Security: DArPA

The authors present an authentication system that applies machine learning techniques to observe a user’s cognitive typing rhythm. Results from a large-scale experiment at Iowa State University show the system’s effectiveness. C onventional authentication systems verify a user only during initial login. Active authentication performs verifi-cation continuously as long as the ses-sion remains active. This work focuses on using behavioral biometrics, extracted from keystroke dynamics, as “something a user is ” for active au-thentication. This scheme performs continual verification in the background, requires no addi-tional hardware devices, and is invisible to users. Keystroke Dynamics Keystroke dynamics—the detailed timing infor-mation of keystrokes when using a keyboard— has been studied for the past three decades. The typical keystroke interval time, referred to as a digraph, is expressed as the time between typing two characters. A user’s keystroke rhythms are distinct enough from person to person for use as biometrics to identify people. However, key-stroke rhythm has generally been considered less reliable than physical biometrics, such as fin-gerprints. The main challenge is the presence of within-user variability. Owing to this within-user variability of interval times among identical keystrokes, most research efforts have focused on verification techniques that can manage such variability. For example, researchers proposed a method called degree of disorder to cope with time variation issues,1,2 ar-guing that although the keystroke typing dura-tions usually vary between each digraph, th