System, apparatus, and method for automatically generating negative keystroke examples and training user identification models based on keystroke dynamics

Abstract

An apparatus adapted to identify a user based on keystroke dynamics of a user's input, the apparatus being adapted to: perform a first training phase of training a keystroke sample generator to generate a negative keystroke sample; performing a second training stage of training the user recognition model based at least in part on the plurality of negative keystroke samples generated using the keystroke sample generator; and performing a deployment of the user identification model to authenticate an input sample associated with the user using the trained user identification model.

Description

Technical Field

[0001] The present disclosure generally relates to a computer-implemented method for identifying a user based on the keystroke dynamics of the user's input, and more particularly to a machine learning-based technique for generating synthetic negative keystroke samples for training a user recognition model for identifying a user based on keystroke samples received from the user. Background Art

[0002] Keystroke dynamics is a type of behavioral biometric that is used to identify individuals based on their typing characteristics, regardless of whether the typing is performed on a physical keyboard or a virtual keyboard. In other words, users of computing devices equipped with physical or virtual keyboards can be identified by analyzing their keyboard typing patterns. The scenarios in which keystroke dynamics systems are implemented can be divided into two categories: fixed text and free text. In fixed text scenarios, the text sequence used for user registration and the text sequence used during user authentication are the same, for example to represent a password or username. In free text scenarios, the registration and authentication text sequences typed by the user do not necessarily match, that is, the user can type any text.

[0003] Existing state-of-the-art approaches for this task are typically based on machine learning models that take as input a sequence of keystrokes and release timestamps (events) and predict the probability that the input sequence belongs to a specific user. Machine learning models are likely to achieve better accuracy when the input text is fixed. User identification in fixed-text scenarios is typically approached as a binary classification problem or as an outlier detection problem.

[0004] In related research, the problem is typically studied and evaluated in a simulated binary classification environment, where multiple users type the same text, which enables training and testing of binary classifiers that benefit from both positive and negative training keystroke samples from each user. The system learns to classify keystroke examples into genuine and imposter instances using both positive data samples collected from the target user (the user to be identified) and negative data samples collected from other users. Ideally, the binary classification system uses keystroke examples typed by other users (impostors, attackers) for the same text sequences as keystroke examples typed by genuine users. In the relevant literature, there are studies such as "Antal, M., Nemes, L.: The MOBIKEYKeystroke Dynamics Password Database: Benchmark Results. In: Software Engineering Perspectives and Applications in Intelligent Systems. Advances in Intelligent Systems and Computing, vol. 465, pp. 35–46, Springer, 2016," which empirically show that binary classification methods produce better results when negative data samples from other users are available at training time. However, this scenario is unrealistic because in real-world environments, each user has a different username and password. Furthermore, in real-world applications, for example, it is impossible to consistently collect negatively labeled training examples generated by actual imposters for each and every genuine user. Therefore, this scenario can only be tested under simulation or laboratory conditions.

[0005] In this context, the conventional approach used in the literature is to employ a single-class machine learning model, trained only on positive keystroke samples belonging to the target user. In the context of outlier detection, the system examines new text examples (recorded during the user identification phase) for deviations (differences) from the keystroke samples available during training, while only data samples collected from the target (real) user (the user to be identified) are used to train the system. In other words, outlier detection systems do not use negative training examples (collected from other users).

[0006] Therefore, one reason why using keystroke biometrics for user identification is a difficult task is the lack of sufficient negative examples collected in real-world environments. Such negative examples are a key ingredient for strengthening the ability of biometric systems based on keystroke dynamics to distinguish between legitimate users and possible attackers.

[0007] Conventional approaches to using negative examples rely primarily on statistical principles. One such approach uses negative examples corresponding to different character strings typed by other users. However, this approach entangles the user identification task with the text classification task. For example, positive examples may be distinguished from negative examples based on the text typed rather than the keystroke dynamics. Consequently, without access to negative keystroke examples containing the same text as the positive examples, such models tend to produce significantly more prediction errors in real-world environments than in simulated laboratory environments. Summary of the Invention

[0008] In view of the shortcomings of conventional keystroke profiling techniques and the improvements provided by effective negative samples, the present disclosure provides systems and methods for automatically generating negative keystroke samples of target text based on keystroke dynamics and using the generated examples to train a binary classifier for user identification.

[0009] There has been research on generating synthetic keystroke samples.

[0010] In one such study, to increase the number of samples in the case of fixed text (typically, passphrase) datasets, "Migdal, D., Rosenberger, C.: Statistical modeling of keystroke dynamics samples for the generation of synthetic datasets. Future Generation Computer Systems, vol. 100, pp. 907–920, 2019" evaluated a collection of 19 distributions to understand which one had the best ability to represent six durations that could be extracted from any two-character symbol from samples belonging to real users. The authors concluded that, in general, the durations follow a normal, logistic, or Gumbel distribution. The synthetic keystroke data was generated with the help of six random engine generators that follow a given law with parameters estimated for each symbol and user.

[0011] In another study, "González, N., Calot, EP, Ierache, JS, Hasperué, W.: Towards liveness detection in keystroke dynamics: Revealing synthetic forgeries. Systems and Soft Computing, vol. 4, p. 200037, 2022," sequences of keys and their incoming keystroke timings are generated to provide a spoofing method based on past observations of the keystroke timings of keys in free text, observations collected from target users, or from a general population. The timings are generated using a variety of different methods, such as by averaging timing values from past observations or by sampling the inverse of a continuous distribution function with random numbers between zero and one. When data from the target user is accessible, sampling methods have been found to be most successful in improving the false acceptance rate.

[0012] The authors of "Monaco, JV, Ali, ML, Tappert, CC: Spoofing key-press latencies with a generative keystroke dynamics model. In: IEEE International Conference on Biometrics Theory, Applications and Systems, pp. 1–8, IEEE, 2015" propose a language buffering and motion control model that leverages observations of keystroke latencies from actual keypress and keyrelease timestamps, without requiring knowledge of the key names. The model generates an empirical distribution of keystroke latencies. The generative model uses a two-state hidden Markov model to determine whether the user is in an active or passive state based on the observed keystroke latencies. The model generates lognormal random variables for each possible distance between keys of a predefined text containing information about the distance between keys on the physical keyboard. In other words, the generative model maps the observed typing patterns of a target user to predetermined text that can be further exploited for spoofing. Experiments show that once approximately 50 keystrokes are observed for each given user, the model begins generating synthetic samples that can increase the equal error rate (EER) of the biometric recognition system to 0.6.

[0013] "Huster, T., Cohen, J., Lin, Z., Chan, K., Kamhoua, C., Leslie, NO, Chiang, CYJ, Sekar, V.: Pareto GAN: Extending the representational power of GANs to heavy-tailed distributions. In: International Conference on Machine Learning, pp. 4523–4532, PMLR, 2021" proposes a different approach from previous methods. The authors argue that existing generative adversarial network (GAN) architectures are inherently unable to match the asymptotic behavior of heavy-tailed distributions. Therefore, they propose Pareto GAN as a solution by leveraging limit theory and the functional properties of neural networks to learn a distribution that matches the asymptotic behavior of the marginal distribution of features. Pareto GAN is shown to outperform three baseline GANs (uniform, normal, and lognormal) on the task of generating synthetic keystroke data with similarity to real data. Similarity was determined based on the Kolmogorov-Smirnov test statistic and the area between the log-log plots of the empirical cumulative distribution functions of the synthetic and real samples.

[0014] GANs were first proposed as a method for digital image generation in "Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial nets. In: Advances of Neural Information Processing, pp. 2672–2680, 2014." GANs consist of a generator and a discriminator trained in an adversarial manner, where the generator aims to produce realistic images and the discriminator aims to distinguish fake (generated) images from natural images.

[0015] The present disclosure provides an improved method for generating negative keystroke samples for training a user recognition classifier.

[0016] Different from the methods introduced in the related literature, this disclosure introduces a novel neural architecture called Generative Partner-Adversarial Network (GPAN) to generate keystroke samples. Unlike other GAN architectures, the disclosed architecture includes three actors instead of two:

[0017] 1. A multimodal generative neural network (which generates keystroke samples given a text sequence, a user ID, and a random noise vector). Typical generators take a single modality as input, while the disclosed generator is multimodal, with three modalities as input.

[0018] 2. Multi-class classification neural network (which distinguishes fake samples from several classes of real keystroke samples). Typical discriminators solve binary classification tasks (fake vs. real), while the disclosed discriminator is multi-class, distinguishing between real keystroke samples and fake keystroke samples belonging to different users.

[0019] 3. A recurrent neural network (which predicts whether the length of the generated keystroke sample is correct). Typical GANs do not use a regressor with a joint (rather than adversarial) objective with the generator.

[0020] The method includes two training phases. In the first training phase, a novel generative partner-adversarial network (GPAN) is trained on a dataset of keystroke timestamps recorded for a pool of users while typing free text. Unlike related generative adversarial networks (GANs), the present disclosure proposes a GPAN that takes a user ID, a string, and a random noise vector as input, and includes a user and text embedding layer before the generator, a multi-class classifier that predicts whether the generated keystroke sample is fake or belongs to a user from an existing dataset, a regressor that measures whether the generated sample has the correct length (according to the input string), and a temporal consistency loss that ensures that the generated timestamps are consistent in time. When the generator and the multi-class classifier are trained as opponents (with opposite goals), the generator and the regressor are trained as partners (with the same goal). Therefore, the proposed architecture has the name of a generative partner-adversarial network (GPAN).

[0021] In the second training phase, a binary user identification model is trained on positive keystroke timestamps collected while the target user types pre-established text, and negative keystroke timestamps generated by the disclosed GPAN architecture. Once the user identification model is trained, it can be deployed in a user identification system based on keystroke dynamics.

[0022] According to an example implementation of the present disclosure, an apparatus suitable for identifying a user based on the keystroke dynamics of the user's input comprises: a communication interface to one or more networks; one or more processing devices operably connected to the computer network interface; and one or more memory storage devices operably connected to the one or more processing devices and having machine-readable instructions stored thereon, which, when executed, cause the one or more processing devices to: receive, via the communication interface, a plurality of first text input samples of a plurality of first users in a first training phase of training a keystroke sample generator; and for each received first text input sample: generate a user identification representation, a noise representation, and a text sequence representation of the received first text input sample; use the keystroke sample generator to generate a keystroke sequence sample based on a combination of the generated user identification representation, the noise representation, and the text sequence representation; input the generated keystroke sequence sample and the actual keystroke sequence of the received first text input sample into the generated keystroke sequence sample. inputting the generated keystroke sequence samples into a classifier that performs user identification classification on the generated keystroke sequence samples; inputting the generated keystroke sequence samples and the actual keystroke sequence of the received first text input sample into a regressor that performs text character length regress on the generated keystroke sequence samples; and training the keystroke sample generator based on the user identification classification of the classifier and the text character length classification of the regressor; in a second training phase of training the user recognition model, receiving one or more second text input samples of a second user via the communication interface, the second user being different from the multiple first users; using the keystroke sample generator to generate multiple negative keystroke samples based on the one or more second text input samples; and training the user recognition model on the user classification of the second user based on the one or more second text input samples and the generated multiple negative keystroke samples; and in the deployment of the user recognition model, receiving a third text input sample associated with the second user via the communication interface; and authenticating the third text input sample using the trained user recognition model.

[0023] According to one implementation, the user identification representation and the text sequence representation are generated using corresponding embedding neural layers.

[0024] According to one implementation, the user identification representation and the noise representation are generated using corresponding neural layers to conform to the format of the text sequence representation.

[0025] According to one implementation, the classifier is a multi-class discriminator implemented by a neural network, and the regressor is a recurrent neural network.

[0026] According to one implementation, the training of the keystroke sample generator, the user identification classification of the classifier, and the text character length regression of the regressor are based on

[0027]

[0028] in,

[0029] G represents the keystroke sample generator,

[0030] D represents the multi-class discriminator,

[0031] R represents the regressor,

[0032] x represents an array of press and release timestamps of the typed text sequence of the first text input sample received,

[0033] t represents the typed text sequence of the received first text input sample,

[0034] u represents a one-hot encoded vector representing an ID associated with one of a plurality of first users who typed the received first text input sample or a label indicating an input sample generated to a classifier,

[0035] λ1 is a hyperparameter that controls the importance of temporal consistency loss,

[0036] λ2 is a hyperparameter that controls the importance of the mean squared error (MSE) loss with respect to the text character length of the generated keystroke sequence samples,

[0037]

[0038] E represents the expected value,

[0039] p data represents the probability distribution of the data,

[0040] p z represents the noise distribution,

[0041] k represents the number of the first users,

[0042]

[0043] y=G(z|u,t), so y i,0 and y i,1 represents the press and release timestamps of the i-th key in sequence t,

[0044] n represents the sequence length, and

[0045]

[0046] According to one implementation, the plurality of negative keystroke samples is generated by the generator based on one or more of a plurality of first text input samples associated with one or more of a plurality of first users, the plurality of first users being different from the second user.

[0047] According to one implementation, at least one negative keystroke sample is generated based on one of a plurality of first text input samples, the one of the plurality of first text input samples including the same character sequence as one or more second text input samples.

[0048] According to one implementation, the user identification model is a binary classifier that determines whether the keystroke sequence of the third text input sample corresponds to the second user based on user classification training.

[0049] According to one implementation, the plurality of first text input samples include a plurality of free text inputs of the first user.

[0050] According to one implementation, the one or more second text input samples include fixed text input of the second user.

[0051] According to an example implementation of the present disclosure, a method for identifying a user based on the keystroke dynamics of the user's input includes: in a first training phase of training a keystroke sample generator, a processing device receives a plurality of first text input samples of a plurality of first users via a communication interface; and for each received first text input sample: the processing device generates a user identification representation, a noise representation, and a text sequence representation of the received first text input sample; the processing device uses the keystroke sample generator to generate a keystroke sequence sample based on a combination of the generated user identification representation, the noise representation, and the text sequence representation; the processing device inputs the generated keystroke sequence sample and the actual keystroke sequence of the received first text input sample into a classifier that performs user identification classification on the generated keystroke sequence sample; the processing device inputs the generated keystroke sequence sample and the actual keystroke sequence of the received first text input sample into a classifier that performs user identification classification on the generated keystroke sequence sample a regressor for regressing text character length based on the generated keystroke sequence samples; and a processing device trains a keystroke sample generator based on the user recognition classification of the classifier and the text character length classification of the regressor; in a second training phase of training the user recognition model, the processing device receives one or more second text input samples of a second user via a communication interface, and the second user is different from the multiple first users; the processing device uses the keystroke sample generator to generate multiple negative keystroke samples based on the one or more second text input samples; and the processing device trains the user recognition model on the user classification of the second user based on the one or more second text input samples and the generated multiple negative keystroke samples; and in the deployment of the user recognition model, the processing device receives a third text input sample associated with the second user via the communication interface; and the processing device uses the trained user recognition model to authenticate the third text input sample.

[0052] According to one implementation, the user identification representation and the text sequence representation are generated using corresponding embedding neural layers.

[0053] According to one implementation, the user identification representation and the noise representation are generated using corresponding neural layers to conform to the format of the text sequence representation.

[0054] According to one implementation, the classifier is a multi-class discriminator implemented by a neural network, and the regressor is a recurrent neural network.

[0055] According to one implementation, the training of the keystroke sample generator, the user identification classification of the classifier, and the text character length regression of the regressor are based on

[0056]

[0057] in,

[0058] G represents the keystroke sample generator,

[0059] D represents the multi-class discriminator,

[0060] R represents the regressor,

[0061] x represents an array of press and release timestamps of the typed text sequence of the first text input sample received,

[0062] t represents the typed text sequence of the received first text input sample,

[0063] u represents a one-hot encoded vector representing an ID associated with one of a plurality of first users who typed the received first text input sample or a label indicating an input sample generated to a classifier,

[0064] λ1 is a hyperparameter that controls the importance of temporal consistency loss,

[0065] λ2 is a hyperparameter that controls the importance of the mean squared error (MSE) loss with respect to the text character length of the generated keystroke sequence samples,

[0066]

[0067] E represents the expected value,

[0068] p data represents the probability distribution of the data,

[0069] p z represents the noise distribution,

[0070] k represents the number of the first users,

[0071]

[0072] y=G(z|u,t), so y i,0 and y i,1represents the press and release timestamps of the i-th key in sequence t,

[0073] n represents the sequence length, and

[0074]

[0075] According to one implementation, the plurality of negative keystroke samples is generated by the generator based on one or more of a plurality of first text input samples associated with one or more of a plurality of first users, the plurality of first users being different from the second user.

[0076] According to one implementation, at least one negative keystroke sample is generated based on one of a plurality of first text input samples, the one of the plurality of first text input samples including the same character sequence as one or more second text input samples.

[0077] According to one implementation, the user identification model is a binary classifier that determines whether the keystroke sequence of the third text input sample corresponds to the second user based on user classification training.

[0078] According to one implementation, the plurality of first text input samples include a plurality of free text inputs of the first user.

[0079] According to one implementation, the one or more second text input samples include fixed text input of the second user. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Various example implementations of the present disclosure will be described in detail with reference to the following drawings, in which:

[0081] Figure 1 is a flow chart illustrating a process of training and deploying a user recognition model for recognizing users based on keystroke dynamics according to an example implementation of the present disclosure.

[0082] Figure 2 is a flowchart illustrating a process of a first training phase for training a keystroke sample generator according to an example implementation of the present disclosure.

[0083] Figure 3 is a diagram providing a schematic illustration of data and network structures for text input embedding according to an example implementation of the present disclosure.

[0084] Figure 4 is a diagram providing a schematic illustration of data and network structures for generating user ID embedding vectors according to one example implementation of the present disclosure.

[0085] Figure 5 is a diagram providing a schematic illustration of data and network structure for generating noise vectors according to an example implementation of the present disclosure.

[0086] Figure 6 is to provide an example implementation according to the present disclosure for combining Figures 3 to 5 A diagram showing a schematic illustration of the data and network structure representing a text input sequence, user ID, and noise vector and generating keystroke timestamps.

[0087] Figure 7 An example implementation according to the present disclosure is provided for Figure 6 Figure 1. Schematic illustration of the data and network structure for generating keystroke timestamps to perform user ID classification and regression training.

[0088] Figure 8 The present invention provides an exemplary embodiment of the present invention for Figure 6 and Figure 7 Figure 1. A diagram of the data and schematic illustration of the network structure for training a user recognition model using keystroke samples generated by a trained generator.

[0089] Figure 9 is a schematic diagram of a system for implementing a user identification process based on keystroke dynamics according to an exemplary embodiment of the present disclosure.

[0090] Figure 10 is a bar chart showing example results comparing user recognition results of a user recognition model trained with keystroke samples generated by a generator trained according to an exemplary embodiment of the present disclosure with the results of the same user recognition model trained with user-generated free text negative samples. DETAILED DESCRIPTION

[0091] As an overview, the present disclosure generally relates to machine learning techniques for user identification based on keystroke dynamics. The following example implementations include novel machine learning techniques, features of which can be incorporated into other types of entity recognition or differentiation without departing from the spirit and scope of the present disclosure.

[0092] The problem of user identification based on keystroke dynamics can be naturally solved using a binary classification algorithm, where the task is to determine whether a sequence of key presses and release timestamps belongs to a specific user. When the system is implemented for fixed and user-specific inputs (such as usernames, passwords, email addresses, etc.), the machine learning model requires negative data samples during training, i.e., samples typed by other users for fixed text belonging to the target user. However, this approach is impractical in real-life scenarios because for each new user registered in the system, it is not feasible or desirable to require other users to type the user-specific input of the newly registered user (e.g., a new username or email address) to obtain the negative data required to train the machine learning model.

[0093] To overcome this problem, this disclosure describes a method based on a Generative Partner-Adversarial Network (GPAN) to automatically generate synthetic negative examples that are passed to a user identification model. The disclosed GPAN generates press and release timestamps conditioned on a set of keystroke sequences generated by an existing set of users. The generator achieves its goal by learning a joint hidden representation of the user, key sequence, and noise vector.

[0094] Figure 1 is a flow chart illustrating a process 100 of training and deploying a user recognition model for identifying users based on keystroke dynamics according to an example implementation of the present disclosure.

[0095] like Figure 1 As an example, the process 100 begins with step s105 of training a keystroke sample generator, which represents the first training phase of the process 100. According to one embodiment, the keystroke sample generator is a negative keystroke sample generative neural network using user free text input 107, the input being a database of keystroke typing patterns from free text scenarios (e.g., Figure 9 In an embodiment, the keystroke typing pattern of the user text input 107 can be collected from the user and recorded in a database (e.g., Figure 9 In addition, user keystroke typing patterns can be continuously collected in real time, such as during a user registration and / or authentication process. In other embodiments, user text input 107 can be obtained from the user during one or more system training sessions, wherein the user is prompted to provide a text input sequence. Thus, in embodiments, user text input 107 can include free text input and / or fixed text input.

[0096] According to one embodiment, step s105 includes employing a generator that learns to generate keystroke samples for a given user ID and text sequence by using a random or pseudo-random noise vector as an input for learning. The generated keystroke samples are compared with the actual keystrokes of the text sequence of the user associated with the user ID by a multi-class discriminator (classifier) and a regressor. The regressor learns to predict the length of the input sequence, thereby acting as a partner of the generator by helping the generator generate keystroke sequences of the correct length. The multi-class classifier learns to distinguish between generated and actual keystroke samples, thereby acting as an adversary of the generator by attempting to exploit the generator's generation pattern. Thus, the generator, classifier, and regressor form a GPAN architecture.

[0097] After the keystroke sample generator is fully trained, the process 100 proceeds to step s110 of training the user identification model, which represents the second training phase of the process 100. According to one embodiment, a binary classifier is trained on the user identification task using both positive keystroke samples (collected from real users) and negative keystroke samples (automatically generated by the generator trained in step s105). According to an exemplary embodiment and as Figure 1 For example, a user input database (e.g., Figure 9 The system may randomly or pseudo-randomly sample positive typing samples ("user text input 117") from the database(s) 9345. In other embodiments, the positive typing samples ("user text input 117") may be obtained from a user during one or more system training sessions, wherein the user is prompted to provide a text input sequence.

[0098] The binary classifier can be any machine learning model, including but not limited to dense neural networks, convolutional neural networks, transformers, random forests, support vector machines, etc.

[0099] In the case where the user identification model is sufficiently trained using at least the generated negative keystroke samples, at step s115, a binary classifier is deployed to identify the user based on the keystroke dynamics of the received user text input 127. In other words, the binary classifier authenticates whether the received user text input 127 is truly from the associated user based on the keystroke dynamics. According to an exemplary embodiment of the present disclosure, the user text input 127 of step s115 is real-time input from the user - for example, during the user authentication process. Based on the training step s110 using at least the negative samples generated by the trained generator of step s105, the accuracy of the user identification performed at step s115 is significantly improved over conventional techniques.

[0100] First training phase (step s105)

[0101] Figure 2 is a flow chart illustrating a process 200 corresponding to step s105 according to an example implementation of the present disclosure.

[0102] like Figure 2 For example, the process 200 starts at step s205: generating a text input embedding representation based on the user free text input 107. According to an exemplary implementation of the present disclosure, the process 200 generates a text input embedding representation by extracting the text from a database (e.g., Figure 99345 in ), the database contains text input data (e.g., for #k users, #k is at least about 10) and a set of corresponding user identifications (user IDs) associated with each piece of text input data. In an exemplary embodiment, the text input data of step s205 and the sampled user free text input 107 include a sequence of n characters typed by the user of the sampled text input data (e.g., user #i). Next, in step s210, a user ID embedding vector based on the user ID (user #i) associated with the sampled user free text input 107 is generated. A noise vector is generated separately in step s215. Then, in step s220, the user ID embedding vector generated in step 210 and the noise vector generated in step s215 are formatted into a representation that corresponds to the format of the text input embedding representation generated in step s205.

[0103] The text input embedded representation is then combined with the formatted user ID embedded representation and the formatted noise representation of step 220 at step s225.

[0104] The process 200 then proceeds to step s230: generating a sample keystroke timestamp based on the combined representation of step s220. Figure 2 For example, at step s235, the generated sample keystroke timestamps are used together with the actual keystroke timestamps 107b (corresponding to the sampled user #i from the user free text input 107) for user ID classification (step s240) as adversarial training for the keystroke sample generator of step s230. In addition, the generated sample keystroke timestamps from step s230 are used together with the actual keystroke timestamps 107b for text input length regression as partner training for the keystroke sample generator of step s230. In some embodiments, process 200 can be repeated for multiple sampled users to continuously train the keystroke sample generator. The user free text input 107 can be obtained from each user—for example, via a registration process—and stored in a database for use in training the keystroke sample generator.

[0105] Figures 3 to 7 is a method for executing an example implementation according to the present disclosure. Figure 2 The process 200 is a schematic diagram of the data and network structure of the overall GPAN architecture. Figure 2 As described, process 200 proceeds by randomly sampling triplets formed by: a) a text sequence of n characters (step s205), and b) a user ID corresponding to a user who provides the text sequence as input from an existing dataset of keystroke samples generated by an established set of users (s210), and c) a noise vector (step s215).

[0106] Figure 3 is a method for performing text input embedding according to an example implementation of the present disclosure Figure 2 Schematic diagram of the data and network structure of step s205 is shown.

[0107] like Figure 3 For example, embedding vectors for each typed character in a text sequence (a string of n characters typed by a user (e.g., user #i)) and corresponding timestamps for each key press and key release event 305 of the user text input 107 are learned via an embedding neural layer 310. According to an exemplary embodiment, the embedding neural layer 310 is a fully connected (dense) neural layer to learn dense character embeddings, thereby generating representations 315 for the n characters in the sampled user text input 107. Figure 3 Illustratively, representation 315 is in the form of a 128-dimensional vector for each of the n characters, the vector embodied in a matrix (eg, a 128×n matrix) representing a sample sequence of n characters 305 of user text input 107 .

[0108] Figure 4 is a method for executing an exemplary embodiment of the present disclosure Figure 2 Schematic diagram of data and network structure of step s210 of generating user ID embedding vector.

[0109] like Figure 4 As shown, embedding vectors are learned for each input user 405 (e.g., user ID of user #i - #i is, for example, between #1, #2, ..., #k) associated with each corresponding text sequence 305 via an embedding neural layer 410. In an exemplary embodiment, a fully connected (dense) neural layer is used for the embedding neural layer 410, and the resulting user embedding vector 415 is a 32-dimensional vector. The user embedding vector 415 passes through another set of dense neural layers 420 to further embed the user embedding vector 415 into a higher space where the representation 315 of the text sequence resides (e.g., a 128×n matrix). According to one embodiment, the dense neural layer 420 outputs a 128*n dimensional vector 425, which is then reshaped into a 128×n matrix 430, for example, by a mathematical operator (not shown) to conform to the format of the representation 315. The operation of the dense neural layer 420 and the reshaped representation of the vector 425 into the matrix 430 Figure 2 An example implementation of step s220 of process 200 is shown.

[0110] Figure 5 is a method for executing an example implementation according to the present disclosure Figure 2 Schematic diagram of data and network structure of step s215 of generating noise vector.

[0111] like Figure 5 For example, for each corresponding text sequence 305 and associated user 405, a noise vector (e.g., a 100-dimensional vector) 505 is randomly or pseudo-randomly sampled from a standard normal distribution (with mean 0 and standard deviation 1) 510. In an embodiment, a random or pseudo-random number generator (not shown) can be used to generate the noise vector 505. The random or pseudo-random noise vector 505 enables the generation of different timestamps for a certain user ID (e.g., user #i of representation 430) and a corresponding text sequence (e.g., representation 315). The noise vector 505 is passed through another set of dense neural layers 515 to further embed the noise vector 505 into a higher space where the representation 315 of the text sequence (e.g., a 128×n matrix) resides. According to one embodiment, the dense neural layer 515 outputs a 128*n dimensional vector 520, which is then reshaped into a 128×n matrix 525, for example, by a mathematical operator (not shown) to conform to the format of the representation 315. Operations of dense neural layer 515 and reshaping of vector 520 into matrix 525 Figure 2 An example implementation of step s220 of process 200 is shown.

[0112] Thus, the user ID and text sequence are encoded into dense vectors by the neural embedding layer before entering the generator for generating keystroke samples. The user ID and random noise vector are passed through the dense neural layer so that the resulting embedding vector reaches the desired dimension, for example 128*n, where n is the number of characters in the input text sequence. The resulting embedding vector is further reshaped into a matrix and concatenated with the character embedding into a single matrix of 384 (128*3) rows and n columns. The resulting matrix represents the input to the generative neural network.

[0113] Figure 6 is a method for executing an example implementation according to the present disclosure Figure 2 Schematic diagram of data and network structure of step s225 of combining text sequence, user ID and noise vector representation and step s230 of generating keystroke timestamp.

[0114] like Figure 6 As shown, the result representation of the user (430), the key / character sequence (315), and the noise vector (520) are concatenated into a single matrix 605 and further propagated through the generator (e.g., a generative neural network) 610. This corresponds to the combination Figure 2 The illustrated representation is step s225 and is an example implementation thereof.

[0115] The generator (e.g., a generative neural network) 610 implements the step s230 of generating keystroke timestamps and produces as output a 2D array (matrix) 615, where the i-th row contains the press and release timestamps (two values) of the i-th typed key / character of the predicted sequence. Figure 6 As an example, matrix 615 representing generated keystroke timestamps includes x rows, which are predicted lengths of actual n-character text sequences of user text input 107. Element 620 is a conceptual diagram of keystrokes 620-1, 620-2, etc. on timeline 625 corresponding to values (not shown) on the first and second rows, etc., of matrix 615, respectively. Figure 6 Also provided is the loss The conceptual diagram of the loss penalty generator 610 (e.g., the generated timestamp 620) is used when the loss breaks the time constraint of the time series 630. This will be described in further detail below with reference to Equation (3).

[0116] Figure 7 is a method for executing an example implementation according to the present disclosure Figure 2 Schematic diagram of data and network structure for steps s230 and s235 of user ID classification and regression training based on the generated keystroke timestamps.

[0117] like Figure 7 As shown, the timestamps 615 generated by the user (e.g., user #i) typing the sampled text (user text input 107) are further processed by a multi-class discriminator (e.g., a classification neural network) 715 and a regressor (e.g., a regression neural network) 720 together with the true timestamp sequence 705. The discriminator (D) 715 is a multi-class classifier that predicts whether a given input is true (real) or false (synthetic). It classifies the true samples into different classes based on the user ID. The regressor (R) 720 performs the regression task. It receives the same input as the discriminator 715 and learns to predict the length of the character sequence, thereby helping the generator (e.g., the generative neural network 610) to generate a keystroke sequence of the correct length (e.g., x=n). As shown Figure 7 For example, in the example implementation, a keystroke assigner 725 is incorporated that is used to match inputs to the discriminator 715 and the regressor 720 between the generated timestamps 615 output from the generator 610 and the actual keystroke timestamps 705 obtained from the user text input 107 .

[0118] Element 730 is a conceptual diagram of the predicted label of the discriminator 715 for the input (eg, user #1 . . . #k or "false" for the generated keystroke timestamp). Figure 7 Also provided Conceptual diagram of , which is the cross entropy loss for the input ground-truth (correct) labels 735, which enables the generator (610) to produce user-specific timestamps and key / character sequences. This will be described in further detail below with reference to Equation (2). Element 740 is a conceptual diagram of the character lengths predicted by the regressor 720 based on the timestamp samples 615 generated by the generator 610. Figure 7 Also provided , which is a conceptual diagram of forcing the generated samples 615 to have the same length as the initial text sequence 305 given as input (e.g., the gold standard actual character length 745 of the sequence 305). This will be described in further detail below with reference to equation (4)

[0119] According to an exemplary embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 are neural networks organized as successive layers of artificial neurons (not shown). In an embodiment, the generator 610, the discriminator 715, and the regressor 720 can each be any machine learning model, including but not limited to dense neural networks, convolutional neural networks, transformers, and the like. Information passing through a neural network typically propagates in one direction, from the input layer, through the hidden layers, to the output layer (not shown). In one embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 are convolutional neural networks. A convolutional neural network is a specific type of neural network designed to efficiently process images (or 2D arrays) using a special type of layer (i.e., a convolutional layer) inspired by the human visual cortex. In another embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 are incorporated with a transformer architecture. A transformer represents a neural network that employs multi-head self-attention to learn how distant elements, such as pixels or image blocks, influence each other. In another embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 are recurrent neural networks. Recurrent neural networks use feedback connections to learn data sequences, thereby being able to find long-term dependencies within a given input sequence.

[0120] Regardless of the architecture type, in an embodiment, the neural network (610, 715 and / or 720) can be trained to minimize some loss function using stochastic gradient descent (SGD) or other variations of the gradient descent algorithm. The training process is based on two steps that alternate: a forward pass and a backward pass until the model's prediction error is sufficiently low. The forward pass involves passing the training data through the model in order to generate some output or predict some class label. In the backward pass, the error given by the current prediction is used to update the model in order to improve the model and reduce its error. To update the model's weights, the error is backpropagated through the network. After a number of iterations (epochs) (e.g., 100) on the training data, the algorithm is considered to have found the model weights that minimize the prediction error on the training set. This is accomplished by making small adjustments to the model weights that move the model downward along the gradient (slope) of the loss function toward the minimum error value. This gives the optimization algorithm its name, gradient descent.

[0121] In an embodiment, to train Figures 3 to 7 The entire GPAN architecture illustrated can be used with any gradient-based backpropagation algorithm, such as SGD (stochastic gradient descent), SGD with momentum, Adam, AdamW, etc. To avoid high memory usage, the optimization algorithm can be applied to small batches (small subsets) of data samples. To optimize the disclosed GPAN model, a novel loss function is defined by the following equation (1), whose elements are Figure 6 and Figure 7 Example:

[0122]

[0123] in,

[0124] G represents a generator (610),

[0125] D represents the multi-class discriminator (715),

[0126] R represents the regressor (720),

[0127] x represents an array of press and release timestamps for the typed text sequence (615),

[0128] t represents the typed text sequence,

[0129] u represents a one-hot encoded vector that represents the ID associated with the user who typed the text or a label indicating that the input sample was generated as (“fake”),

[0130] λ1 represents a hyperparameter that controls the importance of temporal consistency loss,

[0131] λ2 represents a hyperparameter that controls the importance of the mean squared error (MSE) loss with respect to the length of the generated keystroke sequence.

[0132] ( Figure 7 ) is the cross entropy loss that enables the generator (610) to produce a sequence t of timestamps and keys / characters specific to user u, which is defined by equation (2) as follows:

[0133]

[0134] in,

[0135] E represents the expected value,

[0136] p data represents the probability distribution of the data,

[0137] p z represents the noise distribution,

[0138] k represents the number of users.

[0139] like Figure 7 Example, The loss of the gold standard (correct) label of the user (e.g., user #i) 735 associated with the text sequence 305 (from the user text input 107) that forms the basis of the generated sequence 615 and the identified user 730 of the sequence 615 generated by the discriminator 715 is considered. At the same time, the discriminator 715 is trained to identify "fake" text sequences generated by the generator 610.

[0140] ( Figure 6 ) is a loss that penalizes the output of generator 610 when the loss breaks the temporal constraints of time sequence 630, namely: (i) the press timestamp must be before the release timestamp of the same key, and (ii) two consecutive presses must be in temporal order. The temporal consistency loss is defined by equation (3) below:

[0141]

[0142] in,

[0143] y=G(z |u,t), so y i,0 and y i,1 represents the press and release timestamps of the i-th key in sequence t,

[0144] n represents the sequence length.

[0145] is the mean squared error that enforces the generated samples to have the same length as the initial text sequence t given as input. The length consistency loss is defined by the following equation (4):

[0146]

[0147] like Figure 7 Example, The loss of the gold standard (correct) label of the user (e.g., user #i) 735 associated with the text sequence (from the user text input 107) that forms the basis of the generated sequence and the identified user 730 of the sequence generated by the discriminator 715 is considered.

[0148] In order to verify the disclosed GPAN architecture and method for the first training phase (step s105) in a real scenario, thousands of free text samples (e.g., stored in Figure 9 The architecture is trained on a dataset of 100+ users (#k>100) from the (one or more) databases 9345 of [ 15 ]. In general, it is preferred to train the GPAN architecture on free text samples (user text input 107) so that it can learn common patterns that can be adopted later when generating text samples for any user. Although the text samples of a particular user can be based on fixed text, such as their username, it is preferred that the system and method have the ability to generate any text since the user does not need to be known in advance.

[0149] According to an example implementation of the present disclosure, to accommodate the typically short size of fixed text samples (usernames, email addresses, passwords, etc.), the GPAN architecture is provided with short text sequences (and corresponding keystroke timestamps) (e.g., user text input 107) that are generated from free text samples (e.g., from Figure 9 The short text sequences are trimmed (extracted) from the (one or more) databases 9345) to a length between 5 and 20 keys. Then, the obtained short text sequences are grouped into three clusters with respective length intervals: [5, 10), [10, 15), and [15, 20]. According to an example implementation, assuming that shorter sequences are easier to generate, the training process of step s105 (refer to Figures 2 to 7Description) is performed in an ordered iteration from the cluster of text sequences with the shortest length (e.g., [5, 10]) to the cluster with the longest length (e.g., [15, 20]). The process is based on curriculum learning, which is a training process that first organizes examples in order of increasing difficulty and then starts training the neural network on the easiest examples, gradually adding examples of increasing difficulty along the way until all training examples have been fed to the network. The success of this method relies on avoiding forced learning of very difficult examples from the beginning - instead, guiding the model on the right path through the imposed curriculum. Curriculum learning is a method proposed in "Bengio, Y., Louradour, J., Collobert, R., Weston, J.: Curriculum Learning. In: International Conference on Machine Learning, pp. 41–48, 2009" to better train neural networks by imitating how humans learn (from easy to difficult).

[0150] To train the disclosed GPAN architecture, according to one implementation of the present disclosure, curriculum learning is applied to three sets of text sequences as follows.

[0151] First, the first group (text sequences with a length of less than 10 characters) is optimized for multiple iterations. Then, a second set of data samples is added, and the optimization continues for text sequences with a length of less than 15 characters (this includes the first group). Finally, a final set of data samples is added, and the optimization continues until convergence is reached. It is thus believed that longer sequences are more difficult to generate. Therefore, the training of the generator 610 is significantly improved through the curriculum learning process.

[0152] In summary, in the first training phase, the GPAN architecture alternates between two training steps. On the one hand, the generative neural network (generator) 610 learns to generate keystroke samples that deceive the multi-class classifier 715. At the same time, the generator 610 is penalized if it does not help the regressor 720 predict the correct keystroke sample length. Therefore, the generator 610 and the regressor 720 are partners with the same training purpose. Moreover, the generator 610 uses an additional temporal consistency loss (e.g., ) to ensure that the generated samples are temporally coherent. On the other hand, the multi-class classifier 715 is trained to classify keystroke samples into classes representing different users or pseudo classes representing keystroke samples generated by the generator 610. Therefore, the generator 610 and the multi-class classifier 715 are adversaries with opposite training objectives.

[0153] Second training phase (step s110)

[0154] After training the GPAN framework for generating keystroke samples, generator 610 is used to generate negative examples for training the user recognition model.

[0155] Return Reference Figure 1 After fully training the keystroke sample generator 610, the process 100 proceeds to step s110 representing the second training phase. In the second training phase, the binary user recognition model is trained on positive keystroke timestamps (user text input 117) and negative keystroke timestamps (generated by the generator 610 and / or user text input 107 of another user) from an actual user.

[0156] Figure 8 is a schematic diagram of data and network structures for implementing step s110 according to an exemplary embodiment of the present disclosure.

[0157] like Figure 8 For example, for the second training phase, input examples 805 is a matrix with the same number of rows and two columns as the number of keystrokes (e.g., p keys / characters) by a user (e.g., User #m). For each keystroke, the matrix records the timestamps of the key press and key release events on the corresponding row. In an example implementation, positive training examples are collected each time the target user (User #m) types pre-established text (e.g., their username or password (e.g., User Text Input 117)). Negative training examples 815 are automatically generated by the disclosed GPAN architecture (e.g., Generator 610) such that the text typed by the target user (User #m) is extracted from an existing user database (e.g., Figure 9 According to one embodiment, user #m does not belong to the existing user database used in the first training phase.

[0158] Therefore, if Figure 8 For example, the user text input (107) of a user (e.g., user #j) who has input a text sequence (user text input 117) by a target user (user #m) and the associated user ID (e.g., user #j's) are retrieved based on the target user's text sequence (user text input 117) as input 810 for generating negative samples 815 by a generator (e.g., a generative neural network) 610. The input 810 corresponds to Figure 3 and Figure 4 Inputs 305 and 405 are shown for reference above. Figures 3 to 6The operation of the generator 610 is described in terms of the first training phase. For example, to generate negative samples for the training process of the user recognition model 820, a user ID is randomly or pseudo-randomly selected from the pool of existing user IDs (e.g., #1, #2, ..., #k) used to train the GPAN architecture (or the generator 610). In an exemplary embodiment, the user text input 117 of the target user (e.g., user #m) is a fixed text input and is transformed into a sequence of character tokens. Corresponding to the operation of the first training phase, a noise vector (e.g., as shown in the reference Figure 5 The resulting input 810 is passed to a generator 610 to generate press and release timestamps specific to a user (e.g., user #j) randomly or pseudo-randomly selected from a pool of existing users (e.g., #1, #2, ..., #k). Again, according to an exemplary embodiment, the target user (e.g., user #m) is not included in the pool of existing users (e.g., #1, #2, ..., #k) used to train the GPAN in the first training phase. Therefore, the target user is a new user that is not visible to the GPAN architecture.

[0159] The positive training samples 805 and the negative training samples 815 are input to the user recognition model 820 for training to recognize the target user (eg, user #m).

[0160] like Figure 8 In the example, the user identification model 820 is a binary classifier that outputs predicted positive and negative labels 825. A positive label ("user#m") predicts that a timestamp sample belongs to a user (e.g., user#m), while a negative label ("not" user#m) predicts that a timestamp sample does not belong to a user. According to an exemplary embodiment, a cross-entropy loss relative to a gold standard actual label 830 for each timestamp sample (positive or negative) is used to train the user identification model 820.

[0161] Additionally, in some embodiments, real negative training samples from other users—e.g., when other users type their own (different) text sequences—may be obtained and input (not shown) to the binary user recognition model 820 instead of or in addition to the negative training samples 815 .

[0162] After the binary user identification model 820 is trained, the model can also be used to determine whether a new keystroke timestamp sample belongs to a target user (eg, user #m).

[0163] Therefore, for each target user to be identified via keystroke dynamics, a training dataset is constructed by collecting real examples of keystroke timestamps generated by the corresponding target user (e.g., 805). Examples are labeled as positive. To enable training of one or more binary classification models (820) designed to distinguish target users from imposters, simulated keystroke timestamps (e.g., 815) generated by the disclosed GPAN architecture (e.g., generator 610) are added to the training set. The simulated examples are assigned a negative label.

[0164] In one embodiment of the present disclosure, the binary classifier 820 is a single machine learning model, such as a decision tree, a random forest classifier, a neural network, a logistic regression model, a support vector machine model, etc. In another embodiment of the present disclosure, the binary classifier 820 is a whole of multiple binary classifiers, which are combined in various ways (such as multiple voting, classifier stacking, bagging, etc.). As will be appreciated by those skilled in the art, regardless of the type of machine learning model, the binary classifier 820 incorporates data preprocessing, data normalization, feature extraction, feature selection, and other steps required to obtain a complete and fully operational machine learning system. The machine learning model is trained by optimizing a certain objective or loss function on the constructed training set.

[0165] After training the binary classifier 820 to perform user identification, the model can be deployed in any software application and computing environment to identify the target user. Figure 1 , the process 100 proceeds to step s115, in which a user identification model (or binary classifier) 820 is deployed to identify any user based on any user's user text input 127. According to one example implementation, the entire process 100 is repeated for each target user, i.e., the software application stores and employs a different binary classifier (820) to authenticate each target user.

[0166] Figure 9 is a schematic diagram illustrating a system for implementing a user identification process based on keystroke dynamics according to an exemplary embodiment of the present disclosure. Network system 9301 manages the training and deployment process for user identification of the present disclosure. In an implementation, network system 9301 embodies one or more of an application server, a network management device, an identity access management (IAM) system, and the like. In embodiments, the user identification process of the present disclosure can be applied to any network management or account management system incorporated into network system 9301 for managing any user registration, authentication, and / or identification tasks.

[0167] In some implementations, the system architecture is language-neutral, allowing REST, JSON, and Secure Sockets Layer to provide communication interfaces between various computing devices (e.g., 9301 and 9400-1...9400-m). Further, in one or more implementations, the architecture is built on open Secure Sockets Layer, JSON, and / or REST APIs. Thus, the disclosed system for identifying users can implement open standards, thereby allowing significant interoperability. It should also be understood that although the various computing devices and machines referenced herein, including but not limited to the network system 9301, the information system 9340, and the user devices 9400-1...9400-m, are referred to herein as separate / single devices and / or machines, in certain implementations, the referenced devices and machines and their associated and / or accompanying operations, features, and / or functions can be combined or arranged or otherwise employed across any number of devices and / or machines, such as via a network connection or a wired connection, as known to those skilled in the art. Accordingly, the functionality of any multiple entities can be combined and incorporated into a single device without departing from the spirit and scope of the present disclosure.

[0168] like Figure 9As shown, network system 9301, information system 9340, and user devices 9400-1 ... 9400-m communicate with each other via network 9200. Network 9200 can be the Internet, an intranet, a local area network, other wireless or other hardwired connections, or one or more connections, or a combination thereof, through which the above entities can communicate. The communication system used to facilitate network 9200 may include hardware (e.g., hardware for wired and / or wireless connections) and / or software. In embodiments, the communication system may include one or more communication chipsets, such as a GSM chipset, a CDMA chipset, an LTE chipset, 4G / 5G / 6G, a Wi-Fi chipset, a Bluetooth chipset (to name a few examples), and / or combinations thereof. Wired connections can be suitable for use with cable, plain old telephone service (POTS) (telephone), fiber optics (such as hybrid fiber coaxial), xDSL (to name a few examples), and can use coaxial cable, fiber optics, copper wire (such as twisted pair copper wire), and / or combinations thereof (to name a few examples). Wired connections can be provided through a phone port, an Ethernet port, a USB port, and / or other data ports (such as an Apple 30-pin connector port or an Apple Lightning connector port), to name a few. Wireless connections can include cellular or cellular data connections and protocols (e.g., digital cellular, PCS, CDPD, GPRS, EDGE, CDMA2000, 1xRTT, RFC 1149, Ev-DO, HSPA, UMTS, 3G, 4G, LTE, 5G, and / or 6G, to name a few), Bluetooth, Bluetooth low energy, Wi-Fi, radio, satellite, infrared connections, ZigBee communication protocols, to name a few. Communication interface hardware and / or software that can be used to communicate over wired and / or wireless connections can include an Ethernet interface (e.g., supporting a TCP / IP stack), an X.25 interface, a T1 interface, and / or an antenna, to name a few. The computer system can communicate with other computer systems or devices directly and / or indirectly (e.g., via a data network, such as the Internet, a telephone network, a mobile broadband network (such as a cellular data network), a mesh network, Wi-Fi, WAP, a LAN, and / or a WAN, to name a few). For example, the network(s) 9200 can be accessed using the Transmission Control Protocol and Internet Protocol (“TCP / IP”) (e.g., any of the protocols used in the various TCP / IP layers), the Hypertext Transfer Protocol (“HTTP”), WebRTC, SIP, and the Wireless Application Protocol (“WAP”), which are some of the various types of protocols that can be used to facilitate communications between the user devices 9400-1 . . . 9400-m and the network system 9301.According to an exemplary embodiment of the present disclosure, the network 9200 includes switches (not shown), routers (not shown) and other computing devices (not shown), which are used to facilitate communication and data exchange between servers such as the network system 9300 and the information system 9340 and clients such as user devices 9400-1...9400-m, while complying with the above-mentioned connections and protocols understood by ordinary technicians in the field.

[0169] In some embodiments, the user devices 9400-1 ... 9400-m and the network system 9301 can communicate with each other via a web browser using HTTP. Various additional communication protocols can be used to facilitate communication between the user devices 9400-1 ... 9400-m and the network system 9301, including the following non-exhaustive list: Wi-Fi (e.g., 802.11 protocols), Bluetooth, radio frequency systems (e.g., 900 MHz, 1.4 GHz, and 5.6 GHz communication systems), cellular networks (e.g., GSM, AMPS, GPRS, CDMA, EV-DO, EDGE, 3GSM, DECT, IS136 / TDMA, iDen, LTE, or any other suitable cellular network protocol), infrared, BitTorrent, FTP, RTP, RTSP, and / or SSH.

[0170] Correspondingly, if Figure 9 As shown, the network system 9301 incorporates communication circuitry (“network connection interface”) 9305 , one or more processors 9310 , and memory 9315 .

[0171] The network connection interface 9305 may include any circuitry that allows or enables one or more components of the network system 9301 to communicate with one or more additional devices, servers, and / or systems (e.g., one or more of the information system 9340 and the user devices 9400-1 ... 9400-m) via the network 9200. The network connection interface 9305 may use any of the previously mentioned exemplary communication protocols. According to an exemplary embodiment, the network connection interface 9305 includes one or more universal serial bus ("USB") ports, one or more Ethernet or broadband ports, and / or any other type of hardwired access port to communicate with the network 9200, and therefore with the information system 9340 and the user devices 9400-1 ... 9400-m.

[0172] The one or more processors 9310 may include any suitable processing circuitry capable of controlling the operation and functionality of the network system 9301 and facilitating communication between various components within the network system 9301. In some embodiments, the processor(s) 9310 may include a central processing unit ("CPU"), a graphics processing unit ("GPU"), one or more microprocessors, a digital signal processor, or any other type of processor, or any combination thereof. In some embodiments, the functions of the processor(s) 9310 may be performed by one or more hardware logic components, including, but not limited to, a field programmable gate array ("FPGA"), an application specific integrated circuit ("ASIC"), an application specific standard product ("ASSP"), a system on a chip ("SOC"), and / or a complex programmable logic device ("CPLD"). In addition, each of the processor(s) 9310 may include its own local memory, which may store program systems, program data, and / or one or more operating systems.

[0173] The memory 9315 may include one or more types of storage media, such as any volatile or non-volatile memory or any removable or non-removable memory implemented in any suitable manner to store data for the network system 9301. For example, computer readable instructions, data structures and / or program systems may be used to store information. The various types of storage devices / memory may include, but are not limited to, hard drives, solid-state drives, flash memory, permanent memory (e.g., ROM), electrically erasable programmable read-only memory ("EEPROM"), CD ROM, digital versatile disks ("DVD") or other optical storage media, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, RAID storage systems, or any other storage type or any combination thereof. In addition, the memory 9301 may be implemented as a computer readable storage medium ("CRSM"), which may be any available physical medium that can be accessed by the processor(s) 9310 to execute one or more instructions stored within the memory 9315. According to an exemplary embodiment, including Figures 3 to 7 One or more applications corresponding to processes 100 and 200 of the data and network structures illustrated in FIG are executed by processor(s) 9310. In an embodiment, instructions and data associated with these processes may be stored in memory 9315 and / or information system 9340.

[0174] According to an example implementation of the present disclosure, the network system 9301 communicates with the information system 9340 via a direct connection and / or via the network 9200. Figure 9Illustratively, the information system 9340 maintains one or more databases 9345, which specifically implement servers and corresponding storage media for storing data of the network system 9305 and user devices 9400-1 ... 9400-m associated with the training and user identification processes of the present disclosure, as will be understood by one of ordinary skill in the art. For example, the (one or more) databases 9345 are used to store user text input 107 obtained from user devices 9400-1 ... 9400-k for training the keystroke generator 610 (e.g., first training phase step s105) and / or user text input 117 from user device 9400-m for training the user identification model (e.g., second training phase step s110). In an embodiment, the processes associated with the training (e.g., steps s105 and s110 together with Figures 2 to 7 The process steps and data structures thereof as illustrated in FIG1 and FIG2 may be partially or entirely executed by the network system 9301 and / or the information system 9340. Similarly, the data obtained by the training may be partially or entirely retained by the information system 9340 and / or the network system 9301. Correspondingly, the process and data related to the user identification process (e.g., the deployment of the user identification model in step s115 together with the Figures 2 to 7 and their associated process steps and data structures illustrated in ) can be partially or fully executed / maintained by information system 9340 and / or network system 9301.

[0175] The exemplary storage medium used for data storage of the database(s) 9345 corresponds to the storage medium described above with respect to the memory 9315 and will not be repeated here. In an embodiment, the information system 9340 may include one or more database servers supporting Oracle SQL, NoSQL, NewSQL, PostgreSQL, MySQL, Microsoft SQL Server, Sybase ASE, SAP HANA, DB2, etc. The information system 9340 incorporates a network connection interface (not shown) for communicating with the network 9200, and its exemplary implementation may include the implementation described above with respect to the network connection interface 9305 and will not be repeated here.

[0176] In an embodiment, the network system 9301 and / or the information system 9340 may implement an application server that is adapted to host one or more applications that can be accessed and executed by users (User #1, ..., User #m) on user devices 9400-1 ... 9400-m via the network 9200. In an embodiment, the executable portion of the application maintained on the application server may be offloaded to the user devices 9400-1 ... 9400-m. For example, graphical user interface rendering, etc., may be performed locally on the user devices 9400-1 ... 9400-m.

[0177] User devices 9400-1...9400m can be any computing device and / or data processing apparatus capable of implementing the systems and / or methods described herein, and for each corresponding user (User #1...User #m) can include any suitable type of electronic device, including but not limited to a desktop computer, a mobile computer (e.g., a laptop, an ultrabook), a mobile phone, a portable computing device (such as a smart phone, a tablet, a personal display device, a personal digital assistant ("PDA"), a virtual reality device, a wearable device (e.g., a watch)), to name a few examples, with Internet access that can be uniquely identified (directly or through another personal device) by an Internet Protocol (IP) address, an Internet cookie, a Media Access Control (MAC) identifier, or an online personal account of the respective user (User #1...User #m) associated with the corresponding user device 9400-1...9400-m.

[0178] User access device 9400-1 Figure 9 The exemplary schematic arrangement is illustrated as user equipment 9400-1...9400-m. Figure 9As shown, user device 9400-1 includes (one or more) processors 9410, memory 9420, communication portal 9430, and user interface 9415. (One or more) processors 9410, memory 9420, and communication portal 9430 can be implemented according to the exemplary implementation of (one or more) processors 9310, memory 9315, and network connection interface 9305, respectively, and will not be repeated here. Communication portal 9430 can use any communication protocol, such as any of the exemplary communication protocols mentioned previously. In some embodiments, user device 9400-1 can include one or more antennas to facilitate wireless communication with the network using various wireless technologies (e.g., Wi-Fi, Bluetooth, radio frequency, etc.). In another embodiment, user device 9400-1 can include one or more universal serial bus ("USB") ports, one or more Ethernet or broadband ports, and / or any other type of hardwired access port, so that communication portal 9430 allows user devices 9400-1 to communicate with each other or with one or more communication networks (including network 9200).

[0179] In addition, the processor(s) 9410 may run an operating system ("OS") and / or one or more firmware applications, media applications, and / or applications resident on the personal user device 9400-1. In some embodiments, the processor(s) 9410 may run a local client-side script for reading and presenting content received from one or more websites. For example, the processor(s) 9410 may run a local JavaScript client for presenting HTML or XHTML content received from a particular URL accessed by the personal user device 9400-1 (e.g., maintained in association with the network system 9301 and / or the information system 9340).

[0180] The user interface 9415 is operably connected to the processor(s) 9410 and may include one or more input or output devices, such as switches, buttons, keys, touch screens, displays, microphones, cameras, sensors, etc., as will be understood in the art of electronic computing devices. In an exemplary implementation, the user interface 9415 is used to capture keystrokes of users (user #1 ... user #m) associated with the training and / or user identification tasks of the present disclosure. For example, the user interface 9415 is used to facilitate capturing user text input 107 from users (e.g., user #1 ... user #k) of associated user devices (e.g., 9400-1 ... 9400-k) for training the keystroke sample generator 610 (e.g., first training phase step s105). Correspondingly, the user interface 9415 is used to facilitate capturing user text input 117 from a user (e.g., user #m) of an associated user device (e.g., 9400-m) for use in training the user recognition model 820 (e.g., second training phase step s110) and capturing user text input 127 for use in identifying the user based on the trained user recognition model 820 (e.g., user recognition model deployment step s115). Thus, keystrokes input via the user interface 9415 (which may be a physical or virtual keyboard, keypad, etc.) are obtained for training and recognition purposes according to processes 100 and 200. Thus, Figure 9 An exemplary embodiment of the present disclosure illustrates users #1 to #k forming a keystroke sample generator training user pool 9500, from which user text input 107 is obtained for the first training phase, and user #m from which user text inputs 117 and 127 are obtained for the second training phase and user identification task, respectively, outside of user pool 9500. In an embodiment, user text inputs 107, 117, and 127 may be obtained from the respective users (user #1 ... user #m) as part of a user registration and authentication process, a dedicated system security training process, or the like.

[0181] Example

[0182] To validate the disclosed process in a real-world setting, a series of experiments were conducted using various binary classifiers on two datasets of users. Both datasets contained real imposter samples obtained under laboratory conditions. For each dataset, participants were asked to provide imposter keystrokes for each of the usernames and passwords included in the data acquisition experiment. The imposter samples were used for evaluation (testing) purposes because they are not easily available in a real-world setting. The user identification models were a gradient boosting classifier, a multilayer perceptron (MLP), a random forest model, and a support vector machine (SVM) model.

[0183] To evaluate the accuracy improvement brought about by adding synthetic negative keystroke samples generated by the disclosed GPAN, a binary classification model was trained in two scenarios. In the first scenario, the negative data was formed by keystroke examples generated by actual users (other than the target user), but the keystroke samples did not necessarily correspond to the text typed by the target user, that is, the negative samples were collected from other users while typing their own text input. In the second scenario, the negative data was formed by synthetic keystroke examples generated by the disclosed GPAN architecture. The use of a generative model enables the acquisition of negative samples of text sequences identical to those of the positive samples.

[0184] The first scenario is used as a baseline to measure the impact of adding synthetic negative data in the second scenario. Figure 10 The evaluation results of the models trained in two alternative scenarios are shown in . Since the dataset contains keystroke entries for multiple passwords and users, and the machine learning model is created for each unique user and password pair, Figure 10 The values reported in represent the average accuracy achieved for all users in the corresponding dataset. The average accuracy for dataset 1 is listed in Table 1 below, and the average accuracy for dataset 2 is listed in Table 2 below.

[0185] Table 1 (Dataset 1)

[0186]

[0187]

[0188] Table 2 (Dataset 2)

[0189]

[0190] The reported results show that the disclosed process significantly improves the performance of various classification models regardless of the dataset. Thus, the experiments verify the effectiveness of the disclosed GPAN architecture.

[0191] Figure 10 A comparison between the results obtained with and without negative keystroke samples generated by the disclosed GPAN method is shown. The accuracy improvement is significant and consistent across various machine learning models and datasets. Figure 10 As reflected in Tables 1 and 2, user identification accuracy improves (up to about 15%) for each classification model used on both datasets, thereby validating the improvement provided by the disclosed GPAN technique over models trained with user-generated free text negative samples.

[0192] Parts of the methods described herein can be performed by software or firmware in a machine-readable form on a tangible (e.g., non-transient) storage medium. For example, the software or firmware can be in the form of a computer program comprising a computer program code that, when the program is run on a computer or suitable hardware device, is suitable for causing the system to perform the various actions described herein, and wherein the computer program can be specifically implemented on a computer-readable medium. Examples of tangible storage media include computer storage devices with computer-readable media such as optical disks, thumb drives, flash memories, etc., and do not include propagation signals. Propagation signals can be present in tangible storage media. The software can be suitable for execution on a parallel processor or a serial processor so that the various actions described herein can be performed in any suitable order or simultaneously.

[0193] The headings used herein are for organizational purposes only and are not intended to limit the scope of the specification or claims. As used throughout this application, the words "may" and "can" are used in a permissive sense (i.e., meaning with possibility) rather than in a mandatory sense (i.e., meaning must). For ease of understanding, where possible, the same reference numerals are used to represent the same elements shared by the accompanying drawings. In some cases, an alphabetic suffix (... -b) after the dash represents a specific example of an element marked by a specific reference numeral (e.g., 9400-b). A description of an element with reference to a basic reference numeral (e.g., 9400) also refers to all specific examples having such an alphabetic suffix (e.g., 9400-b), and vice versa.

[0194] It should also be understood that like or similar reference numbers in the drawings represent like or similar elements in the several figures, and that not all components or steps described and illustrated with reference to the drawings are required for all embodiments or arrangements.

[0195] The terms used herein are used only for the purpose of describing specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the terms "comprise", "contain" and / or "include" and their variations, when used in this specification, specify the presence of the features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or groups thereof, and are intended to cover the items listed thereafter and their equivalents as well as additional items.

[0196] The directional terms are used herein for the purpose of convention and reference only and should not be construed as limiting. However, it should be recognized that these terms may be used with reference to an operator or user. Therefore, no limitation is implied or inferred. In addition, the use of ordinal numbers (e.g., first, second, third) is for the purpose of distinction rather than counting. For example, the use of "third" does not imply the existence of a corresponding "first" or "second." Moreover, the words and terms used herein are for descriptive purposes and should not be considered limiting.

[0197] Although the present disclosure has described several example implementations, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the spirit and scope of the present disclosure. In addition, it will be understood by those skilled in the art that many modifications may be made to adapt specific instruments, situations, or materials to the embodiments of the present disclosure without departing from the basic scope thereof. Therefore, the present disclosure is not intended to be limited to the specific embodiments disclosed, or to the best mode contemplated for carrying out the present disclosure, but rather the present disclosure will include all embodiments falling within the scope of the appended claims.

[0198] The foregoing subject matter is provided by way of illustration only and is not to be construed as limiting. Various modifications and changes may be made to the subject matter described herein without following the illustrated and described example embodiments and applications, and without departing from the true spirit and scope encompassed by the present disclosure, which is defined by the set of recitations in the appended claims and by structures and functions or steps equivalent thereto.

Claims

1. An apparatus adapted to identify a user based on the keystroke dynamics of the user's input, comprising: a communication interface to one or more networks; one or more processing devices operatively connected to the computer network interface; as well as one or more memory storage devices operatively connected to the one or more processing devices and having stored thereon machine-readable instructions that, when executed, cause the one or more processing devices to: In the first training phase of training the keystroke sample generator, receiving, via the communication interface, a plurality of first text input samples from a plurality of first users; and For each first text input sample received: generating a user identification representation, a noise representation, and a text sequence representation of the received first text input sample; generating a keystroke sequence sample using the keystroke sample generator based on the generated combination of the user identification representation, the noise representation, and the text sequence representation; inputting the generated keystroke sequence sample and the actual keystroke sequence of the received first text input sample into a classifier for performing user identification classification on the generated keystroke sequence sample; Inputting the generated keystroke sequence sample and the actual keystroke sequence of the received first text input sample into a regressor that performs text character length regression on the generated keystroke sequence sample; as well as training the keystroke sample generator based on the user identification classification of the classifier and the text character length classification of the regressor; In the second training phase of training the user identification model, receiving, via the communication interface, one or more second text input samples from a second user, the second user being different from the plurality of first users; generating, using the keystroke sample generator, a plurality of negative keystroke samples based on the one or more second text input samples; as well as training the user identification model on a user classification of the second user based on the one or more second text input samples and the generated plurality of negative keystroke samples; as well as In the deployment of the user identification model, receiving, via the communication interface, a third text input sample associated with the second user; and The third text input sample is authenticated using the trained user recognition model.

2. The device according to claim 1, wherein The user identification representation and the text sequence representation are generated using corresponding embedding neural layers.

3. The device according to claim 1, wherein The user identification representation and the noise representation are generated using corresponding neural layers to conform to the format of the text sequence representation.

4. The device according to claim 1, wherein The classifier is a multi-class discriminator implemented by a neural network, and the regressor is a recurrent neural network.

5. The device according to claim 4, wherein The training of the keystroke sample generator, the user identification classification of the classifier, and the text character length regression of the regressor are based on in, G represents the keystroke sample generator, D represents the multi-class discriminator, R represents the regressor, x represents an array of press and release timestamps of the typed text sequence of the first text input sample received, t represents the typed text sequence of the received first text input sample, u represents a one-hot encoded vector representing an ID associated with one of the plurality of first users who typed the received first text input sample or a label indicating an input sample generated to the classifier, λ1 is a hyperparameter that controls the importance of temporal consistency loss, λ2 is a hyperparameter that controls the importance of the mean squared error (MSE) loss relative to the text character length of the generated keystroke sequence samples, E represents the expected value, p data represents the probability distribution of the data, p x represents the noise distribution, k represents the number of the plurality of first users, y=G(z|u,t), so y i,0 and y i,1 represents the pressing and releasing timestamps of the i-th key in the sequence t, n represents the sequence length, and 6. The device according to claim 1, wherein The plurality of negative keystroke samples are generated by the generator based on one or more of the plurality of first text input samples associated with one or more of the plurality of first users, the plurality of first users being different from the second user.

7. The device according to claim 6, wherein At least one of the negative keystroke samples is generated based on one of the plurality of first text input samples, the first text input sample comprising the same character sequence as the one or more second text input samples.

8. The device according to claim 1, wherein The user identification model is a binary classifier that determines whether the keystroke sequence of the third text input sample corresponds to the second user based on the user classification training.

9. The device according to claim 1, wherein The plurality of first text input samples include free text inputs by the plurality of first users.

10. The device according to claim 1, wherein The one or more second text input samples include fixed text input of the second user.

11. A method for identifying a user based on keystroke dynamics of the user's input, comprising: In the first training phase of training the keystroke sample generator, Receiving, by the processing device via the communication interface, a plurality of first text input samples from a plurality of first users; as well as For each first text input sample received: generating, by the processing device, a user identification representation, a noise representation, and a text sequence representation of the received first text input sample; generating, by the processing device, a keystroke sequence sample based on the generated combination of the user identification representation, the noise representation, and the text sequence representation using the keystroke sample generator; The processing device inputs the generated keystroke sequence sample and the actual keystroke sequence of the received first text input sample into a classifier for performing user identification classification on the generated keystroke sequence sample; The processing device inputs the generated keystroke sequence sample and the actual keystroke sequence of the received first text input sample into a regressor that performs text character length regression on the generated keystroke sequence sample; as well as training, by the processing device, the keystroke sample generator based on the user identification classification of the classifier and the text character length classification of the regressor; In the second training phase of training the user identification model, receiving, by the processing device via the communication interface, one or more second text input samples from a second user, the second user being different from the plurality of first users; generating, by the processing device, a plurality of negative keystroke samples based on the one or more second text input samples using the keystroke sample generator; as well as training, by the processing device, the user identification model on a user classification of the second user based on the one or more second text input samples and the generated plurality of negative keystroke samples; as well as In the deployment of the user identification model, receiving, by the processing device via the communication interface, a third text input sample associated with the second user; as well as The third text input sample is authenticated by the processing device using the trained user recognition model.

12. The method according to claim 11, wherein The user identification representation and the text sequence representation are generated using corresponding embedding neural layers.

13. The method according to claim 11, wherein The user identification representation and the noise representation are generated using corresponding neural layers to conform to the format of the text sequence representation.

14. The method according to claim 11, wherein The classifier is a multi-class discriminator implemented by a neural network, and the regressor is a recurrent neural network.

15. The method according to claim 14, wherein The training of the keystroke sample generator, the user identification classification of the classifier, and the text character length regression of the regressor are based on in, G represents the keystroke sample generator, D represents the multi-class discriminator, R represents the regressor, x represents an array of press and release timestamps of the typed text sequence of the first text input sample received, t represents the typed text sequence of the received first text input sample, u represents a one-hot encoded vector representing an ID associated with one of the plurality of first users who typed the received first text input sample or a label indicating an input sample generated to the classifier, λ1 is a hyperparameter that controls the importance of temporal consistency loss, λ2 is a hyperparameter that controls the importance of the mean squared error (MSE) loss relative to the text character length of the generated keystroke sequence samples, E represents the expected value, p data represents the probability distribution of the data, p z represents the noise distribution, k represents the number of the plurality of first users, y=G(z |u,t), so y i,0 and y i,1 represents the pressing and releasing timestamps of the i-th key in the sequence t, n represents the sequence length, and 16. The method according to claim 11, wherein The plurality of negative keystroke samples are generated by the generator based on one or more of the plurality of first text input samples associated with one or more of the plurality of first users, the plurality of first users being different from the second user.

17. The method according to claim 16, wherein At least one of the negative keystroke samples is generated based on one of the plurality of first text input samples, the first text input sample comprising the same character sequence as the one or more second text input samples.

18. The method according to claim 11, wherein The user identification model is a binary classifier that determines whether the keystroke sequence of the third text input sample corresponds to the second user based on the user classification training.

19. The method according to claim 11, wherein The plurality of first text input samples include free text inputs by the plurality of first users.

20. The method according to claim 11, wherein The one or more second text input samples include fixed text input of the second user.

Images