System, apparatus, and method for automatically generating negative keystroke examples and training a user identification model based on keystroke dynamics

Abstract

An apparatus configured to identify a user based on keystroke dynamics of input by the user, the apparatus configured to: perform a first training phase to train a keystroke example generator to generate negative keystroke examples; perform a second training phase to train a user identification model based at least in part on a plurality of negative keystroke examples generated using the keystroke example generator; and perform user identification model deployment to authenticate input examples associated with the user using the trained user identification model.

Description

[Technical Field]

[0001] The present disclosure relates generally to computer-implemented methods for identifying users based on the keystroke dynamics of their input, and more specifically to machine learning-based techniques for generating synthetic negative keystroke examples to train a user identification model used to identify users based on keystroke examples received from the users. [Background technology]

[0002] Keystroke dynamics is a behavioral biometric used to recognize individuals based on their typing characteristics, regardless of whether the typing is performed on a physical or virtual keyboard. In other words, users of computing devices with physical or virtual keyboards can be identified by analyzing their typing patterns on the keyboard. Scenarios for implementing keystroke dynamics systems can be divided into two categories: fixed-text and free-text. In fixed-text scenarios, the text sequence used for user enrollment and user authentication is the same, representing, for example, a password or username. In free-text scenarios, the text sequences typed by the user for enrollment and authentication do not necessarily match; the user can type any text.

[0003] State-of-the-art methods for this task are typically based on machine learning models that take a series of key press and release timestamps (events) as input and predict the probability that the input sequence belongs to a particular user. Machine learning models are likely to achieve better accuracy when the input text has a fixed structure. The user identification problem in the case of fixed text scenarios is usually treated as a binary classification problem or an outlier detection problem.

[0004] In related work, this problem is typically studied and evaluated in a simulated binary classification setting where multiple users type the same text, allowing for training and validation of a binary classifier that benefits from both negative and positive training keystroke examples for each user. The system uses both positive data examples collected from the target user (the user who must be identified) and negative data examples collected from other users to train the system, which learns to classify keystroke examples into genuine and spoofed instances. Ideally, a binary classification system would use keystroke examples typed by other users (spoofers, attackers) for the same text sequence typed by the genuine user. Related literature includes studies such as "Antal, M., Nemes, L.: The MOBIKEY Keystroke Dynamics Password Database: Benchmark Results. In: Software Engineering Perspectives and Applications in Intelligent Systems. Advances in Intelligent Systems and Computing, vol. 465, pp. 35-46, Springer, 2016," which empirically demonstrates that binary classification methods perform better when negative examples from other users are available during training. However, this scenario is not realistic because in real-world settings, each user has a different username and password. Furthermore, negatively labeled training examples generated by actual impersonators cannot be consistently collected for real-world applications, such as for every authentic user. Therefore, this scenario can only be verified under simulated or laboratory conditions.

[0005] In this context, the traditional approach used in the related literature is to use a one-class machine learning model, which is trained only on the positive keystroke examples belonging to the target user. In the outlier detection setting, the system uses only data examples collected from the target (genuine) user (the user who must be identified) to train the system, while checking the deviation (difference) of the keystroke examples available during training from new text examples (recorded during the user identification stage). In other words, the outlier detection system does not use negative training examples (collected from other users).

[0006] Thus, one of the reasons why using keystroke biometrics for user identification is a challenging task is the lack of sufficient negative examples collected in real-world settings, which are a key component to strengthen the ability of biometric systems based on keystroke dynamics to distinguish between legitimate users and potential attackers.

[0007] Traditional approaches using negative examples rely primarily on statistical principles. One such approach is to use negative examples that correspond to different strings of characters typed by other users. However, such approaches entangle the task of user identification with the task of text classification. For example, positive examples can be distinguished from negative examples based on the typed text rather than on keystroke dynamics. Thus, without the use of negative keystroke examples containing identical text as the positive examples, such models tend to make significantly more prediction errors in realistic settings than in simulated laboratory settings. Summary of the Invention [Means for solving the problem]

[0008] In light of the shortcomings of conventional keystroke profiling techniques and the improvements offered by effective negative examples, the present disclosure provides a system and method for automatically generating negative keystroke examples for a target text and using the generated examples to train a binary classifier for user identification based on keystroke dynamics.

[0009] There has been research into generating synthetic keystroke examples.

[0010] One such study aimed at increasing the number of examples in fixed-text (usually passphrases) datasets, "Migdal, D., Rosenberger, C.: Statistical modeling of keystroke dynamics samples for the generation of synthetic datasets. Future Generation Computer Systems, vol. 100, pp. 907-920, 2019," evaluated a set of 19 distributions to understand which one best represented the number of six possible durations that could be extracted from all digraphs (pairs of two characters) extracted from examples belonging to real users. The authors concluded that, overall, durations followed either a normal, logistic, or Gumbel distribution. The synthetic keystroke data were generated with the help of six random engine generators following given laws, with parameters estimated for each digraph and user.

[0011] In another study, "Gonzalez, N., Calot, EP, Ierache, JS, Hasperue, W.: Towards liveness detection in keystroke dynamics: Revealing synthetic forgeries. Systems and Soft Computing, vol. 4, p. 200037, 2022," a generated sequence of keys and their corresponding keystroke timings were generated based on past observations of keystroke timings for those keys in free text, either from target users or from the general population, with the aim of providing a method for spoofing. The timings were generated in several different ways, such as by averaging timing values ​​from past observations or by sampling with a random number between 0 and 1, which is the inverse of a continuous distribution function. Sampling methods were found to be most successful in improving false acceptance rates when access to data from target users was available.

[0012] The authors of "Monaco, JV, Ali, ML, and Tappert, CC: Spoofing key-press latencies with a generative keystroke dynamics model." In: IEEE International Conference on Biometrics Theory, Applications and Systems, pp. 1-8, IEEE, 2015, proposed a Linguistic Buffer and Motor Control model that utilizes observed keystroke latencies from actual key press and release timestamps without knowing the key names. The model generated an empirical distribution of key press latencies. The generative model determined whether the user was in an active or passive state based on the observed keystroke latencies using a two-state hidden Markov model. For predefined text, which contained information about the distance between keys on a physical keyboard, the model generated a lognormal random variable for each possible distance between keys. In other words, the generative model mapped the target user's observed typing patterns to predefined text that could be further used for spoofing. Experiments have shown that once the model has observed approximately 50 keystrokes for each given user, it begins to generate synthetic examples that can increase the equivalent error rate (EER) of a biometric authentication system by up to 0.6.

[0013] A different approach was presented in "Huster, T., Cohen, J., Lin, Z., Chan, K., Kamhoua, C., Leslie, N.O., Chiang, C.Y.J., Sekar, V.: Pareto GAN: Extending the representational power of GANs to heavy-tailed distributions." In: International Conference on Machine Learning, pp. 4523-4532, PMLR, 2021. The authors argue that existing generative adversarial network (GAN) architectures are inherently unable to handle the asymptotic behavior of heavy-tailed distributions. Therefore, as a solution, the authors propose Pareto GAN (Pareto GAN) by leveraging limit theory and the functional properties of neural networks to learn a distribution that matches the asymptotic behavior of the limiting distribution of features. We demonstrate that Pareto GANs outperform three baseline GANs (uniform, normal, and lognormal) on the task of generating synthetic keystroke data in terms of similarity to real data, established based on the Kolmogorov-Smirnov test statistic and the area between the log-log plots of the empirical cumulative distribution functions of synthetic and real examples.

[0014] GANs were originally proposed as a method for digital image generation in "Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial nets. In: Advances of Neural Information Processing, pp.2672-2680, 2014." GANs consist of a generator and a classifier, both trained in an adversarial manner. The generator aims to generate realistic images, and the classifier aims to distinguish between fake (generated) images and natural images.

[0015] The present disclosure provides an improved method for generating negative keystroke examples for training a user identification classifier.

[0016] Unlike methods introduced in related literature, this disclosure introduces a novel neural architecture called generative partner-adversarial network (GPAN) to generate keystroke examples. Unlike other GAN architectures, the disclosed architecture contains three actors instead of two.

[0017] 1. A multimodal generative neural network that generates example keystrokes given a sequence of text, a user ID, and a random noise vector. While typical generators take a single modality as input, the disclosed generator is multimodal and has three modalities as input.

[0018] 2. Multi-class classification neural network (distinguishing between fake and multiple classes of real keystroke examples): While typical classifiers address binary classification tasks (fake vs. real), the disclosed classifier is multi-class and distinguishes between real and fake keystroke examples belonging to different users.

[0019] 3. Recurrent neural networks (which predict whether the length of generated keystroke examples is correct). Typical GANs do not use a regressor with a joint (non-adversarial) objective with the generator.

[0020] This method involves two training phases. In the first training phase, a novel partner generative adversarial network (GPAN) is trained on a dataset of keystroke timestamps recorded for a pool of users while typing free text. Unlike related generative adversarial networks (GANs), this disclosure presents a GPAN that takes user IDs, strings, and a random noise vector as input. It includes a user layer and text embedding layer before the generator, a multi-class classifier that predicts from the existing dataset whether a generated keystroke example is fake or belongs to one of the users, and a regressor that measures whether the generated examples are of the correct length (according to the input string) and measures a temporal consistency loss to ensure that the generated timestamps are temporally consistent. The generator and multi-class classifier are trained as adversaries (with opposing objectives), while the generator and regressor are trained as partners (with the same objective). Hence, the proposed architecture is named partner generative adversarial network (GPAN).

[0021] In the second training phase, a binary user identification model is trained on the positive keystroke timestamps collected while the target user types the pre-established text and the negative keystroke timestamps generated by the disclosed GPAN architecture. Once the user identification model is trained, it can be deployed into a user identification system based on keystroke dynamics.

[0022] According to an exemplary embodiment of the present disclosure, an apparatus configured to identify a user based on keystroke dynamics of input by the user comprises: a communication interface to one or more networks; one or more processing devices operably connected to the computer network interface; and one or more memory storage devices operably connected to the one or more processing devices and having machine-readable instructions stored thereon, the machine-readable instructions, when executed, causing the one or more processing devices to: receive, via the communication interface, a plurality of first example text inputs by a plurality of first users; for each received first example text input: generate a user identification representation, a noise representation, and a text sequence representation of the received first example text input; generate an example keystroke sequence using the example keystroke generator based on a combination of the generated user identification representation, noise representation, and text sequence representation; and compare the generated example keystroke sequence with an actual keystroke sequence of the received first example text input. inputting the generated example keystroke sequences and the actual keystroke sequence of the received first example text input to a regressor that performs text character length regression on the generated example keystroke sequences; training a keystroke example generator based on the user identity classification of the classifier and the text character length classification of the regressor; a second training stage of training a user identification model includes receiving one or more second example text inputs by a second user different from the plurality of first users via the communication interface; generating a plurality of negative example keystrokes based on the one or more second example text inputs using the keystroke example generator, and training a user identification model for a user classification of the second user based on the one or more second example text inputs and the generated plurality of negative example keystrokes; and developing the user identification model includes receiving a third example text input associated with the second user via the communication interface; and authenticating the third example text input using the trained user identification model.

[0023] According to one embodiment, the user identity representation and the text sequence representation are generated using respective embedding neural layers.

[0024] According to one embodiment, the user identity representation and the noise representation are generated using respective neural layers to fit the format of the text sequence representation.

[0025] According to one embodiment, the classifier is a multi-class classifier implemented by a neural network, and the regressor is a recurrent neural network.

[0026] According to one embodiment, training the keystroke example generator, user identity classification by the classifier, and text character length regression by the regressor are performed by:

number

number

number

number

number

[0027] According to one embodiment, the plurality of negative keystroke examples are generated by a generator based on one or more of a plurality of first text input examples associated with one or more of a plurality of first users different from the second user.

[0028] According to one embodiment, at least one of the example negative keystrokes is generated based on one of a plurality of first example text entries that includes the same character sequence as one or more of the second example text entries.

[0029] According to one embodiment, the user identification model is a binary classifier that determines whether the keystroke sequence of the third example text input corresponds to the second user based on user classification training.

[0030] According to one embodiment, the plurality of first text entry examples comprises a plurality of free text entries by the first user.

[0031] According to one embodiment, the one or more second text input examples comprise a fixed text input by the second user.

[0032] Consistent with an exemplary embodiment of the present disclosure, a method for identifying a user based on keystroke dynamics of input by the user includes: receiving, by a processing device via a communication interface, a plurality of first example text inputs by a plurality of first users in a first training stage for training a keystroke example generator; for each received first example text input, generating, by the processing device, a user identification representation, a noise representation, and a text sequence representation of the received first example text input; generating, by the processing device, an example keystroke sequence based on a combination of the generated user identification representation, the noise representation, and the text sequence representation, using the keystroke example generator; inputting, by the processing device, the generated example keystroke sequence and an actual keystroke sequence of the received first example text input to a classifier that performs user identification classification on the generated example keystroke sequence; and inputting, by the processing device, the generated example keystroke sequence and the actual keystroke sequence of the received first example text input to a classifier that performs user identification classification on the generated example keystroke sequence. The method includes inputting the stroke sequence to a regressor that performs text character length regression on the stroke sequence by the processing device; training a keystroke sequence generator by the processing device based on the user identification classification of the classifier and the text character length classification of the adjuster; a second training stage for training the user identification model includes receiving one or more second example text inputs by a second user different from the plurality of first users; generating a plurality of negative example keystrokes by the processing device via the communications interface based on the one or more second example text inputs and the generated plurality of negative example keystrokes; and developing the user identification model includes receiving a third example text input associated with the second user by the processing device via the communications interface; and authenticating the third example text input by the processing device using the trained user identification model.

[0033] According to one embodiment, the user identity representation and the text sequence representation are generated using respective embedding neural layers.

[0034] According to one embodiment, the user identity representation and the noise representation are generated using respective neural layers to fit the format of the text sequence representation.

[0035] According to one embodiment, the classifier is a multi-class classifier implemented by a neural network, and the regressor is a recurrent neural network.

[0036] According to one embodiment, training the keystroke example generator, user identity classification by the classifier, and text character length regression by the regressor are performed by:

number

number

number

number

number

[0037] According to one embodiment, the plurality of negative keystroke examples are generated by a generator based on one or more of a plurality of first text input examples associated with one or more of a plurality of first users different from the second user.

[0038] According to one embodiment, at least one of the negative keystroke example sequences is generated based on one of a plurality of first text input examples that includes the same character sequence as one or more second text input examples.

[0039] According to one embodiment, the user identification model is a binary classifier that determines whether the keystroke sequence of the third example text input corresponds to the second user based on user classification training.

[0040] According to one embodiment, the plurality of first text entry examples comprises a plurality of free text entries by the first user.

[0041] According to one embodiment, the one or more second text input examples comprise a fixed text input by the second user. [Brief explanation of the drawings]

[0042] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the following drawings, in which:

[0043] [Figure 1] FIG. 1 is a flow diagram illustrating a process for training and deploying a user identification model that identifies users based on keystroke dynamics, according to an exemplary embodiment of the present disclosure.

[0044] [Figure 2] FIG. 2 is a flow diagram illustrating a process for a first training stage of training a keystroke example generator according to an exemplary embodiment of the present disclosure.

[0045] [Figure 3] FIG. 3 is a diagram illustrating a schematic example of a data and network structure for performing text input embedding, according to an exemplary embodiment of the present disclosure.

[0046] [Figure 4] FIG. 4 is a diagram illustrating a schematic example of a data and network structure for generating a user ID embedding vector according to an exemplary embodiment of the present disclosure.

[0047] [Figure 5] FIG. 5 is a diagram that schematically illustrates a data and network structure for generating a noise vector according to an exemplary embodiment of the present disclosure.

[0048] [Figure 6] FIG. 6 is a diagram illustrating a schematic diagram of a data and network structure for combining the text input sequence, user ID, and noise vector representation of FIGS. 3-5 to generate a keystroke timestamp, according to an exemplary embodiment of the present disclosure.

[0049] [Figure 7]FIG. 7 is a diagram illustrating a schematic example of a data and network structure for performing user ID classification and regression training based on the generated keystroke timestamps of FIG. 6, according to an exemplary embodiment of the present disclosure.

[0050] [Figure 8] FIG. 8 is a diagram illustrating a schematic structure of data and a network for training a user identification model based on the example keystrokes generated by the trained generators of FIGS. 6 and 7, according to an exemplary embodiment of the present disclosure.

[0051] [Figure 9] FIG. 9 is a schematic diagram of a system that implements a user identification process based on keystroke dynamics, according to an exemplary embodiment of the present disclosure.

[0052] [Figure 10] FIG. 10 is a bar graph illustrating exemplary results comparing the user identification results of a user identification model trained with example keystrokes generated by a generator trained according to an exemplary embodiment of the present disclosure with the results of the same user identification model trained with negative examples of user-generated free text. DETAILED DESCRIPTION OF THE INVENTION

[0053] In summary, this disclosure generally relates to machine learning techniques for user identification based on keystroke dynamics. The following exemplary embodiments include novel machine learning techniques, the features of which may be incorporated into other types of entity identification or differentiation without departing from the spirit and scope of this disclosure.

[0054] The problem of user identification based on keystroke dynamics could be naturally addressed using a binary classification algorithm, where the task is to determine whether a sequence of key press and release timestamps belongs to a particular user. If the system is implemented for fixed user-specific inputs (e.g., username, password, email address, etc.), the machine learning model requires negative data examples during training—examples entered by other users using fixed text belonging to the target user. However, this approach is impractical in real-life scenarios because it is neither practical nor desirable to ask other users to type the new user's user-specific inputs (e.g., new username or email address) to obtain the negative data needed to train the machine learning model for each new user who joins the system.

[0055] To overcome this problem, this disclosure describes a method based on a Partner Generative Adversarial Network (GPAN) that automatically generates synthetic negative examples that are passed to a user identification model. The disclosed GPAN generates press and release timestamps conditioned on a set of keystroke sequences generated by a set of existing users. The generator achieves its goal by learning a joint hidden representation of the user, the key sequence, and the noise vector.

[0056] FIG. 1 is a flow diagram illustrating a process 100 for training and deploying a user identification model that identifies users based on keystroke dynamics, according to an exemplary embodiment of the present disclosure.

[0057] As illustrated in FIG. 1 , process 100 begins with step s105 of training a keystroke example generator, which represents the first training phase of process 100. According to one embodiment, the keystroke example generator is a negative keystroke example generation neural network that uses user free-text input 107, where this text is obtained from a database of keystroke typing patterns for free-text scenarios (e.g., database 9345 of FIG. 9 ). In an embodiment, the keystroke typing patterns of the user text input 107 may be collected from the user prior to initiating training process 100 and recorded in a database (e.g., database 9345 of FIG. 9 ). Additionally, the user's keystroke typing patterns may be collected on an ongoing, real-time basis, for example, during a user registration and / or authentication process. In other embodiments, the user text input 107 may be obtained from the user during one or more system training sessions, where the user is prompted to provide a text input sequence. Thus, in an embodiment, the user text input 107 may comprise free-text input and / or fixed-text input.

[0058] According to one embodiment, step s105 involves using a generator that learns to generate example keystrokes for a given user ID and text sequence using a random or pseudorandom noise vector as training input. The generated example keystrokes are compared to the actual keystrokes in the user's text sequence associated with the user ID by a multi-class classifier and a regressor. The regressor acts as a partner to the generator by learning to predict the length of the input sequence and helping the generator generate keystroke sequences of the correct length. The multi-class classifier learns to distinguish between generated and actual example keystrokes and acts as an adversary to the generator by attempting to exploit the generator's patterns of generation. Thus, the generator, classifier, and regressor form a GPAN architecture.

[0059] Once the keystroke example generator has been sufficiently trained, process 100 proceeds to step s110 of training a user identification model, which represents the second training stage of process 100. According to one embodiment, a binary classifier is trained for the user identification task using both positive keystroke examples (collected from genuine users) and negative keystroke examples (automatically generated by the generator trained in step s105). According to an exemplary embodiment, and as shown in FIG. 1, the positive keystroke examples ("user text input 117") are randomly or pseudo-randomly sampled from a user input database of keystroke typing patterns for free-text scenarios (e.g., database 9345 of FIG. 9). In other embodiments, the positive keystroke examples ("user text input 117") can be obtained from users in one or more system training sessions that prompt users to provide text input sequences.

[0060] The binary classifier can be any machine learning model, including but not limited to, a dense neural network, a convolutional neural network, a transformer, a random forest, a support vector machine, etc.

[0061] With proper training of the user identification model using at least the generated negative keystroke examples, a binary classifier is deployed in step s115 to identify users based on the keystroke dynamics of the received user text input 127. In other words, the binary classifier authenticates the received user text input 127 based on the keystroke dynamics to determine whether the user text input is authentic from the associated user. According to an exemplary embodiment of the present disclosure, the user text input 127 in step s115 is input from a user in real time, e.g., during a user authentication process. Based on the training step s110 using at least the negative examples generated by the trained generator in step s105, the accuracy of the user identification performed in step s115 is significantly improved over prior art.

[0062] First training stage (step s105)

[0063] FIG. 2 is a flow chart illustrating a process 200 corresponding to step s105 according to an exemplary embodiment of the present disclosure.

[0064] As illustrated in FIG. 2 , process 200 begins with step s205 of generating a text input embedding representation based on a user free-text input 107. According to an exemplary embodiment of the present disclosure, process 200 is performed by randomly or pseudo-randomly sampling a user free-text input 107 of a user (user #i) from a database (e.g., 9345 in FIG. 9 ) containing a collection of text input data (e.g., for #k users, where #k is at least about 10 people) and corresponding user identifications (user IDs) associated with each portion of the text input data. In an exemplary embodiment, the text input data and sampled user free-text input 107 for step s205 comprise a sequence of n characters typed by a user (e.g., user #i) of the sampled text input data. Next, a user ID embedding vector based on the user ID (user #i) associated with the sampled user free-text input 107 is generated in step s210. Separately, a noise vector is generated in step s215. The user ID embedding vector generated in step s210 and the noise vector generated in step s215 are then formatted in step s220 into a representation that corresponds to the format of the text input embedding representation generated in step s205.

[0065] The text input embedded representation is then combined with the formatted user ID embedded representation and the formatted noise representation of step s220 in step s225.

[0066] Process 200 then proceeds to step s230, where example keystroke timestamps are generated based on the combined representation of step s220. As shown in FIG. 2, the generated example keystroke timestamps are used in step s235 as adversarial training for the example keystroke generator of step s230, along with actual keystroke timestamps 107b (corresponding to user #i sampled from the user free-text input 107) for user ID classification (step s240). Additionally, the example keystroke timestamps generated from step s230 are used as partner training for the example keystroke generator of step s230, along with actual keystroke timestamps 107b for text input length regression. In certain embodiments, process 200 can be repeated for multiple sampled users to continuously train the example keystroke generator. User free-text input 107 can be obtained from each user, for example, via an enrollment process, and stored in a database to train the example keystroke generator.

[0067] 3-7 are schematic diagrams illustrating the data and network structure of the overall GPAN architecture for executing process 200 shown in FIG. 2, according to an exemplary embodiment of the present disclosure. As described with reference to FIG. 2, process 200 is performed by randomly sampling triplets formed from a) an n-character text sequence (step s205), b) a user ID corresponding to the user who provided the text sequence (s210) as input from an existing dataset of example keystrokes generated by an established set of users, and c) a noise vector (step s215).

[0068] FIG. 3 is a schematic illustration of the data and network structure for performing step s205 shown in FIG. 2 of text input embedding, according to an exemplary embodiment of the present disclosure.

[0069] 3, an embedding vector for each typed character of a text sequence (a string of n characters typed by a user (e.g., user #i)) and the corresponding timestamp for each key press and key release event 305 of the user's text input 107 is learned via an embedding neural layer 310. According to an exemplary embodiment, the embedding neural layer 310 is a fully connected (dense) neural layer for learning dense character embeddings, resulting in a representation 315 of the n characters in the sampled user text input 107. As illustrated in FIG. 3, the representation 315 is in the form of a 128-dimensional vector for each of the n characters, which is embodied in a matrix (e.g., a 128×n matrix) representing the sampled sequence of n characters 305 of the user text input 107.

[0070] FIG. 4 is a schematic illustration of a data and network structure for performing step s210 shown in FIG. 2 for generating a user ID embedding vector according to an exemplary embodiment of the present disclosure.

[0071] 4, an embedding vector is learned for each input user (e.g., user ID for user #i among #1, #2, . . . , #k) 405 associated with each corresponding text sequence 305 via an embedding neural layer 410. In an exemplary embodiment, a fully connected (dense) neural layer is used as the embedding neural layer 410, and the resulting user embedding vector 415 is a 32-dimensional vector. The user embedding vector 415 is passed through another set of dense neural layers 420 to further embed the user embedding vector 415 into a higher-dimensional space in which the text sequence representation 315 resides (e.g., a 128×n matrix). According to one embodiment, the dense neural layer 420 outputs a 128*n-dimensional vector 425, which is then reshaped, for example, by a mathematical operator (not shown), into a 128×n matrix 430 to fit the format of the representation 315. The operation of dense neural layer 420 and the reshaping of vectors 425 into matrices 430 represents an exemplary implementation of step s220 of process 200 shown in FIG.

[0072] FIG. 5 is a schematic illustration of the structure of data and a network for performing step s215 shown in FIG. 2 for generating a noise vector according to an exemplary embodiment of the present disclosure.

[0073] 5, a noise vector (e.g., a 100-dimensional vector) 505 is randomly or pseudo-randomly sampled from a standard normal distribution (with mean 0 and standard deviation 1) 510 for each corresponding text sequence 305 and associated user 405. In an embodiment, the noise vector 505 can be generated using a random or pseudo-random number generator (not shown). The random or pseudo-random noise vector 505 allows for the generation of different timestamps for a particular user ID (e.g., user #i of representation 430) and corresponding text sequence (e.g., representation 315). The noise vector 505 is passed through another set of dense neural layers 515 to further embed the noise vector 505 into a higher-dimensional space in which the representations 315 for the text sequences reside (e.g., a 128×n matrix). According to one embodiment, dense neural layer 515 outputs a 128*n dimensional vector 520, which is then reshaped, for example by a mathematical operator (not shown), into a 128×n matrix 525 to fit the format of representation 315. The operation of dense neural layer 515 and the reshaping of vector 520 into matrix 525 represent an exemplary implementation of step s220 of process 200 shown in FIG.

[0074] Therefore, before entering the generator that generates the example keystrokes, the user ID and text sequence are encoded into a dense vector by a neural embedding layer. The user ID and random noise vector are passed through a dense neural layer such that the resulting embedding vector reaches the desired dimension, e.g., 128*n, where n is the number of characters in the input text sequence. The resulting embedding vector is further reshaped into a matrix and concatenated with the character embeddings to form a single matrix with 384 (128*3) rows and n columns. The resulting matrix represents the input of the generative neural network.

[0075] FIG. 6 is a schematic illustration of a data and network structure for performing step s225 shown in FIG. 2 of combining the text sequence, user ID, and noise vector representation, and step s230 of generating keystroke timestamps, according to an exemplary embodiment of the present disclosure.

[0076] As shown in Figure 6, the resulting user's representation (430), sequence of keys / characters (315), and noise vector (520) are concatenated into a single matrix 605 and further propagated through a generator (e.g., a generative neural network) 610. This corresponds to and is an exemplary implementation of step s225 of combining representations shown in Figure 2.

[0077] A generator (e.g., a generative neural network) 610 implements step s230 of generating keystroke timestamps and produces as output a 2D array (matrix) 615, where the i-th row contains the press and release timestamps (two values) of the i-th typed key / character of the predicted sequence. As illustrated in Figure 6, matrix 615 representing the generated keystroke timestamps contains x rows, which is the predicted length of the actual n-character text sequence of user text input 107. Element 620 is a conceptual illustration of keystrokes 620-1 and 620-2, among others, on timeline 625, corresponding to values ​​(not shown) in the first and second rows of matrix 615, respectively. Figure 6 further illustrates

number

number

[0078] FIG. 7 is a schematic illustration of the data and network structure for performing steps s230 and s235 shown in FIG. 2 to perform user ID classification and regression training based on generated keystroke timestamps in accordance with an exemplary embodiment of the present disclosure.

[0079] As shown in FIG. 7, the generated timestamps 615, along with the actual sequence 705 of timestamps by a user (e.g., user #i) typing the sampled text (user text input 107), are further processed by a multi-class classifier (e.g., classification neural network) 715 and a regressor (e.g., regression neural network) 720. The classifier (D) 715 is a multi-class classifier that predicts whether a given input is genuine (real) or false (synthetic). It classifies genuine examples into different classes according to user ID. The regressor (R) 720 performs the regression task. It receives the same input as the classifier 715 and learns to predict the length of character sequences to help the generator (e.g., generative neural network 610) generate keystroke sequences of the correct length (e.g., x=n). As illustrated in FIG. 7, in an exemplary embodiment, a keystroke distributor 725 is incorporated to match inputs to a discriminator 715 and a regressor 720 between the generated timestamps 615 output from the generator 610 and the actual keystroke timestamps 705 obtained from the user text input 107.

[0080] Component 730 is a conceptual illustration of the indicia predicted by classifier 715 for the input (e.g., user #1...#k or "false" for the generated keystroke timestamp).

number

number

number

number

[0081] According to an exemplary embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 are neural networks organized into sequential layers of artificial neurons (not shown). In an embodiment, the generator 610, the discriminator 715, and the regressor 720 can each be any machine learning model, including, but not limited to, a dense neural network, a convolutional neural network, a transformer, etc. Information through a neural network typically propagates unidirectionally from an input layer through hidden layers to an output layer (not shown). In one embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 are convolutional neural networks. A convolutional neural network is a specific type of neural network designed to efficiently process images (or 2D arrays) using a special type of layer, i.e., a convolutional layer, inspired by the human visual cortex. In another embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 incorporate a transformer architecture. A Transformer represents a type of neural network that uses multi-head self-attention to learn how distant components, such as pixels or image patches, affect each other. In another embodiment of the present disclosure, the generator 610, the discriminator 715, and the regressor 720 are recurrent neural networks. Recurrent neural networks use feedback connections to learn from sequences of data and can discover long-term dependencies within a given input sequence.

[0082] Regardless of the type of architecture, in embodiments, the neural network (610, 715, and / or 720) can be trained to minimize some loss function using stochastic gradient descent (SGD) or other variations of the gradient descent algorithm. The training process is based on alternating two steps, forward propagation and backpropagation, until the model's prediction error is sufficiently low. Forward propagation consists of passing training data through the model to generate some output or predict some class label. Backpropagation updates the model using the error given by the current prediction to improve the model and reduce its error. To update the model weights, the error is backpropagated through the network. After a few iterations (e.g., 100) on the training data, the algorithm is supposed to find the model weights that minimize the prediction error for the training set. This is done by making small adjustments to the model weights, which move the model down the gradient of the loss function toward a minimum error. This is why the optimization algorithm is called gradient descent.

[0083] In embodiments, any gradient-based backpropagation algorithm, such as SGD (Stochastic Gradient Descent), SGD with Momentum, Adam, AdamW, etc., can be used to train the entire GPAN architecture illustrated in Figures 3-7. To avoid high memory usage, the optimization algorithm can be applied to mini-batches (small subsets) of data examples. To optimize the disclosed GPAN model, a novel loss function is defined by the following equation (1), whose components are shown in Figures 6 and 7:

[0084]

number

[0085] where:

[0086] G represents the generator (610),

[0087] D represents the multi-class classifier (715),

[0088] R represents the regressor (720),

[0089] x represents the sequence of press and release timestamps of the typed text sequence (615);

[0090] t represents the typed text sequence,

[0091] Let u denote a one-hot encoded vector representing the ID associated with the user who typed the text, or an indicator that the example input was generated ("false");

[0092] λ1 represents a hyperparameter that controls the importance of temporal consistency loss,

[0093] λ2 represents a hyperparameter that controls the importance of the mean squared error (MSE) loss with respect to the length of the generated keystroke sequence,

[0094]

number

[0095]

number

[0096] where:

[0097] E represents the expected value,

[0098] p data represents the probability distribution of the data

[0099] p z represents the noise distribution,

[0100] k represents the number of users.

[0101] As illustrated in Figure 7,

number

[0102]

number

[0103]

number

[0104] And here:

[0105]

number

[0106] n represents the sequence length.

[0107]

number

[0108]

number

[0109] As illustrated in Figure 7,

number

[0110] To validate the disclosed GPAN architecture and method of the first training stage (step s105) in a practical scenario, the architecture is trained on a dataset of over 100 users (#k>100) providing thousands of free-text examples (e.g., those stored in database 9345 of FIG. 9). Generally, it is preferable to train the GPAN architecture on free-text examples (user text input 107) to enable learning of generic patterns that can be later used in generating text examples for any user. While the text examples for a particular user can be based on fixed text, e.g., a username, the system and method are preferably capable of generating any text because the user is not necessarily known a priori.

[0111] According to an exemplary embodiment of the present disclosure, to accommodate the typically short size of fixed text examples (e.g., usernames, email addresses, passwords, etc.), the GPAN architecture includes short text sequences (and corresponding keystroke timestamps) (e.g., user text input 107) extracted from free-text examples (e.g., from database 9345 in FIG. 9 ), with lengths ranging from 5 to 20 keys. The resulting short text sequences are then grouped into three clusters of respective length intervals: [5, 10], [10, 15], and [15, 20]. According to an exemplary embodiment, under the assumption that shorter sequences are easier to generate, the training process of step s105 (described with reference to FIGS. 2-7 ) is performed iteratively from the cluster of text sequences with the shortest length (e.g., [5, 10]) to the cluster of the longest length (e.g., [15, 20]). This procedure is based on curriculum learning, a training procedure that first organizes examples in increasing order of difficulty, then starts training the neural network on the easiest examples, gradually adding more difficult examples along the way until all training examples have been fed to the network. The success of this method relies on avoiding forcing the model to learn very difficult examples from the beginning, and instead guiding the model on the correct path through the imposed curriculum. Curriculum learning is a method proposed in "Bengio, Y., Louradour, J., Collobert, R., Weston, J.: Curriculum Learning. In: International Conference on Machine Learning, pp. 41-48, 2009" to better train neural networks by mimicking how humans learn from easy to difficult examples.

[0112] To train the disclosed GPAN architecture, curriculum learning is applied to three groups of text sequences as follows, according to one embodiment of the present disclosure.

[0113] Optimization is first performed for multiple iterations on a first group (text sequences less than 10 characters in length). Then, a second group of data examples is added, and optimization continues for text sequences less than 15 characters in length (which includes the first group). Finally, a final group of data examples is added, and optimization continues until convergence is reached. Thus, longer sequences are considered more difficult to generate. Therefore, training of the generator 610 is significantly improved through a curriculum learning procedure.

[0114] In summary, in the initial training phase, the GPAN architecture alternates between two training steps. On the one hand, the generative neural network (generator) 610 learns to generate keystroke examples that fool the multi-class classifier 715. At the same time, the generator 610 is penalized if it does not help the regressor 720 predict the correct keystroke example length. Thus, the generator 610 and the regressor 720 are partners with the same training objective. Furthermore, the generator 610 applies an additional temporal consistency loss (e.g.,

number

[0115] Second Training Phase (Step s110)

[0116] After training the GPAN framework to generate keystroke examples, a generator 610 is used to generate negative examples for training a user identification model.

[0117] 1, after the keystroke example generator 610 has been properly trained, the process 100 proceeds to step s110, which represents a second training stage. In the second training stage, a binary user identification model is trained on positive keystroke timestamps from actual users (user text input 117) and negative keystroke timestamps (generated by the generator 610 and / or by user text input 107 by another user).

[0118] FIG. 8 is a schematic illustration of the data and network structure for performing step s110, according to an exemplary embodiment of the present disclosure.

[0119] As illustrated in FIG. 8 , for the second training stage, the input examples 805 are a matrix with two columns and a number of rows equal to the number of keystrokes (e.g., p keys / characters) by a user (e.g., user #m). For each keystroke, the matrix records the timestamps of the key press and key release events on the corresponding row. In an exemplary implementation, positive training examples are collected each time a target user (user #m) types pre-established text, such as their username or password (e.g., user text input 117). Negative training examples 815 are automatically generated by the disclosed GPAN architecture (e.g., generator 610) to simulate the typing behavior of users (those with IDs #1, #2, . . . , #k) (e.g., user #j) from an existing database of users (e.g., database 9345 in FIG. 9 ) for the text typed by the target user (user #m). According to one embodiment, user #m does not belong to the existing database of users used in the first training stage.

[0120] Thus, as illustrated in FIG. 8 , a user text input (107) by a user (e.g., user #j) who entered a text sequence (user text input 117) by a target user (user #m), and an associated user ID (e.g., that of user #j) are retrieved based on the text sequence (user text input 117) by the target user as input 810 for generating negative examples 815 by a generator (e.g., a generative neural network) 610. The input 810 corresponds to inputs 305 and 405 shown in FIGS. 3 and 4 for the operation of the generator 610, as described above in the manner of the first training phase with reference to FIGS. 3-6. For example, to generate negative examples for the training procedure of the user identification model 820, user IDs are randomly or pseudo-randomly selected from an existing pool of user IDs (e.g., #1, #2, . . . , #k) used to train the GPAN architecture (or generator 610). In an exemplary embodiment, the user text input 117 of a target user (e.g., user #m) is a fixed text input and is converted into a sequence of character tokens. Corresponding to the operation of the first training stage, a noise vector is generated (e.g., as described with reference to FIG. 5) to ensure diversity in the data examples. The resulting input 810 is passed to generator 610, which generates press and release timestamps specific to a user (e.g., user #j) randomly or pseudo-randomly selected from the pool of existing users (e.g., #1, #2, . . ., #k). Again, according to an exemplary embodiment, the target user (e.g., user #m) is not included in the pool of existing users (e.g., #1, #2, . . ., #k) used to train the GPAN in the first training stage. Thus, the target user is a new user unknown to the GPAN architecture.

[0121] The positive and negative training examples 805 and 815 are input to a user identification model 820 for training to recognize a target user (eg, user #m).

[0122] 8, the user identification model 820 is a binary classifier that outputs predicted positive and negative indicators 825. A positive indicator (“User #m”) predicts that the example timestamp belongs to a user (e.g., User #m), and a negative indicator (“NOT” for User #m) predicts that the example timestamp does not belong to the user. According to an exemplary embodiment, cross-entropy loss against the ground truth actual indicator 830 for each example timestamp (positive or negative) is used to train the user identification model 820.

[0123] Additionally, in particular embodiments, actual negative training examples from other users can be obtained, for example, while the users are typing their own (separate) text sequences, and these can be input (not shown) into the binary user discrimination model 820 instead of or in addition to the negative training examples 815.

[0124] After the binary user identification model 820 is trained, it can be further used to determine whether a new keystroke example timestamp belongs to a target user (e.g., user #m).

[0125] Thus, for each target user to be identified by keystroke dynamics, a training data set is constructed by collecting actual examples of keystroke timestamps (e.g., 805) generated by the respective target user. Such examples are labeled as positive. Simulated keystroke timestamps (e.g., 815) generated by the disclosed GPAN architecture (e.g., generator 610) are added to the training set to enable training of one or more binary classification models (820) aimed at recognizing target users from impersonators. The simulated examples are assigned negative labels.

[0126] In one embodiment of the present disclosure, the binary classifier 820 is a single machine learning model, such as a decision tree, a random forest classifier, a neural network, a logistic regression model, or a support vector machine model. In another embodiment of the present disclosure, the binary classifier 820 is an ensemble of multiple binary classifiers combined in one of various ways, such as single-vote, classifier stacking, or bagging. Regardless of the type of machine learning model, the binary classifier 820 incorporates data preprocessing, data normalization, feature extraction, feature selection, and other steps necessary to obtain a complete and fully operational machine learning system, as will be understood by those skilled in the art. Machine learning models are trained by optimizing some objective or loss function against a constructed training set.

[0127] Once the binary classifier 820 that performs user identification has been trained, the model can be deployed in any software application and computing environment to identify target users. In other words, referring again to FIG. 1 , process 100 proceeds to step s115, where a user identification model (or binary classifier) ​​820 is deployed to identify any user based on user text input 127. According to one exemplary embodiment, the entire process 100 is repeated for each target user. That is, the software application stores and uses a separate binary classifier (820) to authenticate each target user.

[0128] FIG. 9 is a schematic diagram illustrating a system implementing a user identification process based on keystroke dynamics, according to an exemplary embodiment of the present disclosure. A network system 9301 manages the training and deployment process for user identification of the present disclosure. In an embodiment, the network system 9301 embodies one or more of an application server, a network management device, an identity access management (IAM) system, and the like. In an embodiment, the user identification process of the present disclosure is applicable to any network management or account management system incorporated into the network system 9301 to manage any user registration, authentication, and / or identification tasks.

[0129] In some embodiments, the system architecture is language-neutral, allowing REST, JSON, and Secure Sockets Layer to provide a communication interface between various computing devices (e.g., 9301 and 9400-1...9400-m). Furthermore, in one or more embodiments, the architecture is built on open Secure Sockets Layer, JSON, and / or REST APIs. Thus, the disclosed system for identifying users can implement open standards, thereby enabling significant interoperability. It should be further understood that while the various computing devices and machines referenced herein, including but not limited to the network system 9301, the information system 9340, and the user devices 9400-1 through 9400-m, are referred to herein as separate / single devices and / or machines, in certain embodiments, the referenced devices and machines, and their associated and / or associated operations, features, and / or functionality, may be combined, collocated, or otherwise used across any number of devices and / or machines, e.g., over a network or wired connection, as known to those skilled in the art. Correspondingly, functionality for any of multiple entities may be combined and incorporated into a single device without departing from the spirit and scope of the present disclosure.

[0130] As shown in FIG. 9 , network system 9301, information system 9340, and user devices 9400-1 through 9400-m communicate with each other via network 9200. Network 9200 can be the Internet, an intranet network, a local area network, other wireless or other wired connections, or one or more combinations thereof, through which the aforementioned entities can communicate. The communications system facilitating network 9200 can include hardware (e.g., hardware for wired and / or wireless connections) and / or software. In an embodiment, the communications system can include one or more communications chipsets, such as a GSM chipset, a CDMA chipset, an LTE chipset, a 4G / 5G / 6G chipset, a Wi-Fi chipset, a Bluetooth chipset, and / or combinations thereof, to name a few. Wired connectivity can be configured for use with cable, plain old telephone service (POTS) (telephone), fiber optic (e.g., Hybrid Fiber Coaxial), xDSL, to name a few; wired connectivity can use coaxial cable, fiber optic, copper wire (e.g., twisted pair copper), and / or combinations thereof. Wired connectivity can be provided through a telephone port, an Ethernet port, a USB port, and / or other data ports, such as the Apple 30-pin connector port or the Apple Lightning connector port, to name a few. Wireless connections may include cellular or cellular data connections and protocols (e.g., Digital Cellular, PCS, CDPD, GPRS, EDGE, CDMA2000, 1xRTT, RFC1149, Ev-DO, HSPA, UMTS, 3G, 4G, LTE, 5G, and / or 6G, to name a few), Bluetooth, Bluetooth Low Energy, Wi-Fi, radio, satellite, infrared connections, ZigBee communication protocols.Communications interface hardware and / or software that can be used to communicate over wired and / or wireless connections can include, to name a few, an Ethernet interface (e.g., one supporting a TCP / IP stack), an X.25 interface, a T1 interface, and / or an antenna. The computing system can communicate directly and / or indirectly with other computing systems or devices through data networks, such as the Internet, telephone networks, mobile broadband networks (e.g., cellular data networks), mesh networks, Wi-Fi, WAP, LANs, and / or WANs, to name a few. For example, the network 9200 can be accessed using Transmission Control Protocol and Internet Protocol ("TCP / IP") (e.g., any of the protocols used in each of the TCP / IP layers), Hypertext Transfer Protocol ("HTTP"), WebRTC, SIP, and Wireless Application Protocol ("WAP"), which are some of the various types of protocols that can be used to facilitate communication between the user devices 9400-1 through 9400-m and the network system 9301. According to an exemplary embodiment of the present disclosure, network 9200 is comprised of switches (not shown), routers (not shown), and other computing devices (not shown) that facilitate communication and data exchange between servers, e.g., network system 9300 and information system 9340, and clients, e.g., user devices 9400-1...9400-m, while conforming to the connections and protocols described above, as will be understood by those skilled in the art.

[0131] In some embodiments, the user devices 9400-1 through 9400-m and the network system 9301 can communicate with each other via a web browser using HTTP. Various additional communication protocols can be used to facilitate communication between the user devices 9400-1 through 9400-m and the network system 9301, including the following exemplary enumerated list: Wi-Fi (e.g., 802.11 protocol), Bluetooth, radio frequency systems (e.g., 900 MHz, 1.4 GHz, and 5.6 GHz communication systems), cellular networks (e.g., GSM, AMPS, GPRS, CDMA, EV-DO, EDGE, 3GSM, DECT, IS 136 / TDMA, iDen, LTE, or any other suitable cellular network protocol), infrared, BitTorrent, FTP, RTP, RTSP, and / or SSH.

[0132] Correspondingly, as shown in FIG. 9, network system 9301 incorporates communications circuitry (a “network connection interface”) 9305 , one or more processors 9310 , and memory 9315 .

[0133] The network connection interface 9305 may include any circuitry that causes or enables one or more components of the network system 9301 to communicate with one or more additional devices, servers, and / or systems on the network 9200, such as the information system 9340 and one or more of the user devices 9400-1 through 9400-m. The network connection interface 9305 may use any of the exemplary communication protocols discussed above. According to an exemplary embodiment, the network connection interface 9305 comprises one or more universal serial bus (“USB”) ports, one or more Ethernet or broadband ports, and / or any other type of wired access port that communicates with the network 9200 and the information system 9340 and the user devices 9400-1 through 9400-m accordingly.

[0134] The one or more processors 9310 may include any suitable processing circuitry capable of controlling the operation and functionality of the network system 9301 as well as facilitating communication between various components within the network system 9301. In some embodiments, the processor 9310 may include a central processing unit (“CPU”), a graphics processing unit (“GPU”), one or more microprocessors, digital signal processors, or any other type of processor, or any combination thereof. In some embodiments, the functionality of the processor 9310 may be performed by one or more hardware logic components, including, but not limited to, a field programmable gate array (“FPGA”), an application specific integrated circuit (“ASIC”), an application specific standard product (“ASSP”), a system on a chip (“SOC”), and / or a complex programmable logic device (“CPLD”). Additionally, each of the processors 9310 may include its own local memory capable of storing program systems, program data, and / or one or more operating systems.

[0135] The memory 9315 may include one or more types of storage media, such as any volatile or nonvolatile memory, or any removable or non-removable memory, implemented in any suitable manner to store data for the network system 9301. For example, information may be stored using computer-readable instructions, data structures, and / or program systems. Various types of storage / memory may include, but are not limited to, hard drives, solid-state drives, flash memory, fixed memory (e.g., ROM), electronically erasable programmable read-only memory ("EEPROM"), CD-ROM, digital versatile disks ("DVDs") or other optical storage media, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, RAID storage systems, or other storage types, or any combination thereof. Additionally, the memory 9301 may be implemented as a computer-readable storage medium ("CRSM"), which may be any available physical medium accessible by the processor 9310 to execute one or more instructions stored in the memory 9315. According to an exemplary embodiment, one or more applications corresponding to processes 100 and 200, including the data and network structures illustrated in Figures 3-7, are executed by processor 9310. In an embodiment, instructions and data related to these processes may be stored in memory 9315 and / or information system 9340.

[0136] According to an exemplary embodiment of the present disclosure, network system 9301 is in communication with information system 9340 via a direct connection and / or via network 9200. As illustrated in FIG. 9 , information system 9340 maintains one or more databases 9345, which embody a server and corresponding storage media that store data about network system 9305 and user devices 9400-1 through 9400-m related to the training and / or user identification processes of the present disclosure, as would be understood by one of ordinary skill in the art. For example, database 9345 may be used to store user text inputs 107 obtained from user devices 9400-1 through 9400-k for training keystroke generator 610 (e.g., first training phase step s105) and / or user text inputs 117 obtained from user device 9400-m for training a user identification model (e.g., second training phase step s110). In embodiments, processes related to the training (e.g., steps s105 and s110, along with their associated process steps and data structures illustrated in FIGS. 2-7) may be performed, in part or in whole, by network system 9301 and / or information system 9340. Data resulting from the training may likewise be maintained, in part or in whole, by information system 9340 and / or network system 9301. Correspondingly, processes and data related to the user identification process (e.g., development of a user identification model in step s115, along with their associated process steps and data structures illustrated in FIGS. 2-7) may be performed / maintained, in part or in whole, by information system 9340 and / or network system 9301.

[0137] Exemplary storage media for data storage of database 9345 correspond to those described above with respect to memory 9315 and will not be repeated here. In an embodiment, information system 9340 may comprise one or more database servers supporting Oracle SQL, NoSQL, NewSQL, PostgreSQL, MySQL, Microsoft SQL Server, Sybase ASE, SAP HANA, DB2, and the like. Information system 9340 incorporates a network connection interface (not shown) for communicating with network 9200, an exemplary embodiment of which may include those described above with respect to network connection interface 9305 and will not be repeated here.

[0138] In embodiments, network system 9301 and / or information system 9340 may implement an application server configured to host one or more applications accessible and executable over network 9200 by users (user #1 through user #m) of user devices 9400-1 through 9400-m. In embodiments, executable portions of applications maintained on the application server may be offloaded to user devices 9400-1 through 9400-m. For example, graphical user interface rendering and the like may be executed locally on user devices 9400-1 through 9400-m.

[0139] User devices 9400-1...9400m may be any computing and / or data processing device capable of implementing the systems and / or methods described herein, and may include any suitable type of electronic device, including, but not limited to, for each corresponding user (User #1...User #m), a desktop computer, a mobile computer (e.g., laptop, ultrabook), a mobile phone, a portable computing device such as a smartphone, a tablet, a personal display device, a personal digital assistant ("PDA"), a virtual reality device, a wearable device (e.g., a watch), to name a few, that have Internet access that is uniquely identifiable, either directly or via another personal device, by an Internet Protocol (IP) address, an Internet cookie, a Media Access Control (MAC) identifier, or the individual user's (User #1...User #m) online personal account associated with each user device 9400-1...9400-m.

[0140] An exemplary schematic arrangement of user devices 9400-1 through 9400-m, including user access device 9400-1, is illustrated in FIG. 9. As shown in FIG. 9, user device 9400-1 includes a processor 9410, a memory 9420, a communication portal 9430, and a user interface 9415. The processor 9410, memory 9420, and communication portal 9430 may be implemented in accordance with exemplary implementations of processor 9310, memory 9315, and network connection interface 9305, respectively, which will not be repeated here. The communication portal 9430 may use any communication protocol, such as any of the exemplary communication protocols previously described. In some embodiments, user device 9400-1 may include one or more antennas to facilitate wireless communication with a network using various wireless technologies (e.g., Wi-Fi, Bluetooth, radio frequency, etc.). In yet another embodiment, user equipment 9400-1 may include one or more universal serial bus (“USB”) ports, one or more Ethernet or broadband ports, and / or any other type of wired access port, allowing communication portal 9430 to enable user equipment 9400-1 to communicate with each other or with one or more communication networks, including network 9200.

[0141] Additionally, the processor 9410 may execute the operating system ("OS") of the personal user device 9400-1, and / or one or more firmware applications, media applications, and / or applications resident thereon. In some embodiments, the processor 9410 may execute local client scripts that read and render content received from one or more websites. For example, the processor 9410 may execute a local JavaScript client that renders HTML or XHTML content received from particular URLs (e.g., those maintained in association with the network system 9301 and / or the information system 9340) accessed by the personal user device 9400-1.

[0142] The user interface 9415 is operatively connected to the processor 9410 and may include one or more input or output devices, such as switches, buttons, keys, touchscreens, displays, microphones, cameras, sensors, etc., as understood in the art of electronic computing devices. In an exemplary implementation, the user interface 9415 serves to capture keystrokes by users (user #1 through user #m) associated with the training and / or user identification tasks of the present disclosure. For example, the user interface 9415 serves to facilitate the capture of user text input 107 from users (e.g., user #1 through user #k) of associated user devices (e.g., 9400-1 through 9400-k) for training the keystroke example generator 610 (e.g., first training phase step s105). Correspondingly, the user interface 9415 serves to facilitate the capture of user text input 117 from a user (e.g., user #m) of an associated user device (e.g., 9400-m) for training the user identification model 820 (e.g., second training phase step s110), and the capture of user text input 127 for identifying the user based on the trained user identification model 820 (e.g., user identification model deployment step s115). Thus, keystrokes entered via the user interface 9415, which may be a physical or virtual keyboard, keypad, or the like, are captured for training and identification purposes in accordance with processes 100 and 200. Thus, FIG. 9 illustrates an exemplary embodiment of the present disclosure of users #1 through #k forming a keystroke example generator training user pool 9500 from which user text inputs 107 for the first training stage are obtained, and user #m outside the user pool 9500 from which user text inputs 117 and 127 are obtained for the second training stage and user identification task.In an embodiment, user text inputs 107, 117, and 127 may be obtained from each user (User #1...User #m) as part of a user registration and authentication process, a dedicated system security training process, and the like.

[0143] [Example]

[0144] To validate the disclosed process in a real-world setting, we performed a series of experiments using various binary classifiers on two datasets of users. Both datasets contained real-world imposter examples obtained under laboratory conditions. For each of the two datasets, participants were asked to provide imposter keystrokes for each username and password included in the data acquisition experiment. The imposter examples were used for evaluation (validation) purposes because such examples may not be readily available in real-world settings. The user identification models were a gradient boosting classifier, a multilayer perceptron (MLP), a random forest model, and a support vector machine (SVM) model.

[0145] To evaluate the accuracy improvement provided by adding synthetic negative keystroke examples generated by the disclosed GPAN, a binary classification model was trained in two scenarios. In the first scenario, the negative data was formed from keystroke examples generated by real users (other than the target user), but the keystroke examples did not necessarily correspond to the text typed by the target user. That is, the negative examples were collected from other users while they were typing their own text input. In the second scenario, the negative data was formed from synthetic keystroke examples generated by the disclosed GPAN architecture. Using a generative model, it was possible to obtain negative examples of the same text sequence as the positive examples.

[0146] Using the first scenario as a baseline, the impact of adding synthetic negative data is measured in the second scenario. Figure 10 shows the evaluation results of models trained in the two alternative scenarios. Because the datasets contain keystroke inputs for multiple passwords and users, and a machine learning model was generated for each unique user-password pair, the values ​​reported in Figure 10 represent the average accuracy rates obtained for all users in the corresponding datasets. The average accuracy rates for Dataset 1 are shown in Table 1 below, and the average accuracy rates for Dataset 2 are shown in Table 2 below.

[0147] Table 1 (Dataset 1) [Table 1]

[0148] Table 2 (Dataset 2) [Table 2]

[0149] The reported results demonstrate that the disclosed process significantly improves the performance of each classification model, regardless of the dataset. Thus, this experiment validates the effectiveness of the disclosed GPAN architecture.

[0150] Figure 10 shows a comparison of results obtained with and without negative keystroke examples generated by the disclosed GPAN method. The accuracy improvement is significant and consistent across various machine learning models and datasets. As reflected in Figure 10 and Tables 1 and 2, user identification accuracy improved (up to approximately 15%) for all classification models used on the two datasets, thereby validating the gains achieved by the disclosed GPAN technique over models trained with user-generated free-text negative examples.

[0151] Some of the methods described herein can be performed by software or firmware in machine-readable form on a tangible (e.g., non-transitory) storage medium. For example, the software or firmware can be in the form of a computer program containing computer program code configured to cause the system to perform various operations described herein when the program is executed on a computer or suitable hardware device, in which case the computer program can be embodied on a computer-readable medium. Examples of tangible storage media include computer storage devices having computer-readable media such as disks, thumb drives, flash memory, and the like, but do not include propagated signals. Propagated signals may reside in tangible storage media. The software can be suitable for execution on parallel or serial processors such that the various operations described herein can be performed in any suitable order, or simultaneously.

[0152] The headings used herein are for organizational purposes only and are not intended to be used to limit the scope of the specification or claims. As used throughout this application, the words "may" and "can" are used in a permissive sense (i.e., having the possibility) rather than a mandatory sense (i.e., must). To facilitate understanding, like reference numerals have been used whenever possible to designate like components common to the drawings. In specific instances, a dash followed by a letter suffix (···-b) indicates a specific instance of the component with that particular reference numeral (e.g., 9400-b). A description of a component made with reference to a base reference numeral (e.g., 9400) also refers to all instances with that letter suffix (e.g., 9400-b), and vice versa.

[0153] It is to be further understood that like or similar reference numerals in the figures represent like or similar components across the several figures, and that not all components or steps described and illustrated with reference to the figures are required for all embodiments or arrangements.

[0154] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly dictates otherwise. It will be further understood that the terms "contains," "containing," "includes," "including," "comprises," and / or "comprising," and variations thereof, when used herein, specify the presence of stated features, elements, steps, operations, components, and / or ingredients, but do not preclude the presence or addition of one or more other features, elements, steps, operations, components, ingredients, and / or groups thereof, and are intended to encompass the subsequently listed items and equivalents thereof as well as additional items.

[0155] Orientational terms are used herein merely for purposes of convention and reference and are not to be construed as limiting. However, it is recognized that these terms may be used relative to an operator or user. Therefore, no limitation is implied or inferred. Furthermore, the use of ordinal numbers (e.g., first, second, third) is for purposes of distinction and not for purposes of counting. For example, the use of "third" does not imply a corresponding "first" or "second." Additionally, the phraseology and terminology used herein are for purposes of description and should not be considered limiting.

[0156] While the present disclosure has been described in terms of several exemplary embodiments, those skilled in the art will recognize that various changes can be made and equivalents substituted for components thereof without departing from the spirit and scope of the disclosure. In addition, those skilled in the art will recognize that many modifications can be made to adapt a particular equipment, situation, or material to the embodiments of the present disclosure without departing from its essential scope. Therefore, it is intended that the disclosure not be limited to the particular embodiments disclosed or to the best mode contemplated for carrying out the disclosure, but that the disclosure will include all embodiments falling within the scope of the appended claims.

[0157] The subject matter described above is provided by way of example only and should not be construed as limiting. Various modifications and variations can be made to the subject matter described herein without following the exemplary embodiments and applications shown and described, and without departing from the true spirit and scope encompassed by the present disclosure, as defined by the set of claims and structures and functions or steps equivalent to those descriptions.

Claims

1. configured to identify the user based on keystroke dynamics of input by the user: a communications interface to one or more networks; one or more processing devices operably connected to said computer network interface; one or more memory storage devices operably connected to the one or more processing units and storing machine-readable instructions; the machine-readable instructions, when executed, cause the one or more processing units to: In the first training phase, the keystroke example generator is trained: receiving a plurality of first example text inputs by a plurality of first users via the communication interface; For each received first text input example: generating a user-identified representation, a noise representation, and a text sequence representation of the received first example text input; generating example keystroke sequences based on a combination of the generated user identification representation, noise representation, and text sequence representation using the example keystroke generator; inputting the generated example keystroke sequences and the actual keystroke sequence of the received first example text input to a classifier that performs a user identification classification on the generated example keystroke sequences; inputting the generated example keystroke sequences and the actual keystroke sequence of the received first example text input to a regressor that performs a text character length regression on the generated example keystroke sequences; training a keystroke example generator based on the user identification classification of the classifier and the text character length classification of the regressor; In the second training phase, which trains the user identification model, receiving, via the communication interface, one or more second example text inputs by a second user different from the plurality of first users; generating a plurality of negative example keystrokes based on the one or more second example text inputs using the keystroke example generator; training a user identification model for a user classification of the second user based on the one or more second text input examples and the generated plurality of negative keystroke examples; In developing the user identification model, receiving a third example text input associated with the second user via the communication interface; authenticating the third example text input using the trained user identification model; and A device that performs the following.

2. The apparatus of claim 1 , wherein the user identity representation and the text sequence representation are generated using respective embedding neural layers.

3. The apparatus of claim 1 , wherein the user-identified representation and the noise representation are generated using respective neural layers to conform to the format of the text sequence representation.

4. The apparatus of claim 1 , wherein the classifier is a multi-class classifier embodied by a neural network and the regressor is a recurrent neural network.

5. training the keystroke example generator, user identification classification by the classifier, and text character length regression by the regressor; [Equation 1] is based on G represents the keystroke example generator; D represents the multi-class classifier; R represents the regressor; x represents an array of press and release timestamps for the typed text sequence of the received first example text input; t represents the typed text sequence of the received first example text input; u represents a one-hot encoded vector representing an ID associated with one of the plurality of first users who typed the received first example text input, or an indicator that an example input to the classifier was generated; λ １ is a hyperparameter that controls the importance of temporal consistency loss, λ ２ is a hyperparameter that controls the importance of mean squared error (MSE) loss with respect to the length of text characters in the generated example keystroke sequence; [Equation 2] And, E represents the expected value, p ｄａｔａ represents the probability distribution of the data, p ｚ represents the noise distribution, k represents the number of the plurality of first users; [Equation 3] [Equation 4] and therefore y ｉ，０ and y ｉ，１ represents the timestamps of the press and release of the i-th key in the sequence t, n represents the sequence length, [Equation 5] 5. The device of claim 4, wherein:

6. 2. The apparatus of claim 1, wherein the plurality of example negative keystrokes is generated by the generator based on one or more of the plurality of first example text inputs associated with one or more of the plurality of first users that are different from the second user.

7. 7. The apparatus of claim 6, wherein at least one of the example negative keystrokes is generated based on one of the plurality of first example text inputs comprising the same character sequence as the one or more second example text inputs.

8. 2. The apparatus of claim 1, wherein the user identification model is a binary classifier that determines whether a keystroke sequence of the third example text input corresponds to the second user based on the user classification training.

9. The apparatus of claim 1 , wherein the plurality of first example text entries comprises free text entries by the plurality of first users.

10. The apparatus of claim 1 , wherein the one or more second text input examples comprise a fixed text input by the second user.

11. 1. A method for identifying a user based on keystroke dynamics of input by the user, comprising: In the first training phase, the keystroke example generator is trained: receiving, by the processing device via the communications interface, a plurality of first example text inputs by a plurality of first users; For each received first text input example: generating, by the processing device, a user-identified representation, a noise representation, and a text sequence representation of the received first example text input; generating, by the processing unit using the example keystroke generator, example keystroke sequences based on a combination of the generated user identification representation, noise representation, and text sequence representation; inputting, by a processing device, the generated example keystroke sequences and the actual keystroke sequence of the received first example text input to a classifier that performs a user identification classification on the generated example keystroke sequences; inputting, by the processing unit, the generated example keystroke sequences and the actual keystroke sequence of the received first example text input to a regressor that performs a text character length regression on the generated example keystroke sequences; training, by the processing unit, the keystroke example generator based on the user identification classification of the classifier and the text character length classification of the regressor; In the second training phase, which trains the user identification model, receiving, by the processing device via the communications interface, one or more second example text inputs by a second user different from the plurality of first users; generating, by the processing unit using the keystroke example generator, a plurality of negative keystroke examples based on the one or more second text input examples; training, by the processing device, a user identification model for a user classification of the second user based on the one or more second example text inputs and the generated plurality of negative keystroke examples; In developing the user identification model, receiving, by the processing device via the communications interface, a third example text input associated with the second user; authenticating, by a processing device, a third example text input using the trained user identification model; A method comprising:

12. The method of claim 11 , wherein the user identity representation and the text sequence representation are generated using respective embedding neural layers.

13. The method of claim 11 , wherein the user-identifying representation and the noise representation are generated using respective neural layers to fit the format of the text sequence representation.

14. The method of claim 11 , wherein the classifier is a multi-class classifier embodied by a neural network and the regressor is a recurrent neural network.

15. training the keystroke example generator, user identification classification by the classifier, and text character length regression by the regressor; [Equation 6] Based on where: G represents the keystroke example generator; D represents the multi-class classifier; R represents the regressor; x represents an array of press and release timestamps for the typed text sequence of the received first example text input; t represents the typed text sequence of the received first example text input; u represents a one-hot encoded vector representing an ID associated with one of the plurality of first users who typed a received first example text input, or an indicator that an example input to the classifier was generated; λ １ is a hyperparameter that controls the importance of temporal consistency loss, λ ２ is a hyperparameter that controls the importance of mean squared error (MSE) loss with respect to the length of text characters in the generated example keystroke sequence; [Equation 7] where E represents the expected value, p ｄａｔａ represents the probability distribution of the data, p ｚ represents the noise distribution, k represents the number of the plurality of first users; [Equation 8] [Equation 9] and therefore y ｉ，０ and y ｉ，１ represents the timestamps of the press and release of the i-th key in the sequence t, n represents the sequence length, [Equation 10] The method of claim 14, wherein

16. 12. The method of claim 11 , wherein the plurality of negative keystroke examples are generated by the generator based on one or more of the plurality of first text input examples associated with one or more of the plurality of first users that are different from the second user.

17. 17. The method of claim 16, wherein at least one of the example negative keystrokes is generated based on one of the plurality of first example text entries comprising the same character sequence as the one or more second example text entries.

18. 12. The method of claim 11, wherein the user identification model is a binary classifier that determines whether a keystroke sequence of the third example text input corresponds to the second user based on the user classification training.

19. The method of claim 11 , wherein the plurality of first example text entries comprises free text entries by the plurality of first users.

20. The method of claim 11 , wherein the one or more second text input examples comprise fixed text input by the second user.

Images