c Se Project

8/12/2019 c Se Project

1/46

Data analysis system for behaviouralbiometric authentication [Keystroke

Dynamics]

Project Report


2/46

Department of Electronic and Computer Engineering

Faculty of Technology

June 2014

2

Name:

Student number:

Course Stream: BEng 2010/11 projects

Course: Computer Network Management

and Design year !CNB"

Super#isor:


3/46

Contents

Data ana$ysis system %or &e'a#ioura$ &iometric aut'entication ()eystroke Dynamics*+ ++ ++1

Name: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++2

Student num&er: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++2

,&stract+++++++++++++-

1+ .ntroduction++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1+1 Biometric and aut'entication systems++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1+1+1 wo types o% &iometrics c'aracteristics systems:+++++++++++++++++++++++++++++++++++++++++++++++++

1+1+2 +Biometric ,ut'entication+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1+1+ +imitations o% .denti%ication and ,ut'entication+++++++++++++++++++++++++++++++++++++++++++++++++3

2+ Background 'eory (Be'a#ioura$ &iometric keystroke dynamics*++++++++++++++++++++++++++++++++++4

+ ec'no$ogy +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++10

+1 +5'at is keystroke dynamic 6 (&e'a#ioura$ &iometric*7+++++++++++++++++++++++++++++++++++++++++++10

+2 +5'y keystroke dynamic &e'a#ioura$ Biometric+++++++++++++++++++++++++++++++++++++++++++++++++++++++11

+2 +8ow )eystroke Dynamic works+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++1

+2+1 +)eystroke Metrics+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++1

9+ esearc' and ,na$ysis on ,$gorit'm %or )eystroke Dynamics+++++++++++++++++++++++++++++++++++++1

9+1 )ey 'ings w'ic' decides 'ow good t'e aut'entication system is or t'e ,$gorit'm

is+ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++1

9+2+ ,$gorit'ms ,#ai$a&$e %or keystroke dynamics ++++++++++++++++++++++++++++++++++++++++++++++++++++++++13

9+2+1+ Euc$idean++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++13

9+2+2+ Euc$idean !normed"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++13

9+2++ Man'attan+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++13

9+2+9+ Man'attan !%i$tered"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++14

9+2+-+ Man'attan !sca$ed" ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++14

9+2++ Ma'a$ano&is++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++14

9+2++ Ma'a$ano&is !normed"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++14

9+2+3+ Nearest;neig'&or !Ma'a$ano&is"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++14

9+2+4+ Neura$;network !standard"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++20

9+2+10+ Neura$;network !auto;assoc"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++20

9+2+11+


4/46

9+2+12+ >ut$ier;counting !=;score"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++20

9+2+1+ S?M !one;c$ass"+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++20

9+2+19+ k;means+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++21

9+ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++219++ Ca$cu$ating detector per%ormance+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++22

9++1+ 'e resu$t o% t'e comparison s'own &e$ow in %igure (3*+++++++++++++++++++++++++++++++++++2

9++2+ >t'er researc'ers wit' t'e a$gorit'm comparison++++++++++++++++++++++++++++++++++++++++++++++2-

-+ )ey En#ironmenta$ %actors a%%ecting )eystroke Dynamics+ +++++++++++++++++++++++++++++++++++++++++2

-+1 C$ock eso$ution is one o% t'e major 5 8E S>>)S ,M@ES.>N+++++++++++++++++++++++++++++1

+1+ Capa&i$ity o% t'e so%tware++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++1

+1+9 @ictures &e$ow s'ows a %eatures o% t'e so%tware++++++++++++++++++++++++++++++++++++++++++++++++++++2

+1+- 8ow t'ese data can &e use%u$++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

+1+ DES.AN 8E )ES>)E D,,B,SE S>


5/46

Abstract

'e more ser#ices w'ic' are coming in w'en t'ere is 'ig' rise o% t'e internet and t'e pus'

%or u&iuitous computing 'a#e turned t'e wor$d o% tec'no$ogy wit' di%%erent sing$e

met'od so$utions o% aut'entication+ Some are %orcing peop$e to remem&er di%%icu$t codes

w'ic' 'as &een increasing$y di%%icu$t among t'e users+ .t 'as &een etensi$e used

e#eryw'ere w'ere t'ere is aut'entication it cou$d &e in emai$s &$ogs or %or .S@ ser#ice

pro#iders or &y &anks ,M mac'ines and many+ 'e eisting system o% tetua$ password

or any o% t'e token &ased system do not o%%er t'e needed security standard %or its users

w'o aut'enticate &ut t'e &io$ogica$ %eature o% t'e user in &e'a#ioura$ &iometric w'en

typing tet are #ery promising w'en compared to t'e actua$ tetua$ passwords+

'e main o&jecti#e o% t'is project is to comp$ete compre'ensi#e researc' into a#ai$a&$e

a$gorit'm %or &e'a#ioura$ &iometric aut'entication ()eystroke Dynamics* t'en comparing

t'em in suc' a way t'at s'owing 'ow accurate t'ey are and imp$ementing one o% t'e

a$gorit'm to s'ow 'ow t'ey work+

-


6/46

1. Introuction

1.1 Biometric and authentication systems

Fser ,ut'entication 'as &een a #ery &ig issue in computer system as t'ere 'a#e &een

many ser#ices coming in wit' aut'entication o% users+ Biometric was one o% t'e major

so$utions to meet t'e mu$tip$e %actor aut'entication o&jecti#es %or major companies or

&usiness w'o gi#e out ser#ices+ ,ny'ow cost was a major %actor pre#enting t'e

organisations %rom getting a &iometric so$ution+ 'at donGt comp$ete$y mean ot'er %actors

o% so$utions are any $ess cost pro'i&iti#e+ 'e capita$ ependiture and on ;going

maintenance cost o% token;&ased system are o%ten 'ig'er t'an t'ose %or &iometrics+ 'is

#enture o#er 'ere mig't meet up wit' t'is &usiness c'a$$enges+ So%tware wit' no

&iometric de#ice attac'ed to it just a computer system w'ic' 'as a standard key&oard is

w'at a$$ it reuires t'is mean met'od o% aut'entication is o% &e'a#ioura$ &iometric

aut'entication using t'e )eystroke Dynamics ec'no$ogy+

H'ree di%%erent user aut'entication types can &e c$assi%ied under t'e security %ie$d used

!Simon iu and Mark Si$#erman 2001"+

I Somet'ing you know ; a password @.N or a piece o% persona$ in%ormation !suc' as your

mot'erGs maiden name"+

I Somet'ing you 'a#e ; a card key smart card or a token !$ike a Secur.D card"+

I Somet'ing you are ; a &iometric+J !Simon iu and Mark Si$#erman+ 2001"

'e measurement o% t'e indi#idua$s Biometric cou$d &e in any %orms it cou$d &e @'ysica$

or &e'a#ioura$ c'aracteristics use to recognise or aut'enticate t'e user wit' t'eir uniue

identities+ .t does a titanic jo& wit'out any escape %or errors &y $inking t'e aut'enticator to

its owner w'ic' a password or a token canGt do as t'ey can &e taken away or sto$en were

as &iometric is our own+


7/46

1.1.1 Two types of biometrics characteristics systems:

IPhysiological characteristic of biometric: t'is inc$udes more o% t'e tec'niues w'ic' are

sta&$e p'ysica$ c'aracters suc' as %ingerprints iris or retina+

IBehavioural characteristic of biometric: are t'ose tec'niues w'ic' s'ow a indi#idua$s

c'aracter decision it cou$d &e a keystroke pattern t'e way a person wa$ks wou$d &e

uniue to a sing$e person !Bergando et a$ 2002"+

Due to t'e $itt$ie c'anges in t'e c'aracter or decision o% most &e'a#ioura$ c'aracteristics

it 'as to &e designed %or &eing more dynamic and 'as to accept $itt$e rate o% #aria&i$ity+

ooking at di%%erent aspect o% &e'a#ioura$ &iometrics it is $ess intrusi#e systems were

contri&ution to more accepta&i$ity %or t'e users+

1.1.2 .Biometric Authentication

Biometric aut'entications natura$$y terminate t'e gap &etween t'e risks o% anonymity in a

two;%actor security scenario &y using an attri&ute o% t'e person to aut'enticate a token+

,ut'entication systems %o$$ow &y t'e steps s'own &e$ow+

I ,cuisition:

.mage o% t'e users attri&ute is taken+

I oca$i=ation:

'e attri&ute is stored minutiae etracted and a matc'ing temp$ate created+

I Matc'ing:

'e #a$ue o% t'e token is compared wit' t'e temp$ate pre#ious$y stored %or t'is user+ .% t'e

temp$ate &ecomes matc' t'e reuestor is aut'enticated !e%erence: we& +0-"+ (


8/46

Figure 1.1: Biometric Authentication Process

Source: Reference (web: 05)

1.1.3 .Limitations of dentification and Authentication

Due to t'e c$assi%ication o% &iometric identi%ication and aut'entication matc'ing

tec'niues as pro&a&i$istic t'ere is a margin o% error in o&tained resu$ts+ 8owe#er %a$se

rejections are considered more accepta&$e t'an %a$se acceptance+

,ut'entication sc'emes are more re$ia&$e and e%%icient t'an pure identi%ication sc'emes+

'is is main$y &ecause t'e aut'entication temp$ate on$y 'as to &e matc'ed on to

aut'enticate w'ereas it may &e matc'ed against 'undreds or t'ousands o% records to

identi%y a person+

3


9/46

!. "ack#roun $heory ["ehavioural biometric keystroke ynamics]

H,s in t'e ear$y o% t'e &eginning o% t'e 20t' century psyc'o$ogists 'a#e demonstrated

t'at human actions are predictable in performance of repetitive and routine task+J

(Umphress and !"illiams!1#$%&

)eystroke dynamics is a &iometric w'ic' is &ased on a disco#ery t'at eac' and e#ery

'uman type in uniue$y c'aracteristic manners+ .n ear$ier 14 t'century >&ser#ation o%

te$egrap' operators re#ea$ed persona$$y distincti#e patterns w'en keying messages o#er

te$egrap' $ines and t'e way t'ey keyed in or t'e dynamics o% it was t'e on$y way to

recogni=e eac' ot'er !Mi$$er 1449"+

Figure 2: Te!e"raph


'e one w'ic' come mental conception to &iometric identi%ication wou$d &e t'e

signature recognition+ ,s &ot' ()D and signature recognition* identi%y t'e su&jects &y t'e

writing dynamics w'ic' is conceptua$$y same %or a $arge num&er o% users among peop$e+

)eystroke dynamics 'as &een known in di%%erent name suc' as: Hkey&oard dynamics

keystroke ana$ysis typing &iometrics and typing r'yt'ms+J

!>&aidat M+S K Sadoun+ 144"

4


10/46

%. $echnolo#y

3.1 .#hat is $eystro$e dynamic % &beha'ioura! biometric()

)eystroke Dynamics it is a process were t'e data is captured t'e way or 'ow t'e person

types at t'e key&oard and t'ose data is ana$ysed to identi%y t'em !,raujo 200-"+'e

measurements or t'e #a$ues in t'e data wou$d inc$ude t'e timestamp %or pressing and

re$easing o% keys 'e code %or t'e particu$ar key pressed and t'e pressure !Monrose Ku&in 2000"+

)eystroke Dynamics is tec'niue in &iometric +'e &iometric tec'niues can &e di#ided

into two categories i+e+ @'ysio$ogica$ &iometric $ike %ingerprint iris %ace recognition+ ,nd

t'e Be'a#ioura$ &iometrics $ike signatures #oice or keystroke dynamics !Bergando et a$

2002"+E#en t'e Fnited )ingdom @assport ser#ice 'ad $ooked into and esta&$is'ed %acia$

iris and %ingerprint &iometric tec'niues w'ic' $ater was to &e added to t'e &iometric datain t'e .D Cards t'is was t'e main de&ate in ear$ier time o% 200!e%erence: we& +02" &ut

now it 'as &een cance$$ed !e%erence: we& +01"+ 'ese card and ot'er met'ods t'ey try to

add was a$$ p'ysio$ogica$ &iometrics tec'niues w'ic' is tend to &e a sta&$e data it 'as or

it wonGt c'ange %or a $ong period o% time some donGt e#en c'ange !Bergando et a$

2002"+,ny 'ow $ooking at it t'e ad#antage %or t'e &e'a#ioura$ &iometric wou$d &e #ery

$ess epensi#e compared to t'e ot'ers to imp$ement and it is $ess intrusi#e %or users

!Monrose K u&in 2000"

10


11/46

3.2 .#hy $eystro$e dynamic beha'ioura! Biometric

Now a dayGs users access t'eir system account using t'e username and t'e passwords

gi#ing at t'e $ogin screen+ 'is wou$d &e one o% t'e pre%era&$e met'ods o% &ecause it is

$ow cost and it 'as &een known &y e#eryone 'ow to use !,raujo 200-"+'en to it 'as its

own $imits : i% password is a memora&$e p'rase or a word it may &e guessa&$e &y

ot'ers &ut i% it is a string o% meaning$ess c'aracters t'e user mig't %orget it!peacock et a$

2009"'e &etter t'e word is not remem&er a&$e means t'e &etter t'e password +.n t'e

%ormer case t'ere cou$d &e a serious &reac' o% security+ .t wi$$ &e tota$ waste &y a$$ocating

a new password+ 'is 'as &ecome a major pro&$em as t'ere 'as &een many peop$e getting

registered and getting used to internet as now more ser#ices are a#ai$a&$e t'an ear$ier

days+ Many users tent to use t'eir sing$e password %or t'e mu$tip$e accounts t'ey 'a#e in

di%%erent ser#ices !@eacock 2009" w'ic' wi$$ %urt'er resu$t in greater identity t'e%t+

Monrose and u&in !2000" argue t'at t'e natura$ met'od %or user identi%ication wou$d &e

keystroke dynamics+ ,s per 'ow t'e password is t'e keystroke &iometrics canGt &e sto$en

or $ost %rom any person as itGs an indi#idua$Gs own+

5'en comparing wit' t'e ot'er &iometric tec'niue $ike %ingerprint recognition and iris

%ace recognition t'e keystroke &iometric donGt need any ot'er additiona$ euipment;

ecept a$$ w'at it reuires is a standard key&oard and a computer so it is c'eaper and

practica$ and is a$so easy to imp$ement+ 5'en $ooking in contrast wit' t'e ot'er tec'niue

$ike iris scanning w'ic' need more cooperation o% t'e user t'is one wou$d &e non;

intrusi#e %or users+

11


12/46

Figure 3: *ost of ownership and maintenance chart showin" how re!iab!e it is in a!! ways


12


13/46

3.2 .+ow ,eystro$e -ynamic wor$s

)eystroke dynamics measures t'e series o% key down and key up e#ent timings w'i$e t'e

user types a string i+e+ i% a userGs password is LpasswordG t'en t'e key down and key up

e#ents are captured %or e#ery a$p'a&et+

3.2.1 .,eystro$e etrics

>ne oious measurement to ana$yse and to get data %or ca$cu$ation is &y measuring t'e

$engt' o% time t'at a person 'o$ds down a sing$e key+ 'is 'as &een named as t'e dwe!!

time+ !5estern Caro$ina Fni#ersity 200-"+

HDwe$$ime)1 keyFp)1 ; keyDown)1J

>&aidat !144-" dictator pro#ed t'at t'e time taken &etween $i%ting t'e %inger o%% one key

and pressing t'e net 6 f!i"ht time6 gi#es &etter per%ormance t'an dwe$$ time a$one+

H


14/46

Figure 3: ,eystro$e -we!! Time and /!i"ht Time


Figure 4: ,eystro$e -we!! Time and /!i"ht Time


19


15/46

>nce w'en t'e processing o% co$$ecting t'e data is %inis'ed t'e data is ana$ysed and

processed &y a particu$ar a$gorit'm w'ic' determines a primary pattern %or $ater

comparison+

,$gorit'ms 'a#e greater importance in t'is so%tware t'e &etter t'e a$gorit'm t'e more

good t'e so%tware determines t'e data %ast and in a re$ia&$e way+ 'en comes t'e $ast

process $ike any o% t'e &iometric tec'no$ogies app$ied to an aut'entication jo& were major

%unctions is to enro$ and #eri%y credentia$s+

1-


16/46

&. Research an Analysis on Al#orithm for Keystroke Dynamics.

0.1 ,ey Thin"s which decides how "ood the authentication system is or the

A!"orithm is.

'e aut'entication system to &e per%ect or not is decided &y t'e !


17/46

Figure 5: Crossover error rate



18/46

Figure 6: FR! FRR! C"R


9+2+ ,$gorit'ms ,#ai$a&$e %or keystroke dynamics

4.2.1. Euclidean

'is one is Hc$assic anoma$y;detection a$gorit'm mode$J !Duda 8art and Stork

2001"@oint inp;dimensiona$ space is a password p is t'e one w'ic' is in timing #ectors

+ Suared Euc$idean distance &etween two o% t'em #ector and t'e mean is ca$cu$ated as

t'e anoma$y score+

4.2.2. Euclidean (normed)

,s &y B$e'a !B$e'aS$i#insky and 8ussien 1440" w'o named it as t'e Hnorma$i=ed

minimum distance c$assi%ier+J suared Euc$idean distance &etween t'e test #ector and t'e

mean #ector is ca$cu$ated &ut t'e Hanoma$y score is ca$cu$ated &y Hnorma$i=ingJ t'is

distance di#iding it &y t'e product o% t'e norms o% t'e two #ectors+J

4.2.3. Manhattan

'is c$assic anoma$y;detection a$gorit'm !+ >+ Duda @+ E+ 8art and D+ A+ Stork 2001"

imitates Euc$idean detector were t'e distance measure is t'e Man'attan distance instead

o% Euc$idean detector+ ,noma$y score is ca$cu$ated as t'e Man'attan distance &etween t'e

mean in t'e test purpose+

13


19/46

4.2.4. Manhattan (filtered)

.t is simi$ar to t'e Man'attan detector ecept out$iers in t'e training data are %i$tered+

!Ooyce and A+ Aupta 1440"+ 'e anoma$y score is ca$cu$ated as t'e Man'attan distance

&etween t'is ro&ust mean #ector and t'e test #ector+

4.2.5. Manhattan (scaled)

'e ca$cu$ation is same as Man'attan distance &ut wit' a sma$$ c'ange+ !,raPujo

Sucupirai=Parraga ing and a&u;uti 2009"+ 'e anoma$y score is ca$cu$ated as

,

%eatures o% t'e test and mean #ectors respecti#e$yand ai is t'e a#erage a&so$ute de#iation

%rom t'e training p'ase+ 'e gi#en out score s'ows Man'attan;distance ca$cu$ation

ecept eac' dimension is sca$ed &y ai+

4.2.6. Mahalanobis

'e c$assic anoma$y;detection a$gorit'm !+ >+ Duda @+ E+ 8art and D+ A+ Stork 2001"

w'ic' wou$d &e simi$ar to Euc$idean and Man'attan detectors t'en to t'e distance

measure 'as &een more comp$e+ 'e anoma$y score is ca$cu$ated as t'e Ma'a$ano&is

distance &etween t'e mean #ector and t'e test #ector+

4.2.7. Mahalanobis (normed)

!B$e'aS$i#insky and 8ussien 1440" w'o ca$$ed it t'e Hnorma$i=ed Bayes c$assi%ier+J t'e

Ma'a$ano&is distance &etween t'e mean #ector and test #ector is ca$cu$ated+ 'e anoma$y

score is ca$cu$ated &y Hnorma$i=ingJt'e Ma'a$ano&is distance using t'e same di#isor as

t'e Euc$idean !normed" detector+

4.2.8. Nearestnei!hbor (Mahalanobis)

!C'o8an 8an and )im 2000"+ t'e detector ca$cu$ates t'e Ma'a$ano&is distance

&etween eac' o% t'e training #ectors and t'e test #ector+ 'e anoma$y score is &y t'e

distance w'ic' takes %rom t'e test #ector to nearest training #ector+ !C'o8an 8an and

)im 2000"+

14


20/46

4.2.". Neuralnet#or$ (standard)

!8aider ,&&as and Qaidi 2000"+ .t incorporates a %eed;%orward neura$;network trained

wit' t'e &ack;propagation a$gorit'm + !Duda 8art and Stork 2001" H, network is &ui$t

wit' p input nodes one output node and 2p/'idden nodes+J !8aider ,&&as and Qaidi2000"+

4.2.1%. Neuralnet#or$ (autoassoc)

!C'o8an 8an and )im 2000"+ 5'o ca$$ed it an Hauto;associati#e mu$ti$ayer

perceptron+J 'is is made into a &ack;propagation a$gorit'm rat'er t'an a typica$ neura$

network ;structure o% t'e network stricter was designed %or anoma$y detector !8wang andS+ C'o 1444"+ 'e Euc$idean distance w'ic' $ays &etween test #ector and t'e output

#ector is ca$cu$ated to get t'e anoma$y scoreJ !C'o8an 8an and )im 2000"+

4.2.11. &u''lo!ic

!8aider ,+ ,&&as and ,+ )+ Qaidi 2000"+ .t incorporates a %u==y;$ogic in%erence

procedure+ 'e key idea is t'at ranges o% typing times are assigned to %u==y sets+'e sets

are ca$$ed %u==y &ecause e$ements can partia$$y &e$ong to a set Eac' timing %eature is

c'ecked to see i% it &e$ongs to t'e same set as t'e training data+ H'e anoma$y score is

ca$cu$ated as t'e a#erage $ack o% mem&ers'ip across a$$ test #ector timing %eatures+J

!8aider ,+ ,&&as and ,+ )+ Qaidi 2000"+

4.2.12. utliercountin! ('score)

!8aider ,+ ,&&as and ,+ )+ Qaidi 2000" 'e aut'er ca$$es it &y Hstatistica$ tec'niue

t'e detector computes t'e a&so$ute =;score o% eac' %eature o% t'e test #ector+ 'e =;score is

app$ied to Ri + yiR /si &y t'e i;t' %eature w'ere i and yi are t'e i;t' %eatures o% t'e test

and mean #ectors respecti#e$y and si is t'e standard de#iation %rom t'e training p'ase+

!8aider ,+ ,&&as and ,+ )+ Qaidi 2000"

4.2.13. *+M (oneclass)

!u and S+ C'o2001"+ .t inc$udes an a$gorit'm named support;#ector mac'ine !S?M"+ ,

Hone;c$assJ S?M was made on$y %or t'e purpose o% anoma$y detection+ est #ector is

projected into t'e same 'ig';dimensiona$ space and t'e !signed" distance %rom t'e $inear

20


21/46

separator is ca$cu$ated+ H'e anoma$y score is ca$cu$ated as t'is distance wit' t'e sign

in#erted so t'at positi#e scores are separated %rom t'e data+J !u and S+ C'o2001"+

4.2.14. $means

!)ang S+ 8wang and S+ C'o200"+ 'e c$usters in t'e training #ectors are identi%ied

using t'e k;mean c$uster a$gorit'm+t'en it %ind out weat'er t'e test #ector is c$ose to any

o% t'e c$usters+ H'e anoma$y score is ca$cu$ated as t'e Euc$idean distance &etween t'e

test #ector and t'e nearest o% t'ese centroids+J !)ang S+ 8wang and S+ C'o200"+

0.3

21


22/46


23/46

4.3.1. ,he result of the com-arison sho#n belo# in fi!ure 8/

2


24/46

Figure $

Source: Reference (web: 0#)

Figure %:Fa&se &ar' Rate

Source: Reference (web: 0#)

29


25/46

4.3.2. ther researchers #ith the al!orithm com-arison.

Continuous researc' carried out &y ot'ers !)i$$our'y 2010" came into a conc$usion wit'

t'e same resu$t +'e %igure &e$ow $ustrates t'e %inding+

Figure 10: Sows te etectors "rror Rate

Source: Reference (*i&&our+! 2010)

2-


26/46

,s per t'e a&o#e resu$t &est eua$;error rate was 0+04 it was o&tained &y t'e Man'attan

!sca$ed" detector said &y ,raPujo+ !,raPujo Sucupira i=Parraga

ing and a&u;uti2009"+ Nearest Neig'&or !Ma'a$ano&is" detector it was t'e topper%orming as it 'ad t'e >ut$ier Count as we$$ as t'e top per%orming detector using t'e

eua$;error per%ormance measure+

>ne and on$y &est =ero;miss %a$se a$arm rate was 0+93w'ic' was &y t'e Nearest

Neig'&or !Ma'a$ano&is" as mentioned &y C'o+!C'o 8an 8an and )im 2000"

By $ooking into t'e ta&$es t'e initia$ o&ser#ation was t'at t'e per%ormance measure

needed to ac'ie#e t'e 0+001 miss rate and 1 %a$se;a$arm reuired &y t'e European

standard %or access;contro$ system+! CENEEC+2002"

Nearest Neig'&or !Ma'a$ano&is" detector was t'e one and on$y top among t'e &ot'

per%ormance measures+!eua$ 6error rate and =ero miss %a$se;a$arm rate" measure detector

%rom a di%%erent ang$e o% t'e operating points on an >C cur#e as s'own in %igure(4* t'is

indi#idua$ resu$t suggest t'at t'e Nearest Neig'&or !Ma'a$ano&is" detector wou$d &e

ro&ust to di%%erent t'res'o$d;se$ection procedures+

'is make up t'e %ina$ ana$yse t'at t'e Nearest Neig'&or!Ma'a$ano&is"detector is t'e

&est a$gorit'm %or )eystroke dynamics+

2


27/46

'. Key (nvironmental factors affectin# Keystroke Dynamics.

Figure 11: "nviron'enta& factors effecting te *e+stro,e +na'ics

Source: Reference (*i&&our+.200$)

7.1 *!oc$ eso!ution is one of the ma6or /actors which affect the ,eystro$e

-ynamics.

' research carried out ()i$$our'y+2003" &y )i$$our'y a&out t'e %actors e%%ecting )D

came into conc$usion c$ock reso$ution was one o% t'e major %actor+ ,s s'own in %igure

&e$ow (11 121*Eample sho"n in figure )10* eplains ho" important the cloc+

resolutions for ,eystro+e Dynamics is important !The pass"ord for -oth 'lice and

.o- it the same /pass"ord! 's in figure 10 .o- cant access 'lice system "ere as in

figure 11 .o- could access her system as the cloc+ resolution is lees and comes

matching "ith 'lice !

2


28/46

Figure 12: Sowing iger c&oc, reso&ution -reventing ob fro' accessing &ice/s

s+ste'


23


29/46

Figure 13: Sowing &ess c&oc, reso&ution an ob cou& access &ice/s s+ste'


24


30/46

Figure 14: Sows iger c&oc, reso&ution i'-roves -erfor'ance


). *oft+are Development.

8.1 Phase one 5 *reation of the data co!!ection and ana!ysis software with "raph

to reco"nise the typin" rhythms of different person.

6.1.1 *oft#are a--lication and 0ard#are used

rogram used for "riting soft"are 3icrosoft isual studio 200%

For functions5methods used 3icrosoft Frame"or+ 6D, 7!%

0


31/46

User interface 89indo"s forms

6ource code at the end of the -oo+ at page no!

6.1.2 0 ,0E *&,E * &,E ME*9N

Figure 15: e co'-&ete software in its new &oo,

6.1.3 a-abilit of the soft#are

The soft"are sho"n a-oe is capa-le of ma+ing graphical representation of

,eystro+es Dynamics "hile typing! :t could record and store them in a data-ase

"hich could -e analy;ed for later use! :t has the a-ility to record!

Time -et"een t"o +eys pressed


32/46

Time -et"een one release and one pressurea" press

>a" release

raph could -e ;oomed to see the correct accurate measurement

raphs could -e saed as picture file for later reference or use!

8.1.0 Pictures be!ow shows a features of the software

2


33/46

Figure 16: Sows te gra- wic re-resents a&& te attributes

'e grap' now 'as t'e image o% sing$e user trained and w'o 'as typed t'e password

H,,@@,J %or -0 times+ 'e image &e$ow wi$$ demonstrate 'ow it $ooks in t'e grap'

w'en a di%%erent user tries to $og in wit' t'e same password+ (


34/46

Figure 1#: Sows te gra- wic re-resents a&& te attributes

'is image %igure (1* s'ows t'ree ot'er users w'ic' 'a#e tried to $og in wit' t'e same

password+ But t'e grap' s'ows us t'e #ariation in )eystroke Dynamics wit' t'e o$d users

w'o 'a#e &een trained to type 'is password+

9


35/46

Figure 1$: erification rocess Sows istance reaing


36/46

Figure 1%: Sows te vector recore an oter ata besie

te'.


37/46

8.1.7 +ow these data can be usefu!.

Figure 20

Source: Reference (web: 0$)


38/46

6.1.6 :E*9;N & ,0E E


39/46

4


40/46

Phase two % mp!ementation of a software for $eystro$e dynamic authentication

So%tware wou$d run as a c$ient ser#er approac'+ 5'en t'e c$ient try to $og in t'e ser#er

wou$d gi#e out t'e password %or aut'enticating+ 'e main a&i$ity o% t'is app$ication is to

aut'enticate using t'e tec'no$ogy keystroke dynamics+

Bui$d 6 it is &ui$d in ja#a

i&raries and ot'er needed 6 $atest jcommon and j%reec'artjdk new

,dditiona$ reuirement 6 Data&ase to &e insta$$ed+

Ser#er notes attac'ed $ast page+

90


41/46

,onclusion

.n conc$usion t'e researc' in t'e ,$gorit'm shows us that Nearest Neig'&or

!Ma'a$ano&is" is one o% t'e &est ,$gorit'ms %or &e'a#ioura$ &iometric aut'entication

o% $eystro$e dynamic system as it is topped out performed in equal-error rate and

zero-miss false-alarm ratew'ic' makes it one o% t'e &est+ By t'e demonstration o% t'e

so%tware s'ows 'ow t'e tec'no$ogy in t'e present day 'as &ecome it cou$d at $east

reac' to a certain etent+ 'e work input and process created &y t'e users t'at

continues to proceed in a way t'at is not t'e most e%%icient concerning security+

,ssuming 'uman &e'a#iour as a %act di%%erent ways are $ooked into to reac' %or t'e

&est o% practices in security $ike now comp$e passwords is used %rom t'e users w'o

used norma$ and traditiona$ met'ods o% passwords+ 'e &e'a#ioura$ &iometric wou$d

&e t'e &est in t'e day a'ead+

91


42/46


43/46

yping Biometrics &aidat M S !144-" , #eri%ication met'odo$ogy %or computer systems users+ @roceedings

o% t'e 144- ,CM

symposium on ,pp$ied computing+ pp+ 2-3 ; 22

D+Fmp'ress+ and A+5i$$iams!143-"H.dentity #eri%ication t'roug' key&oard

c'aracteristicsJ+ .nternat+ O+ManMac'+Stud+2262+143-

>&aidat M+S+ Sadoun B+: ?eri%ication o% computer users using keystroke dynamics+

.EEE ransactions on Systems Man and Cy&ernetics 2 !144" 21624

Mi$$er B+: ?ita$ signs o% identity+ .EEE Spectrum 1 !1449" 2260

Simon iu and Mark Si$#erman , @ractica$ Auide to Biometric Security ec'no$ogy+

.EEE . @ro%essiona$ ?o$ume Num&er 1!2001"2;2

awrence >GAorman ,#aya a&s esearc' Basking idge NO+ Securing BusinessGs


44/46

S+ B$e'a C+ S$i#insky and B+ 8ussien+ Computeraccess security systems using keystroke

dynamics+ .EEE ransactions on @attern ,na$ysis and Mac'ine .nte$$igence

12!12":12161222 1440+

+ Ooyce and A+ Aupta+ .dentity aut'entication &ased on keystroke $atencies+

Communications o% t'e ,CM!2":1361 1440+

+ C+ rgani=ationa$ Computing and E$ectronic

Commerce 10!9":24-60 2000+

S+ 8aider ,+ ,&&as and ,+ )+ Qaidi+ , mu$ti;tec'niue approac' %or user identi%ication

t'roug' keystroke dynamics+.EEE .nternationa$ Con%erence on Systems Man and

Cy&ernetics pages 16191 2000+

B+ 8wang and S+ C'o+ C'aracteristics o% auto;associati#e M@ as a no#e$ty detector+ .n

@roceedings o% t'e .EEE .nternationa$ Ooint Con%erence on Neura$ Networks #o$ume -

pages 036041 1061 Ou$y 14445as'ington DC 1444+

E+ u and S+ C'o+ A,;S?M wrapper approac' %or %eature su&set se$ection in keystroke

dynamics identity #eri%ication+ .n @roceedings o% t'e .nternationa$ Ooint Con%erence on

Neura$ Networks !.OCNN" pages 22-622-+ .EEE @ress 200+

@+ )ang S+ 8wang and S+ C'o+ Continua$ retraining o% keystroke dynamics &ased

aut'enticator+ .n @roceedings o% t'e 2nd .nternationa$ Con%erence on Biometrics !.CBG0"

pages 12061211+ Springer;?er$ag Ber$in 8eide$&erg 200+

99


45/46

O+ ,+ Swets and + M+ @ickett+Evaluation of Diagnostic Systems !ethods from Signal

Detection "heory+ ,cademic@ress New ork 1432

)e#in )i$$our'y+!2003",.D U03 @roceedings o% t'e 11t' internationa$ symposium on

ecent ,d#ances in .ntrusion Detection

)e#in )i$$our'y!2010"5'y Did My Detector Do 'at7V@redicting )eystroke;Dynamics

Error ates+,.D

CENEEC+ European Standard EN -01;1: ,$arm systems+ ,ccess contro$ systems %or

use in security app$ications+ @art 1: System reuirements 2002+ Standard Num&er

EN -01;1:144/,1:2002 ec'nica$ Body CC/C4 European Committee %or

E$ectrotec'nica$ Standardi=ation !CENEEC"+

#ebPa"es Accessed:

5e&+01: #$dentity %ard& (,ccessed on 1-;09;2011 at 1+00pm* a#ai$a&$e on WFX

'ttp://we&arc'i#e+nationa$arc'i#es+go#+uk/20110104112-4/'ttp://ips+go#+uk/cps/rde/c

'g/ipsY$i#e/'s+s$/-+'tm

5e&+02:#'ouse of common& (,ccessed on 1-;09;2011 at 2+00pm* a#ai$a&$e on WFX

we&:'ttp://www+pu&$ications+par$iament+uk/pa/cm200-0/cm&i$$s/094/200094+'tm

5e&+0: #"elegraph& (,ccessed on 14;09;2011 at +00pm* a#ai$a&$e on WFX

'ttp://www+engadget+com/200-/0-/0/morse;code;trumps;sms;in;'ead;to;'ead;

speed;teting;com&at/

5e&+09:#9estern Carolina Uniersity& (,ccessed on 20;09;2011 at 10+00pm* a#ai$a&$e on

WFX http55et!"cu!edu5aidc5.io9e-ages5.iometrics,eystro+e!html

9-


46/46

5e&+0-:#Biometric $dentification()uthentication "echniques& (,ccessed on 21;09;2011

at -+00pm* a#ai$a&$e on WFX

'ttp://www+a$tisinc+com/resources/Biometric/tec'niues+p'p

5e&+0: #biometric solution& (,ccessed on 22;09;2011 at 1+00pm* a#ai$a&$e on

WFX 'ttp://www+&iometric;so$utions+com/inde+p'p7storyper%ormanceY&iometrics

5e&+0: #*eystroke Dynamics - Benchmark Data SetJ (,ccessed on 2;0-;2011 at

4+00pm* a#ai$a&$e on WFX 'ttp://www+cs+cmu+edu/Zkeystroke/

5e&+03:#+ser authentication using keystroke

Dynamics for cellular phoneJ (,ccessed on 2;0-;2011 at 4+00pm* a#ai$a&$e on WFX

'ttp://ieeep$ore+ieee+org/stamp/stamp+jsp7arnum&er0-193

Documents

c Se Project