Keystroke Dynamics Authentication Attacker Attribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current keystroke dynamics authentication systems struggle to identify attackers who attempt to circumvent security by repeatedly typing credentials, as they cannot readily distinguish the attacker's typing style from legitimate users, especially when the attacker has created their own account to study the system's security measures.
Innovation Solution
The system records and analyzes keystroke sessions to extract features that characterize typing changes, representing these features in a uniform manner to compare against pre-existing user models, using machine learning algorithms or mathematical distance metrics to identify the attacker by matching their typing patterns with those of registered users, even when the attacker's credential is different from the target user's.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If keystroke dynamics authentication is used to verify user identity, then authentication security is improved, but the system cannot distinguish attackers who repeatedly type credentials from legitimate users
Solution Approach 1:
The system pre-processes keystroke sessions during authentication to extract temporal typing change features and store them for later comparison. When an attack is detected, the system can immediately compare the attacker's features against the pre-stored user profiles without requiring real-time analysis, enabling rapid attacker identification.
Solution Approach 2:
The system creates feature representations (copies) of the original keystroke data that capture temporal typing changes. These feature copies are stored and can be efficiently compared against attacker attempts, allowing the system to identify attackers by matching their typing patterns against stored user feature copies.
2Measurement precision
If the system analyzes temporal typing changes to identify attackers, then attacker identification accuracy is improved, but computational resources increase
Solution Approach 1:
The system extracts only the essential temporal typing change features from complete keystroke sessions, separating the critical identification characteristics from the full keystroke data. This extraction reduces the amount of data that needs to be stored and compared, lowering computational resource requirements while maintaining attacker identification accuracy.
Solution Approach 2:
The system transforms raw keystroke timing data into derived temporal typing change features that capture the essential variation patterns. This parameter transformation condenses large volumes of raw data into compact feature representations, reducing computational complexity for both storage and comparison operations.
3Productivity
If the system stores and compares complete keystroke sessions, then comprehensive analysis is possible, but data processing time increases
Solution Approach 1:
The system performs feature extraction during the authentication process itself, preparing the temporal typing change features in advance before any attack detection is needed. This preliminary processing ensures that when an attack occurs, the system can immediately compare attacker features against pre-extracted user features without time-consuming real-time analysis.
Data Source
AI summary
Aspects of the present invention disclose a method, computer program product, and system for employing keystroke dynamics authentication. The method includes one or more processors recording, for a plurality of users, a respective keystroke session of multiple typing samples (typed consecutively) of a credential associated with a respective user of the plurality. The method further includes extracting a set of features that characterize typing changes between the multiple typing samples. The method further includes detecting repeated typing of a certain one of the credentials that is associated with a certain user of the plurality. The method further includes extracting, from the repeated typing of the certain credential, a set of features that characterize typing changes between repetitions. The method further includes comparing the feature set extracted from the repeated typing against feature sets extracted from a set of the keystroke sessions, estimating which user is the first user.