Computer Security Forensics Based on Temporal Typing Changes of Credentials

Abstract

Aspects of the present invention disclose a method, computer program product, and system for employing keystroke dynamics authentication. The method includes one or more processors recording, for a plurality of users, respective keystroke sessions of multiple typing samples (typed consecutively) of authentication information associated with each of the plurality of users. The method further includes extracting a feature set characterizing typing variations between the multiple typing samples. The method further includes detecting repeated typing of a particular one of the authentication information associated with a particular user of the plurality of users. The method further includes extracting a feature set characterizing typing variations between repetitions from the repeated typing of the particular authentication information. The method further includes comparing the feature set extracted from the repeated typing with the feature set extracted from the set of keystroke sessions to infer which user is a first user.

Description

[Technical field]

[0001] The present invention relates generally to the field of computer security, and more specifically to keystroke dynamics. [Background technology]

[0002] Keystroke dynamics is an active research topic in the field of behavioral biometrics. Keystroke dynamics identifies and measures the manner and rhythm of how a person types on a keyboard (physical or virtual). For example, a keystroke dynamics system can distinguish between different people by how fast they tend to type, whether they type all letters at the same pace or tend to pause before typing a particular letter, how long they typically hold down each key, etc.

[0003] Authentication by keystroke dynamics typically involves a machine learning algorithm that uses a number of recorded keystroke sessions to train a model that is characteristic of the associated user. New keystroke sessions of the user (or a person purporting to be the user) can then be compared to the model by the machine learning algorithm. If the content of this new keystroke session matches the model sufficiently well, the user's identity is authenticated. Summary of the Invention

[0004] Aspects of the present invention disclose methods, computer program products, and systems for employing keystroke dynamics authentication. The method includes one or more processors for recording, for a plurality of users of a computerized system, respective keystroke sessions including a plurality of typing samples of authentication information associated with respective users of the plurality of users. The plurality of typing samples are typed consecutively by the respective users. The method further includes one or more processors for extracting from each of the respective keystroke sessions a set of features characterizing typing variations between the plurality of typing samples. The method further includes one or more processors for detecting an attempt by a first user to circumvent keystroke dynamics authentication and log into the computerized system by detecting repeated typing of a particular one of the authentication information associated with a particular user of the plurality of users. The method further includes one or more processors for extracting from the repeated typing of the particular authentication information by the first user a set of features characterizing typing variations between repetitions. The method further includes one or more processors comparing the set of features extracted from the repeated typing of the authentication information by the first user to the set of features extracted from the set of keystroke sessions to infer which user of the plurality of users is the first user. [Brief description of the drawings]

[0005] Exemplary embodiments are illustrated in the referenced drawings, in which dimensions of components and features shown generally have been selected for convenience and clarity of presentation and have not necessarily been drawn to scale. The drawings are listed below.

[0006] [Figure 1] FIG. 1 is a block diagram of an exemplary system for inferring the identity of a user attempting to circumvent keystroke dynamics authentication features and log into a system in accordance with an embodiment of the present invention. [Diagram 2] 1 is a flowchart of a method for inferring the identity of a user attempting to circumvent keystroke dynamics authentication functionality and log into a system according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] Embodiments of the present invention recognize that because each individual's keystroke dynamics are highly unique, security systems can reliably authenticate an individual's identity based on the individual's measured keystroke dynamics. Accordingly, some security systems use keystroke dynamics either as an add-on to traditional authentication techniques (such as passwords, tokens, two-factor authentication, etc.) or as a replacement for these techniques entirely.

[0008] The above examples of the related art and limitations associated therewith are intended to be illustrative and not exhaustive. Other limitations of the related art will become apparent to those skilled in the art upon reading the specification and studying the drawings.

[0009] This specification discloses techniques, embodied in methods, systems, and computer program products, for computer security forensics based on temporal typing changes of authentication information. Embodiments of the invention operate to infer the identity of a computer system user attempting to circumvent keystroke dynamics authentication features and log into a computerized system.

[0010] Various embodiments of the present invention provide advantages when operating in conjunction with a type of keystroke dynamics authentication function that requires a user to type authentication information (e.g., username, password, etc.) and then analyzes the keystroke dynamics of the typing to determine whether to allow the user to log in. If the authentication information matches predefined user authentication information and the keystroke dynamics match a pre-built user keystroke dynamics model, the user is allowed to log in.

[0011] An attacker may attempt to circumvent such keystroke dynamics authentication features by first gaining access to a user's credentials (through phishing, social engineering, guesswork, etc.) and then attempting to type the credentials to log into a computerized system. If the login attempt fails, the attacker will type the credentials multiple times in the hope that one of the repeated inputs will be accepted by the computerized system as valid. As an attacker types the same credentials multiple times in succession, their typing style tends to unconsciously change over time. This is primarily due to the cognitive learning process (the "learning curve") involved in repeatedly typing the same characters of characters.

[0012] Although a computerized system can typically infer that an attack is underway from a series of such failed login attempts, embodiments of the present invention recognize that it may still be difficult for a system to identify an attacker other than by recording various generic identifiers (such as the attacker's Internet Protocol (IP) address, which may be forged and may not provide a conclusive identification).

[0013] Furthermore, embodiments of the present invention can enable a computerized system to attribute an attack to a particular user of the computer system, thereby aiding in the identification of the attacker. This determination and attribution is based on the recognition that attackers often tend to sign up for their own user accounts on computerized systems before launching an attack, to study the security measures employed by the computerized system and potentially also to look for suitable users to target.

[0014] Attributing an attack to a particular user of a computerized system may leverage the fact that all users, including potential attackers, provided multiple typing samples of their credentials upon sign-up (or later, during the credential change process). The successive typing samples entered by the users are used in a conventional manner by the keystroke dynamics authenticator to create a keystroke dynamics model of each user, e.g., to determine how the user tends to type the characters of the credential. As a simple example, if a user's credential is a password that reads "a1b," the keystroke dynamics authenticator may form a model of the user based on the average time to press each of the letters "a," "1," and "b," the average interval between typing "a" and "1" and between typing "1" and "b," or other similar statistics associated with particular characters, or a combination thereof.

[0015] Beyond the standard use of the typing samples to create a keystroke dynamics model, embodiments of the present invention can further utilize typing samples of each user. Moreover, embodiments of the present invention extract from the samples a set of features that characterize typing changes between multiple typing samples. These features are derived from what can be called the "learning curve" of a user as he repeatedly types the same credentials upon sign-up (or credential change). A user's keystroke dynamics tend to change gradually along successive typings, which is exactly what may happen when an attacker repeatedly enters a target user's credentials. Thus, by comparing the time changes of an attacker's login attempts with previously recorded time changes for each user, it may be possible to identify the attacker as one of the users of the computerized system.

[0016] However, embodiments of the present invention recognize that matching an attacker's typing changes over time with those of other users is not straightforward. This is primarily because the attacker's own credentials (e.g., a password that reads "john2020") are most likely to differ from the target user's credentials (e.g., a password that reads "jane123"). Thus, to facilitate such comparisons, embodiments of the present invention can perform a series of calculations that ultimately represent the feature sets of all users in a uniform manner, which is agnostic to both (a) the actual keys pressed to type each credential, and (b) the length of each credential. For example, each feature set can be represented as a feature vector with uniform length and the same structure.

[0017] Once such a uniform feature set is available for all users, the computerized system can respond to the attack by extracting such a uniform feature set for the attacker's login attempts as well and comparing the attacker's feature set with the feature sets of all or a portion of the users of the computerized system. For example, the comparison may include applying a machine learning algorithm to the feature set or calculating a mathematical distance metric between the attacker's feature set and other feature sets.

[0018] In another aspect, to reduce the computational resources required for each such comparison, embodiments of the present invention may select a smaller subset of users of the computerized system to perform the comparison. For example, if the computerized system is that of a social network, the comparison may be performed only between social network users who are linked (e.g., "friends") with the target user. Similarly, any form of relationship between users of the computerized system, such as past interactions or other methods of indicating that users are related, may be utilized to narrow down the list of users to be compared with the attacker's feature set.

[0019] Reference is now made to Figure 1, which is a block diagram of an example computer system 100 configured to circumvent keystroke dynamics authentication features to infer the identity of a user attempting to log in. System 100 may include one or more hardware processors 102, random access memory (RAM) 104, and one or more computer-readable storage devices 106.

[0020] The storage device 106 may store program instructions and / or components configured to operate the hardware processor 102. The program instructions may include one or more software modules, such as the attacker identification module 108. The software components may include an operating system having various software components and / or drivers for controlling and managing general system tasks (e.g., memory management, storage control, power management, etc.) and facilitating communication between the various hardware and software components.

[0021] The system 100 may operate by loading instructions of an attacker identification module 108 into the RAM 104 for execution by the processor 102. The attacker identification module 108 may instruct the system 100 to record a user keystroke session for each of the system's users during a sign-up process and / or credential change process (block 110) and extract a respective user feature set characterizing typing changes between multiple typing samples of the keystroke session (block 112). If an attack is detected, the attacker identification module 108 may instruct the system 100 to extract a feature set characterizing typing changes between repeated credential typings by the attacker (block 114), compare the features to previously extracted user feature sets for some or all of the users (block 112), and infer the identity of the attacker among the system's users (block 116).

[0022] The system 100 described herein is merely an exemplary embodiment of the invention and may in fact be implemented in hardware only, software only, or a combination of both hardware and software. System 100 may have more or fewer components and modules than shown, may combine two or more components, or may have different configurations or arrangements of components. System 100 may include additional components (not shown) that enable system 100 to function as an operational computer system, such as a motherboard, data bus, power supply, network interface card, display, input devices (e.g., keyboard, pointing device, touch-sensitive display), etc. Additionally, the components of system 100 may be co-located or distributed. Alternatively, the system may be implemented as one or more cloud computing "instances," "containers," or "virtual machines," or a combination thereof, as known in the art.

[0023] Instructions for the attacker identification module 108 will now be described with reference to the flowchart of Figure 2. Figure 2 illustrates a method 200 for circumventing keystroke dynamics authentication features to infer the identity of a user attempting to log into a computerized system, such as system 100 of Figure 1, according to an embodiment of the present invention.

[0024] The steps of method 200 may be performed in the order presented, or in a different order (or even in parallel), so long as the necessary input for a particular step is obtained from the output of a previous step. Additionally, the steps of method 200 are performed automatically (e.g., by system 100 of FIG. 1) unless specifically noted otherwise.

[0025] At step 202, method 200 records a keystroke session for each of a plurality of users of the system. Each such keystroke session may include multiple typing samples of authentication information associated with the respective user (e.g., a username, email address, password, or any other multi-character authentication information (including one or more letters, numbers, symbols, or the like, or combinations thereof) selected by the user or assigned to the user by the system). In various embodiments, the user may be prompted by the system to type the authentication information multiple times in succession (e.g., a total time limited to 5, 10, 20, 30, 40, 50, or 60 seconds, or any value therebetween or greater), for example, in one or more fields provided within a graphical user interface (GUI) provided by the system. Method 200 may record each such typing by the user as a separate typing sample. The recorded keystroke session thereby includes an ordered set of consecutively typed typing samples.

[0026] A user may enter the authentication information on a computerized device that is connected to the system via a computer network, such as a local area network (LAN) or the Internet. A user may enter the authentication information using a physical keyboard or a virtual keyboard (e.g., assisted by a touch screen or an on-screen virtual keyboard operated using a pointing device) of their computerized device.

[0027] Based on step 202, method 200 can utilize a keystroke dynamics authentication feature of the system to create a conventional keystroke dynamics model for the associated user. In one embodiment, the keystroke dynamics authentication feature is one aspect of an authentication system that method 200 can utilize in accordance with various aspects of the present invention. Thus, although not described herein, embodiments of the present invention can perform conventional methods at step 202.

[0028] At step 204, method 200 extracts a set of features from each of the keystroke sessions that characterize typing variations among the multiple typing samples. In various embodiments, the process of extracting features from the keystroke sessions at step 204 can include sub-steps 204a, 204b, and 204c, which are described in more detail below.

[0029] At sub-step 204a, the method 200 calculates digraph latencies between each keystroke event in the typing sample. As is known in the field of keystroke dynamics, a digraph latency is the time difference between two keystroke events. For example, such keystroke events may include press to consecutive press, press to consecutive release, release to consecutive release, or release to consecutive press, or combinations thereof. In an exemplary embodiment, the keystroke events are key-agnostic. That is, the keystroke events consider only the serial position of each pressed key in the typing sample, and not the identity of the key itself (the particular letter, number, or symbol entered). As a simple example, based on a typing sample of the authentication information "a1b", three letters are serial numbered 1 to 3, respectively. The nine digraph latencies can then be calculated as follows:

[0030] [Table 1]

[0031] Considering the fact that different users' authentication information may have different lengths, method 200 need not use all of the digraph time differences calculated for the four exemplary keystroke event types. Instead, method 200 can reduce the calculated digraph time differences to a single value for each keystroke event type. For example, method 200 can utilize the median or average digraph time differences for each keystroke event type as a representative value for that keystroke event type. Referring to the above example, if the press to successive release time differences were 300 ms (milliseconds) for key #1, 170 ms for key #2, and 130 ms for key #3, method 200 can utilize the average value of 200 ms or the median value of 170 ms as a representative value of the digraph time differences for this keystroke event in the typing sample, thus becoming independent of the authentication information length.

[0032] In another embodiment, method 200 may also calculate (for each typing sample) the digraph time difference between the first one of the keystroke events (press of key #1 in the above example) and the last one of the keystroke events (release of key #3 in the above example). This digraph time difference will obviously depend on the length of the typed authentication information, but this value may be a useful metric when comparing such digraph time differences across all typing samples. For example, method 200 may utilize this value to make the observation that a particular user tends to type each successive sample 20% faster than the previous sample, as will be further described below.

[0033] In a further embodiment, the method 200 can also calculate (for each typing sample) the digraph time difference between the first one of the keystroke events (in the above example, the press of key #1) and the last one of the keystroke events of the previous typing sample (not given in the above example). In other words, this is the interval between every two consecutive typing samples. Of course, the method 200 does not calculate this value for the first typing sample in a keystroke session, only for the second and subsequent typing samples.

[0034] In addition to, or in lieu of, some of the digraph time differences described above, embodiments of the present invention may operate to calculate and utilize digraph time differences between other types of keystroke-related events in each typing sample. Additionally, embodiments of the present invention may calculate various statistical indices for more than two keystroke events at a time.

[0035] In an exemplary embodiment, upon completion of sub-step 204a, each keystroke session is optionally represented as a feature matrix, where the rows are consecutive samples of the keystroke session and the columns are corresponding features (i.e., the various calculated digraph time differences). An example of such a feature matrix is ​​shown in Table 2 below.

[0036] For example, assuming a typing sample has six digraph time differences (press to successive presses, press to successive releases, release to successive releases, release to successive presses, first press to last release, and interval from previous typing sample), method 200 operates (via sub-step 204a) to provide six respective features. For example, if the system recorded that a user typed their authentication information ten times in succession, the feature matrix for the keystroke session would be on the order of 10 by 6.

[0037] [Table 2]

[0038] At sub-step 204b, for each of the keystroke sessions, method 200 may calculate changes in digraph time differences between at least some of the typing samples. The calculations of sub-step 204b may operate to detect temporal changes in how the respective user types the authentication information along the keystroke session. In general, keystroke dynamics tend to change gradually as the user progresses along the sequence of typing samples. This change is usually the result of the user making rapid cognitive improvements in performing the typing task.

[0039] Various embodiments of the invention may perform the calculation of change in a pair-wise manner, with each pair including feature (digraph time difference) values ​​from two of the typing samples. The samples may be consecutive typing samples (e.g., sample 1 and sample 2) or discontinuous typing samples (e.g., sample 2 and sample 5). Another option is to aggregate feature values ​​from two or more typing samples (consecutive or discontinuous) and compare the aggregated value to feature values ​​from a single typing sample or to another aggregated value. For example, the aggregation may include a statistical calculation such as averaging the values. As another example, the aggregation may include comparing a feature in one sample (e.g., sample 1) to the same feature in each of the other samples (e.g., samples 2, 3, 4, 5). The calculated change along the samples may then be a rate of change defined, for example, by a linear, exponential, or custom function (e.g., polynomial, piecewise, etc.).

[0040] It should be noted that not all typing samples are necessarily included in the calculation. For example, an embodiment of the present invention may determine that in a scenario, a calculation based on only the first two typing samples and the last two typing samples is sufficient to capture the most significant temporal changes along a keystroke session. In such a scenario, the preceding sub-step 204a need not include a calculation of digraph time differences for the unused typing samples.

[0041] The pairwise calculation of sub-step 204b may include at least one mathematical operation applied to the two values ​​of the pair. For example, the values ​​may be subtracted, added, multiplied, divided, raised to the power of each other, averaged, or similar operations or combinations thereof. Method 200 may also operate to amplify values ​​or to attenuate values ​​by a predefined factor (linear or exponential).

[0042] Next, in sub-step 204c, method 200 can generate a uniform feature vector for each of the keystroke sessions, i.e., method 200 can generate feature vectors with uniform length and structure across all keystroke sessions, thereby ensuring that representations of different users' keystroke sessions are uniform and independent of authentication information lengths that vary between users.

[0043] Generating each uniform feature vector in sub-step 204c may include statistically processing the calculated changes for each keystroke session. This processing may involve the calculation of one or more statistical functions, such as standard deviation, mean, median, average gradient, or histogram analysis or combinations thereof, on the changes calculated in the previous sub-step 204b. Note that these are only a few examples of statistical functions that may be used. One or more other statistical functions known in the art may be used as well, so long as they are capable of meaningfully summarizing the multiple changes calculated for each feature.

[0044] For each keystroke session, the statistical process may generate a per-feature value that represents the feature's change over time along the keystroke session. The feature values ​​for all of a keystroke session form a uniform feature vector for that keystroke session. Because method 200 can apply substeps 204a, 204b, and 204c uniformly for all keystroke sessions, the resulting feature vectors are guaranteed to be uniform in length (the number of features they contain) and structure (the type of features and their order within the vector).

[0045] Optionally, each feature vector may also undergo dimensionality reduction to compress it to retain its most important features. For example, various embodiments of the present invention may utilize Principal Component Analysis (PCA) or Linear Discriminant Analysis (LDA) to reduce dimensionality, as known in the art. As another option, embodiments of the present invention may apply feature selection algorithms, known in the art, to each feature vector to search for and evaluate different feature subsets that better characterize temporal typing changes along a keystroke session.

[0046] Next, in step 206, method 200 stores the feature set (extracted in step 204, i.e., the feature vector finally generated in sub-step 204c) in a computerized database. The database may be part of system 100 (FIG. 1) or may be contained in a separate computer server in network communication with the system.

[0047] Notably, for each new user signing up to system 100 (FIG. 1), method 200 may perform steps 202-206 and add the generated feature vector to the database. Similarly, for each credential change process initiated for an existing user, method 200 may perform steps 202-206 and the generated feature vector replaces the user's old feature vector in the database. When operating as a new application of the technology to a system with existing users, method 200 may perform steps 202-206 for previously recorded keystroke sessions for the user, assuming such records have been kept since the user first signed up.

[0048] At step 208, method 200 detects an attacker's attempt to circumvent the system's keystroke dynamics authentication and log into the system. For example, this detection may be performed by the system's keystroke dynamics authentication functionality or any other security-related functionality of the system, according to various embodiments of the invention.

[0049] The detected attempts may include repeatedly typing a particular one of the credentials associated with a particular user. Method 200 may detect when a predetermined number of such failed attempts are logged, for example, 3, 4, or 5 (or a lesser or greater number as defined by a system administrator). Detecting a failed attempt indicates that the person typing the credentials is likely not the true user who owns the associated user account, but rather an attacker who has somehow fraudulently obtained the user's credentials and is attempting to log into the system as that user.

[0050] In step 210, the method 200 extracts from the repeated typing a set of features that characterize typing changes between detected repetitions. This feature extraction step may include the same operations (with appropriate modifications) performed in step 204 on a keystroke session of a user of the system. That is, the method 200 may treat each typing of the credential by the attacker as a typing sample of the user, and treat a series of repeated typings as a keystroke session of the user. Therefore, the description of how to extract a set of features from the repeated typing by the attacker will not be repeated here, as the details are provided above.

[0051] Upon completion of step 210, method 200 can provide a final set of features of the attack attempt, optionally represented as a feature vector. In performing step 210, method 200 can perform all operations similar to those performed in step 204 for each keystroke session. This makes the feature vector of the attack attempt uniform (in length and structure) with the feature vectors of all keystroke sessions. Thus, the feature vectors can be easily compared at a later time.

[0052] At step 212, method 200 compares the feature set of the attack attempt against feature sets of at least some of the keystroke sessions of users of the system, as fetched from the database. At optional sub-step 212a, to reduce the potentially large computational burden of comparing the feature set of the attacker with feature sets of the keystroke sessions of all users of the system, method 200 may perform an intelligent selection of a smaller number of users. For example, the system may select from among keystroke sessions associated with users who are linked to a particular user whose account is the target of the attack. For example, if the system is a social network (e.g., a social networking website or platform) or an instant messaging platform (e.g., an internet messaging service or social media messaging service), the comparison may be performed only against keystroke sessions of users that the system defines as linked (e.g., "friends") with the target user.

[0053] Additionally or alternatively, various embodiments of the present invention may exploit any implicit linkage between users of a computerized system to narrow down the users for which keystroke sessions are compared. Such implicit linkage may be inferred, for example, from the fact that users have previously interacted with each other within the system, such as through direct messaging between users or through one user's interaction with content posted by another user within the system (e.g., commenting on a post, "liking" a post, etc.).

[0054] In an exemplary embodiment, method 200 may perform the comparison of step 212 based on a machine learning algorithm that generates a probability score for each of the selected user's keystroke sessions that indicates the likelihood that the selected user is an attacker. The machine learning algorithm may be, for example, a random forest algorithm, a support vector machine (SVM), a naive Bayes algorithm, etc. However, one of ordinary skill in the art may recognize other machine learning algorithms that are suitable for generating a probability score.

[0055] Various embodiments of the present invention can train a machine learning algorithm on a training set that includes feature vectors for multiple users (e.g., at least 50, 100, 200, or 500 users), each feature vector labeled with the unique identifier of that user (e.g., a simple serial number assigned to that user for training purposes). In the training set, each user has at least one feature vector associated with that user. However, it may be beneficial to have multiple feature vectors for each user, i.e., feature vectors obtained from separate keystroke sessions of that user recorded at least minutes, hours, or days apart. Embodiments of the present invention recognize that the more feature vectors available for each user, the more the machine learning algorithm can learn the underlying features of these feature vectors (features that attribute these feature vectors to the same class (i.e., user identifier) ​​as indicated by the label).

[0056] The resulting machine learning model (also called a "classifier") can then calculate the probability that a new, previously unseen feature vector belongs to various known classes - the existing users of the system (or a refined subset of users). That is, when the trained machine learning model is applied to a new feature vector (i.e., an attack feature vector), the trained machine learning model will assign probability scores to the various existing users.

[0057] As an alternative to machine learning, the method 200 can perform the comparison of step 212 based on a mathematical distance metric that quantifies the distance (or "similarity") between each of two feature vectors, the attacker's vector and one of the users' vector. Examples of suitable distance metrics include Manhattan distance, Euclidean distance, Chebyshev distance, etc. However, those skilled in the art will recognize other mathematical distance metrics suitable for calculating the distance between two feature vectors.

[0058] Next, at step 214, method 200 estimates which of the users is likely to be the attacker. In various embodiments, method 200 determines the estimate based on the comparison results of step 212. In this manner, method 200 identifies as the putative attacker the user (i.e., keystroke session feature vector) that compares with the attacker (i.e., attack feature vector) with the highest probability score (in the case of a machine learning algorithm) or the shortest distance (in the case of a mathematical distance metric). If multiple users have the same highest probability score or the same shortest distance, method 200 may flag all corresponding users as possible attackers.

[0059] Additionally, method 200 may operate to output a ranked list of likely attackers based on top-k probability scores or bottom-k distance, where k may be set as desired, such as from 2 to 20 or more. In either case, method 200 may transmit the identity of the likely attacker, i.e., details of the corresponding user account in the system (e.g., username, email address, linked single sign-on account, etc.), to an administrator of the system, a person responsible for security of the system, or a combination thereof. These persons may take steps to stop the attack or prevent future attacks. These steps may, for example, be terminating the attacker's user account, requiring the targeted user to change their credentials, or a combination of similar steps. Alternatively, embodiments of the present invention may automatically initiate one or more such steps by the system upon discovery of the likely identity of the attacker.

[0060] One advantage of this technique is that it may create a deterrent among potential attackers. If it becomes apparent that a system is using this technique to identify attackers, potential attackers are likely to be deterred from targeting users of that system. The attacker knows that if he attempts to log into other user accounts in the system by repeatedly typing a user's fraudulently obtained credentials, the system can then associate such an attack with the attacker's own account that he opened in preparation for the attack. Thus, unless the attacker is confident that he can circumvent the system's keystroke dynamics authentication features on the first try or the first few tries (which is highly unlikely), he knows that repeatedly typing a user's credentials will make him more visible.

[0061] The technique may be employed in conjunction with other conventional methods of computer security forensics. For example, in addition to recording each user's keystroke sessions and attacker attempts, identifiers such as IP addresses, user agent strings, or Media Access Control (MAC) addresses, or a combination thereof, may be collected. If an attacker maintains the same identifier from the time they sign up for a user account until they perform an attack, the attack can be more accurately associated with a particular user account. Identifiers that can be used further include those created by traditional behavioral biometric techniques (e.g., unique patterns of pointing device movements, touchscreen interactions, etc.). In general, the technique may be combined with one or more additional user identifiers to improve the accuracy of an estimate of which users of a particular system are attackers.

[0062] The present invention may be a system, a method, or a computer program product, or a combination thereof. The computer program product may include a computer readable storage medium having stored thereon computer readable program instructions for causing a processor to perform aspects of the present invention.

[0063] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. The computer-readable storage medium may be, for example, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or a suitable combination thereof. More specific examples of computer-readable storage media include portable computer diskettes, hard disks, RAM, ROM, EPROM (or flash memory), SRAM, CD-ROM, DVD, memory sticks, floppy disks, punch cards or ridges in grooves or other mechanically encoded devices with instructions recorded thereon, and suitable combinations thereof. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a wave guide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electric signal transmitted through a wire.

[0064] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computer device / processing device. Alternatively, they can be downloaded to an external computer or external storage device via a network (e.g., the Internet, a LAN, a WAN, or a wireless network, or a combination thereof). The network can include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computer device / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium in the respective computer device / processing device for storage.

[0065] The computer readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk and C++, and procedural programming languages ​​such as the "C" programming language and similar programming languages. The computer readable program instructions may be executed entirely on the user's computer as a stand-alone software package, or partially on the user's computer, or partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a LAN or WAN, or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry, including, for example, programmable logic circuitry, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), can execute computer readable program instructions by utilizing state information of the computer readable program instructions to customize the electronic circuitry for carrying out aspects of the present invention.

[0066] Aspects of the present invention are described herein with reference to flowchart and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. Each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer readable program instructions.

[0067] These computer readable program instructions can be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, whereby the instructions executed via the processor of such computer or other programmable data processing apparatus create means for performing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions can further be stored on a computer readable storage medium capable of instructing a computer, programmable data processing apparatus or other device, or combination thereof, to function in a particular manner. The computer readable storage medium having instructions stored thereon thereby constitutes an article of manufacture including instructions for performing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0068] Also, computer-readable program instructions may be loaded into a computer, other programmable device, or other apparatus and a sequence of operational steps executed on the computer, other programmable device, or other apparatus to generate a computer-implemented process, whereby the instructions executing on the computer, other programmable device, or other apparatus perform the functions / operations identified in one or more blocks in the flowcharts and / or block diagrams.

[0069] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for performing a specific logical function. In some other implementations, the functions shown in the blocks may be performed in a different order than the order shown in the figures. For example, depending on the functions involved, two blocks shown in succession may actually be accomplished as one step, may be performed simultaneously or nearly simultaneously, may be performed in a partially or fully overlapping manner, or the blocks may be performed in reverse order in some cases. It should be noted that each block in the block diagrams and / or flowcharts, and combinations of multiple blocks in the block diagrams and / or flowcharts, may be executed by a dedicated hardware-based system that performs a specific function or operation or executes a combination of dedicated hardware and computer instructions.

[0070] Descriptions of numerical ranges should be considered to have specifically disclosed all the possible subranges and individual numerical values ​​within those ranges. For example, description of a range such as "1 to 6" should be considered to have specifically disclosed subranges such as 1 to 3, 1 to 4, 1 to 5, 2 to 4, 2 to 6, 3 to 6, etc., as well as individual values ​​within that range (e.g., 1, 2, 3, 4, 5, and 6). This applies regardless of the broadness of the range.

[0071] Although various embodiments of the present invention have been described by way of example, they are not intended to be exhaustive or limited to these embodiments. As will be apparent to those skilled in the art, many modifications and variations are possible without departing from the scope and spirit of the present invention. The terms used in this specification are selected in order to best explain the principles of the present embodiment, practical applications, or technical improvements to the technology recognized in the market, or to allow those skilled in the art to understand each embodiment disclosed in this specification.

Claims

1. recording, by one or more processors, respective keystroke sessions for a plurality of users of a computerized system, the keystroke sessions including a plurality of typing samples of authentication information associated with each user of the plurality of users, the plurality of typing samples being typed consecutively by the respective users; extracting, by one or more processors, a set of features from each of the respective keystroke sessions that characterize typing variations among the plurality of typing samples; detecting, by one or more processors, an attempt by a first user to circumvent keystroke dynamics authentication and log into the computerized system by detecting repeated typing of a particular one of the credentials associated with a particular user of the plurality of users; extracting, by one or more processors, a set of features from the typing of the repetitions of the particular authentication information by the first user, the set of features characterizing typing changes between repetitions; comparing, by one or more processors, the set of features extracted from the repeated typing of the authentication information by the first user with the set of features extracted from the set of keystroke sessions to infer which user of the plurality of users is the first user; The method includes:

2. Extracting the feature set from each of the respective keystroke sessions comprises: For each of the typing samples, (a) digraph time differences between key-independent keystroke events selected from the group consisting of press to consecutive press, press to consecutive release, release to consecutive release, and release to consecutive press; and (b) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events; Calculate For each of the typing samples except for the first one of the typing samples, (c) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events in the previous typing sample; Calculating The method of claim 1.

3. Extracting the feature set from each of the respective keystroke sessions comprises: calculating, by the one or more processors, a change in at least one of the digraph time differences selected from the group consisting of: a digraph time difference between key-independent keystroke events, a digraph time difference between a first one of the keystroke events and a last one of the keystroke events, and a digraph time difference between a first one of the keystroke events and a last one of the keystroke events in the previous typing sample, during at least a portion of the typing samples. The method of claim 2.

4. Extracting the feature set from each of the respective keystroke sessions comprises: and statistically processing, by one or more processors, the calculated changes to generate a feature vector for each of the keystroke sessions; the feature vectors of the keystroke session are generated with uniform length and uniform structure; The method according to claim 3.

5. Extracting the feature set from the repeated typing of the particular credential by the first user comprises: For each of said repetitions, (a) digraph time differences between key-independent keystroke events selected from the group consisting of press to consecutive press, press to consecutive release, release to consecutive release, and release to consecutive press; and (b) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events; Calculate For each of said repetitions except the first one, (c) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events in the previous typing sample; Calculating The method of claim 1.

6. Extracting the feature set from the repeated typing of the particular credential by the first user comprises: calculating, by the one or more processors, a change during at least a portion of the iterations in at least one of the digraph time differences between key-independent keystroke events, the digraph time difference between a first one of the keystroke events and a last one of the keystroke events, and the digraph time difference between a first one of the keystroke events and a last one of the keystroke events in a previous iteration. The method according to claim 5.

7. Extracting the feature set from the repeated typing of the particular credential by the first user comprises: and statistically processing, by one or more processors, the calculated changes to generate a feature vector of the attempt by the first user. The method according to claim 6.

8. The comparison is based on a machine learning algorithm. The method of claim 1.

9. The comparison is based on a mathematical distance metric. The method of claim 1.

10. selecting, by one or more processors, keystroke sessions associated with each user linked in the computerized system to the particular user as the set of keystroke sessions used in the comparison. The method of claim 1.

11. 1. A computer program product comprising: one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media, the program instructions comprising: program instructions for recording, for a plurality of users of a computerized system, respective keystroke sessions including a plurality of typing samples of authentication information associated with each user of the plurality of users, the plurality of typing samples being typed consecutively by the respective users; program instructions for extracting from each of said respective keystroke sessions a set of features characterizing typing variations among said plurality of typing samples; program instructions for detecting an attempt by a first user to circumvent keystroke dynamics authentication and log into the computerized system by detecting repeated typing of a particular one of the authentication information associated with a particular user of the plurality of users; program instructions for extracting a set of features from the typing of the repetitions of the particular authentication information by the first user, the set of features characterizing typing variations between repetitions; and program instructions for comparing the set of features extracted from the repeated typing of the authentication information by the first user with the set of features extracted from the set of keystroke sessions to infer which of the plurality of users is the first user. Computer program products.

12. Extracting the feature set from each of the respective keystroke sessions comprises: For each of the typing samples, (a) digraph time differences between key-independent keystroke events selected from the group consisting of press to consecutive press, press to consecutive release, release to consecutive release, and release to consecutive press; and (b) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events; and program instructions for calculating For each of the typing samples except for the first one of the typing samples, (c) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events in the previous typing sample; and program instructions for calculating 12. A computer program product as claimed in claim 11.

13. Extracting the feature set from the repeated typing of the particular credential by the first user comprises: For each of said repetitions, (a) digraph time differences between key-independent keystroke events selected from the group consisting of press to consecutive press, press to consecutive release, release to consecutive release, and release to consecutive press; and (b) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events; and program instructions for calculating For each of said repetitions except the first one, (c) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events in the previous typing sample; and program instructions for calculating 12. A computer program product as claimed in claim 11.

14. and program instructions stored on the one or more computer readable storage media for selecting, as the set of keystroke sessions to be used in the comparison, keystroke sessions associated with each user that is linked in the computerized system with the particular user.

12. A computer program product as claimed in claim 11.

15. one or more computer processors; one or more computer readable storage media; and program instructions stored on the computer-readable storage medium for execution by at least one of the one or more processors, the program instructions comprising: program instructions for recording, for a plurality of users of a computerized system, respective keystroke sessions including a plurality of typing samples of authentication information associated with each user of the plurality of users, the plurality of typing samples being typed consecutively by the respective users; program instructions for extracting from each of said respective keystroke sessions a set of features characterizing typing variations among said plurality of typing samples; program instructions for detecting an attempt by a first user to circumvent keystroke dynamics authentication and log into the computerized system by detecting repeated typing of a particular one of the authentication information associated with a particular user of the plurality of users; program instructions for extracting a set of features from the typing of the repetitions of the particular authentication information by the first user, the set of features characterizing typing variations between repetitions; and program instructions for comparing the set of features extracted from the repeated typing of the authentication information by the first user with the set of features extracted from the set of keystroke sessions to infer which of the plurality of users is the first user. Computer system.

16. Extracting the feature set from each of the respective keystroke sessions comprises: For each of the typing samples, (a) digraph time differences between key-independent keystroke events selected from the group consisting of press to consecutive press, press to consecutive release, release to consecutive release, and release to consecutive press; and (b) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events; and program instructions for calculating For each of the typing samples except for the first one of the typing samples, (c) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events in the previous typing sample; and program instructions for calculating 16. The computer system of claim 15.

17. Extracting the feature set from each of the respective keystroke sessions comprises: further comprising program instructions for calculating a change in at least one digraph time difference selected from the group consisting of a digraph time difference between key independent keystroke events during at least a portion of the typing samples, a digraph time difference between a first one of the keystroke events and a last one of the keystroke events, and a digraph time difference between a first one of the keystroke events and a last one of the keystroke events in the previous typing sample.

17. The computer system of claim 16.

18. Extracting the feature set from the repeated typing of the particular credential by the first user comprises: For each of said repetitions, (a) digraph time differences between key-independent keystroke events selected from the group consisting of press to consecutive press, press to consecutive release, release to consecutive release, and release to consecutive press; and (b) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events; and program instructions for calculating For each of said repetitions except the first one, (c) the digraph time difference between the first one of the keystroke events and the last one of the keystroke events in the previous typing sample; and program instructions for calculating 16. The computer system of claim 15.

19. Extracting the feature set from each of the respective keystroke sessions comprises: calculating, during at least a portion of the iterations, a change in at least one of the digraph time differences between key-independent keystroke events, a digraph time difference between a first one of the keystroke events and a last one of the keystroke events, and a digraph time difference between a first one of the keystroke events and a last one of the keystroke events in a previous iteration.

20. The computer system of claim 18.

20. and program instructions stored on the computer readable storage medium for execution by at least one of the one or more processors, the program instructions further comprising: selecting keystroke sessions associated with each user that is linked in the computerized system with the particular user as the set of keystroke sessions to be used in the comparison.

16. The computer system of claim 15.

Images