utilize principal component analysis (PCA) or linear discriminant analysis (LDA), as known in the art, to reduce dimensionality. As another option, embodiments of the present invention may apply a feature selection algorithm known in the art to each feature vector in order to search for and evaluate various different feature subsets that better characterize the temporal typing changes along a keystroke session.

[0049] Next, in step 206, method 200 stores the feature set (extracted in step 204, i.e., the feature vector finally generated in sub-step 204c) in a computerized database. The database may be a computerized database of system 100 ( Figure 1 ) or may be included in a separate computer server that is in network communication with the system.

[0050] It is worth noting that when new users occasionally register system 100 ( Figure 1 ), method 200 may perform steps 202-206 for each such registration and then add the generated feature vector to the database. Similarly, whenever a credential change process is initiated for an existing user, method 200 may perform steps 202-206 and the generated feature vector replaces the old feature vector for that user in the database. When operating to newly apply the present technology to a system with pre-existing users, method 200 may perform steps 202-206 for the user's previously recorded keystroke sessions, assuming that these records are retained from when the user initially registered.

[0051] In step 208, method 200 detects an attempt by an attacker to circumvent the system's keystroke dynamic authentication and log into the system. For example, according to various embodiments of the present invention, detection may be performed by the system's keystroke dynamic authentication function or by any other security-related function of the system.

[0052] The detected attempt may include repeatedly typing in one of the credentials associated with a particular user. The method 200 may make failed attempts once a predetermined number of attempts are logged, such as 3, 4, or 5 attempts (or any other smaller or larger number of attempts defined by a system administrator). Detection of failed attempts indicates that anyone who typed in the credentials may not be the real user who owns the associated user account, but rather an attacker who has managed to somehow compromise the user's credentials and is attempting to log into the system as that user.

[0053] In step 210, method 200 extracts a set of features that characterize the typing changes between detected repetitions from the repeated typing. The feature extraction step may include the same operations performed on the system user's typing session in step 204 (mutatis mutandis). That is, method 200 may treat each typing of the credential by the attacker in the same manner as a typing sample of the user, and treat a series of repeated typing the same as a typing session of the user. Therefore, the description of extracting a set of features from the attacker's repeated typing is not repeated here, and is discussed in more detail above.

[0054] When step 210 is completed, method 200 can provide a final feature set of the attack attempt, optionally represented as a feature vector. In the execution of step 210, method 200 can perform all operations in the same manner as the operations performed for each keystroke session in step 204, so that the feature vector of the attack attempt is consistent with the feature vectors of all keystroke sessions (in length and structure). Therefore, the feature vectors can be easily compared later.

[0055] In step 212, method 200 compares the signature set of the attack attempt with signature sets of at least some of the keystroke sessions of system users obtained from the database. In optional sub-step 212a, in order to reduce the heavy computational load that may be generated by comparing the signature set of the attacker with the signature sets of keystroke sessions of all users of the system, method 200 may perform an intelligent selection of a smaller number of users. For example, the selection may be keystroke sessions associated with users linked in the system to a user whose account is the target of the attack. For example, if the system is a social network (e.g., a social networking website or platform, etc.) or an instant messaging platform (e.g., an Internet messaging service, a social media messaging service, etc.), the comparison may be performed only for keystroke sessions of users that the system defines as being linked to the target user (e.g., a "friend").

[0056] Additionally or alternatively, various embodiments of the invention may exploit any implicit links between users of the computerized system to narrow the list of users with which to compare keystroke sessions. For example, such implicit links may be inferred from the existence of past interactions between users within the system, such as direct message exchanges between users, interaction of one user with content posted in the system by another user (e.g., commenting on a post, "liking" a post, etc.), and the like.

[0057] In an example embodiment, method 200 may base the comparison of step 212 on a machine learning algorithm that generates, for each keystroke session of the selected user, a probability score representing the likelihood that the associated user is an attacker. The machine learning algorithm may be, for example, a random forest algorithm, a support vector machine (SVM), a naive Bayes algorithm, etc. Those skilled in the art will recognize other machine learning algorithms suitable for generating probability scores.

[0058] Various embodiments of the present invention may train a machine learning algorithm on a training set that includes feature vectors for multiple users (e.g., at least 50, 100, 200, or 500 users), each feature vector being labeled with a unique identifier for the associated user (e.g., a simple serial number assigned to the user for training purposes). In the training set, each user has at least one feature vector associated with that user. However, it may be beneficial to have multiple feature vectors for each user, i.e., feature vectors generated from separate keystroke sessions for the user that were recorded at least minutes, hours, or even days apart. Embodiments of the present invention recognize that the more feature vectors available for each user, the better the machine learning algorithm can learn the underlying characteristics of those feature vectors that cause them to belong to the same category represented by the label (i.e., user identifier).

[0059] The machine learning model (also called a "classifier") produced by such training is then able to calculate the probability that a new, previously unseen feature vector belongs to various known categories, which are existing users of the system (or a narrowed subset of users). That is, when the trained machine learning model is applied to a new feature vector (i.e., an attack feature vector), the trained machine learning model will assign a probability score to each existing user.

[0060] As an alternative to machine learning, method 200 can base the comparison of step 212 on a mathematical distance metric that quantifies the distance (or "similarity") between each two feature vectors (the attacker's vector and one of the users' vectors). Examples of suitable distance metrics include Manhattan distance, Euclidean distance, Chebyshev distance, etc. Those skilled in the art will recognize other mathematical distance metrics suitable for calculating the distance between two feature vectors.

[0061] Next, in step 214, method 200 estimates that the user is a possible attacker. In various embodiments, method 200 determines this estimate based on the comparison results of step 212, and method 200 identifies the user (i.e., keystroke session feature vector) whose comparison with the attacker (i.e., attack feature vector) produces the highest probability score (in the case of a machine learning algorithm) or the shortest distance (in the case of a mathematical distance metric) as the estimated attacker. If multiple users have the same highest probability score or the same shortest distance, method 200 may mark all corresponding users as potential attackers.

[0062] In addition, the method 200 can be operated to output a ranked list of possible attackers based on the top k probability scores or the bottom k distances, where k can be set as desired, such as between 2 and 20 or more. In either case, the method 200 can send the identity of the possible attacker (i.e., details of the corresponding user account in the system (e.g., username, email address, linked single sign-on account, etc.)) to an administrator of the system, a person responsible for system security, etc. That person can take measures to stop the attack or prevent subsequent attacks, such as by suspending the attacker's user account, requiring the target user to change their credentials, etc. Alternatively, once the possible identity of the attacker becomes known, embodiments of the present invention can automatically initiate one or more such measures by the system.

[0063] One of the advantages of the present technique is that it can potentially create a deterrent among potential attackers. Once it is known that a system uses the present technique to identify attackers, potential attackers will likely be discouraged from targeting users of the system; the attacker will understand that any attempt to log into other user accounts in the system by repeatedly typing in the user's compromised credentials will only allow the system to associate the attack with the attacker's own user account, which they opened in preparation for the attack. Therefore, unless the attacker is certain that they can circumvent the system's keystroke dynamic authentication function on the first try or the first few tries (which is highly unlikely), the attacker will know that repeatedly typing in user credentials will only further expose them.

[0064] The present technology can be used in conjunction with other conventional measures of computer security forensics. For example, in addition to logging each user's keystroke session and the attacker's attempts, identifiers such as IP addresses, user agent strings, and / or MAC (media access control) addresses can be collected. If the attacker maintains the same identifier from the time they register the user account to the time they perform the attack, then associating the attack with a specific user account can be done with a higher degree of confidence. Additional possibilities for identifiers include those created by conventional behavioral biometric techniques, such as unique patterns of pointing device movement, touch screen interaction, and the like. In general, the collection of the present technology with one or more additional user identifiers can enhance the accuracy of the estimate of who the attacker is among the users of a particular system.

[0065] The present invention may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform various aspects of the present invention.

[0066] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0067] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0068] The computer-readable program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider via the Internet). In some embodiments, in order to perform various aspects of the present invention, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute a computer-readable program instruction by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0069] Aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flow chart and / or block diagram and the combination of frames in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0070] These computer-readable program instructions can be provided to a processor of a computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0071] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0072] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in the flow chart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, the two frames shown in succession can actually be implemented as a step, and are executed simultaneously, substantially simultaneously, in a partially or entirely overlapping manner, or these frames can sometimes be executed in reverse order, depending on the functions involved.It will also be noted that each frame of the block diagram and / or flow chart illustration and the combination of the frames in the block diagram and / or flow chart illustration can be implemented by a dedicated hardware-based system that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

[0073] The description of a numerical range should be considered to have specifically disclosed all possible subranges as well as individual numbers within that range. For example, the description of a range from 1 to 6 should be considered to have specifically disclosed subranges such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6, etc., as well as individual numbers within that range, such as 1, 2, 3, 4, 5, and 6.

[0074] The description of various embodiments of the present invention has been given for the purpose of illustration, but it is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the present invention. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements existing in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method comprising: recording, by one or more processors, respective keystroke sessions for a plurality of users of a computerized system, the respective keystroke sessions comprising a plurality of typing samples of credentials associated with respective users of the plurality of users, wherein the plurality of typing samples are continuously typed by the respective users; extracting, by one or more processors, from each respective one of the respective typing sessions, a set of features characterizing typing changes between the plurality of typing samples; detecting, by one or more processors, an attempt by a first user to circumvent keystroke dynamic authentication and log into the computerized system by detecting repeated typing of one of the credentials associated with one of the plurality of users; extracting, by one or more processors, from the repeated typing of the certain credential by the first user, a set of features characterizing changes in typing between repetitions; as well as The set of features extracted from the repeated typing of the credentials by the first user is compared, by one or more processors, with the set of features extracted from the set of keystroke sessions to estimate which user of the plurality of users is the first user.

2. The method of claim 1 , wherein the extracting of the set of features from each of the respective typing sessions comprises: For each of the typing samples, calculate: (a) a directed graph of latency between key-agnostic keystroke events, wherein the keystroke events are selected from the group consisting of: press to continuous press, press to continuous release, release to continuous release, and release to continuous press, (b) a directed graph waiting time between a first keystroke event among the keystroke events and a last keystroke event among the keystroke events; as well as For each of the typing samples except the initial typing sample in the typing samples, calculate: (c) a directed graph of waiting times between a first one of the keystroke events and a last one of the keystroke events of a previous typing sample.

3. The method of claim 2, wherein the extracting of the set of features from each of the respective ones of the respective typing sessions further comprises: One or more processors calculate a change in the directed graph wait time of at least one of the directed graph wait times selected from the group consisting of: the directed graph wait time between key-agnostic keystroke events, the directed graph wait time between a first keystroke event of the keystroke events and a last keystroke event of the keystroke events, and between at least some of the typing samples, the directed graph wait time between a first keystroke event of the keystroke events and a last keystroke event of the keystroke events in the previous typing sample.

4. The method of claim 3, wherein the extracting of the set of features from each of the respective ones of the respective typing sessions further comprises: processing, by one or more processors, the calculated changes statistically to generate a feature vector for the corresponding keystroke session, and Wherein the feature vectors of the keystroke session are generated with uniform length and uniform structure.

5. The method of claim 1 , wherein the extracting of the feature set from the repeated entry of the certain credential by the first user comprises: For each of the replicates, calculate: (a) a directed graph of latency between key-agnostic keystroke events, wherein the keystroke events are selected from the group consisting of: press to continuous press, press to continuous release, release to continuous release, and release to continuous press, (b) a directed graph waiting time between a first keystroke event among the keystroke events and a last keystroke event among the keystroke events; as well as For each of the repetitions except an initial one of the repetitions, calculate: (c) a directed graph of waiting times between a first one of the keystroke events and a last one of the keystroke events of a previous typing sample.

6. The method of claim 5, wherein the extracting of the feature set from the repeated entry of the certain credential by the first user further comprises: Changes in the directed graph wait time of at least one of the following are calculated by one or more processors: the directed graph wait time between key-agnostic keystroke events, the directed graph wait time between a first one of the keystroke events and a last one of the keystroke events, and between at least some of the repetitions, the directed graph wait time between a first one of the keystroke events and a last one of the keystroke events of a previous repetition.

7. The method of claim 6, wherein the extracting of the feature set from the repeated entry of the certain credential by the first user further comprises: The calculated changes are statistically processed by one or more processors to generate a feature vector for the attempt by the first user.

8. The method of claim 1, wherein the comparing is based on a machine learning algorithm.

9. The method of claim 1, wherein the comparison is based on a mathematical distance metric.

10. The method according to claim 1, further comprising: Keystroke sessions associated with respective users linked to the certain user in the computerized system are selected, by one or more processors, as the set of keystroke sessions used in the comparison.

11. A computer program product comprising: One or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions comprising: program instructions to record respective typing sessions for a plurality of users of a computerized system, the respective typing sessions comprising a plurality of typing samples of credentials associated with respective users of the plurality of users, wherein the plurality of typing samples are continuously typed by the respective users; program instructions to extract, from each respective one of the respective typing sessions, a set of features characterizing typing changes between the plurality of typing samples; program instructions for detecting an attempt by a first user to circumvent keystroke dynamic authentication and log into the computerized system by detecting repeated typing of one of the credentials associated with one of the plurality of users; Program instructions for extracting from the repeated typing of the certain credential by the first user a set of features characterizing changes in typing between repetitions; and Program instructions to compare the set of features extracted from the repeated typing of the credentials by the first user with the set of features extracted from the set of keystroke sessions to estimate which of the plurality of users is the first user.

12. The computer program product of claim 11, wherein the extracting of the set of features from each respective one of the respective typing sessions comprises: For each of the input samples, program instructions for calculating: (a) a directed graph of latency between key-agnostic keystroke events, wherein the keystroke events are selected from the group consisting of: press to continuous press, press to continuous release, release to continuous release, and release to continuous press, (b) a directed graph waiting time between a first keystroke event among the keystroke events and a last keystroke event among the keystroke events; as well as For each of the typing samples except an initial one of the typing samples, program instructions to calculate: (c) a directed graph of waiting times between a first one of the keystroke events and a last one of the keystroke events of a previous typing sample.

13. The computer program product of claim 11, wherein the extracting of the set of features from the repeated entry of the certain credential by the first user comprises: For each of the repetitions, program instructions to calculate: (a) a directed graph of latency between key-agnostic keystroke events, wherein the keystroke events are selected from the group consisting of: press to continuous press, press to continuous release, release to continuous release, and release to continuous press, (b) a directed graph waiting time between a first keystroke event among the keystroke events and a last keystroke event among the keystroke events; as well as For each of the repetitions except an initial one of the repetitions, program instructions to calculate: (c) a directed graph of waiting times between a first one of the keystroke events and a last one of the keystroke events of a previous typing sample.

14. The computer program product of claim 11, further comprising program instructions stored on the one or more computer-readable storage media to: Keystroke sessions associated with respective users linked to the certain user in the computerized system are selected as the set of keystroke sessions used in the comparison.

15. A computer system comprising: one or more computer processors; one or more computer-readable storage media; as well as program instructions stored on the computer-readable storage medium for execution by at least one of the one or more processors, the program instructions comprising: program instructions to record respective typing sessions for a plurality of users of a computerized system, the respective typing sessions comprising a plurality of typing samples of credentials associated with respective users of the plurality of users, wherein the plurality of typing samples are continuously typed by the respective users; program instructions to extract, from each respective one of the respective typing sessions, a set of features characterizing typing changes between the plurality of typing samples; program instructions for detecting an attempt by a first user to circumvent keystroke dynamic authentication and log into the computerized system by detecting repeated typing of one of the credentials associated with one of the plurality of users; program instructions for extracting from the repeated typing of the certain credential by the first user a set of features characterizing changes in the typing between the repetitions; as well as Program instructions to compare the set of features extracted from the repeated typing of the credentials by the first user with the set of features extracted from the set of keystroke sessions to estimate which of the plurality of users is the first user.

16. The computer system of claim 15, wherein the extracting of the set of features from each of the respective ones of the respective typing sessions comprises: For each of the input samples, program instructions for calculating: (a) a directed graph of latency between key-agnostic keystroke events, wherein the keystroke events are selected from the group consisting of: press to continuous press, press to continuous release, release to continuous release, and release to continuous press, (b) a directed graph waiting time between a first keystroke event among the keystroke events and a last keystroke event among the keystroke events; as well as For each of the typing samples except an initial one of the typing samples, program instructions to calculate: (c) a directed graph of waiting times between a first one of the keystroke events and a last one of the keystroke events of a previous typing sample.

17. The computer system of claim 16, wherein the extracting of the feature set from each of the respective ones of the respective typing sessions further comprises program instructions to: Calculate a change in the directed graph wait time of at least one of the directed graph wait times selected from a group comprising: the directed graph wait time between key-agnostic keystroke events, the directed graph wait time between a first keystroke event of the keystroke events and a last keystroke event of the keystroke events, and between at least some of the typing samples, the directed graph wait time between a first keystroke event of the keystroke events and a last keystroke event of the keystroke events in a previous typing sample.

18. The computer system of claim 15, wherein the extracting of the feature set from the repeated entry of the certain credential by the first user comprises: For each of the repetitions, program instructions to calculate: (a) a directed graph of latency between key-agnostic keystroke events, wherein the keystroke events are selected from the group consisting of: press to continuous press, press to continuous release, release to continuous release, and release to continuous press, (b) a directed graph waiting time between a first keystroke event among the keystroke events and a last keystroke event among the keystroke events; as well as For each of the repetitions except an initial one of the repetitions, program instructions to calculate: (c) a directed graph of waiting times between a first one of the keystroke events and a last one of the keystroke events of a previous typing sample.

19. The computer system of claim 18, wherein the extracting of the feature set from each of the respective ones of the respective typing sessions further comprises program instructions to: Calculate the change in the directed graph wait time of at least one of the following: the directed graph wait time between key-agnostic keystroke events, the directed graph wait time between a first one of the keystroke events and a last one of the keystroke events, and between at least some of the repetitions, the directed graph wait time between a first one of the keystroke events and a last one of the keystroke events of a previous repetition.

20. The computer system of claim 15, further comprising program instructions stored on the computer-readable storage medium for execution by at least one of the one or more processors to: Keystroke sessions associated with respective users linked to the certain user in the computerized system are selected as the set of keystroke sessions used in the comparison.

Images