ArticlePDF Available

The physiology of keystroke dynamics

Authors:

Abstract and Figures

A universal implementation for most behavioral Biometric systems is still unknown since some behaviors aren't individual enough for identification. Habitual behaviors which are measurable by sensors are considered 'soft' biometrics (i.e., walking style, typing rhythm), while physical attributes (i.e., iris, fingerprint) are 'hard' biometrics. Thus, biometrics can aid in the identification of a human not only in cyberspace but in the world we live in. Hard biometrics have proven to be a rather successful form of identification, despite a large amount of individual signatures to keep track of. Virtually all soft biometric strategies, however, share a common pitfall. Instead of the classical pass/fail decision based on the measurements used by hard biometrics, a confidence threshold is imposed, increasing False Alarm and False Rejection Rates. This unreliability is a major roadblock for large scale system integration. Common computer security requires users to log-in with a six or more digit PIN (Personal Identification Number) to access files on the disk. Commercially available Keystroke Dynamics (KD) software can separately calculate and keep track of the mean and variance for each time travelled between each key (air time), and the time spent pressing each key (touch time). Despite its apparent utility, KD is not yet a robust, fault-tolerant system. We begin with a simple question: how could a pianist quickly control so many different finger and wrist movements to play music? What information, if any, can be gained from analyzing typing behavior over time? Biology has shown us that the separation of arm and finger motion is due to 3 long nerves in each arm; regulating movement in different parts of the hand. In this paper we wish to capture the underlying behavioral information of a typist through statistical memory and non-linear dynamics. Our method may reveal an inverse Compressive Sensing mapping; a unique individual signature.
Content may be subject to copyright.
THE PHYSIOLOGY OF KEYSTROKE DYNAMICS
Jeff Jenkins, Quang Nguyen, Joseph Reynolds, William Horner, Harold Szu
US Army NVESD
ABSTRACT
A universal implementation for most behavioral Biometric systems is still unknown since some behaviors aren’t individual
enough for identification. Habitual behaviors which are measurable by sensors are considered ‘soft’ biometrics (i.e., walking
style, typing rhythm), while physical attributes (i.e., iris, fingerprint) are ‘hard’ biometrics. Thus, biometrics can aid in the
identification of a human not only in cyberspace but in the world we live in. Hard biometrics have proven to be a rather
successful form of identification, despite a large amount of individual signatures to keep track of. Virtually all soft biometric
strategies, however, share a common pitfall. Instead of the classical pass/fail decision based on the measurements used by hard
biometrics, a confidence threshold is imposed, increasing False Alarm and False Rejection Rates. This unreliability is a major
roadblock for large scale system integration. Common computer security requires users to log-in with a six or more digit PIN
(Personal Identification Number) to access files on the disk. Commercially available Keystroke Dynamics (KD) software can
separately calculate and keep track of the mean and variance for each time travelled between each key (air time), and the time
spent pressing each key (touch time). Despite its apparent utility, KD is not yet a robust, fault-tolerant system. We begin with a
simple question: how could a pianist quickly control so many different finger and wrist movements to play music? What
information, if any, can be gained from analyzing typing behavior over time? Biology has shown us that the separation of arm
and finger motion is due to 3 long nerves in each arm; regulating movement in different parts of the hand. In this paper we wish
to capture the underlying behavioral information of a typist through statistical memory and non-linear dynamics. Our method
may reveal an inverse Compressive Sensing mapping; a unique individual signature.
Keywords: Keystroke Dynamics, Neural Networks, Time Series Analysis, Recursive Statistics, Compressive Sensing, Physiology
1. INTRODUCTION
Learning to play the piano can be a challenging endeavor, but experienced pianists will say that ‘practice makes perfect’.
But how do we use our sense of touch, sight, and hearing to learn how to play the piano? When trying to play a piece of music,
beginners tend to get frustrated by wrong notes. They may begin to hum the song and try to play it with a note-by-note approach.
Others who have taken many lessons can strike a series of harmonious chords without even looking. How much practice does
one need to learn the scales and the movement techniques before they gain confidence and play from memory? Playing an
instrument is just one example of cross-sensory activities that requires supervised learning to shape what kind of memory is
formed about a particular event, experienced together, yet differently by multiple senses. Multi-sensory activities require our
brain to quickly coordinate movements or responses based on the combined input from different sensor systems (i.e. eyes, hands,
ears). Over the past century, digital communication technology has improved by leaps and bounds, yet ironically humans can’t
seem to master interpersonal verbal communication. The Mammalian nervous system possesses a carbon-based, short and long
distance communication architecture, which has remained relatively unchanged. Our sensory system can rapidly acquire, detect,
and store the changes in intensity from varied stimuli over time to associate with a mental representation (image, sound, etc.)
from our long-term memory in a minimal number of steps. These days, Soldiers face an enemy that no longer wears a uniform,
and fight in unconventional battlegrounds. This unfortunate constraint, coupled with minimal cultural awareness would certainly
reduce sensory coordination through semantic confusion. It would be nice if we could gain insight into aspects of human nature
through observing a transition between physical states of wellness through studying individual statistical variability.
How could we use our physiological understanding to guide a mathematically model of our Nervous system? Unique to our
nervous system and ubiquitous throughout our sensors are these principles: we can learn, we have memory retention and
replenish rate, and habituation. There are structural similarities between the sensors in the human body. The back of our eye
(retina) and our skin has separate, overlapping circular groups of n sensors (1 n 100), of varying diameters; each set of n
sensors is connected to a ganglion. The approximately 1 million ganglions from each eye form the optic nerves. These nerves
further reduce irrelevant light upon entering the Lateral Geniculate Nucleus, where remaining information from both eyes is
fused and sent to the visual cortex in the back of the head. We observe that the human Central Nervous System always seeks to
maintain Isothermal equilibrium, maintaining constant pressure and Temperature (37° C) through free energy minimization. This
may provide a basis for biological Compressive Sensing’s (CS: if you don’t need to sense some stimuli, ignore it) habituation.
Independent Component Analyses, Wavelets, Neural Networks, Biosystems, and Nanoengineering IX,
edited by Harold Szu, Liyi Dai, Proc. of SPIE Vol. 8058, 80581N · © 2011 SPIE
CCC code: 0277-786X/11/$18 · doi: 10.1117/12.887419
Proc. of SPIE Vol. 8058 80581N-1
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
Could CS help us determine how much faster an instinctive reaction is than a decision? Although we will not be addressing it in
this paper, we believe that CS may impact future perception experiments.
Soldiers rely heavily on quick reaction speed and good instincts. If we expect them to respond most efficiently in life or
death situations, we must fully understand the adversary and the terrain; what kind of observable indicators cause the experienced
Soldier to instantly flip their mental state from protector to warrior. We may gain an understanding of the phenomenon known
as hostile intent by reaching out to veterans and deployed soldiers on the front lines and learn from their social and cultural
experiences. In this spirit, an effort has been underway at NVESD to introduce an intranet-based Soldier-Centric Augmented
Reality Training system to conduct perceptual variability testing. It will provide (but is certainly not limited to) a robust library
of different culturally related interactions (for many different cultures) with libraries of different foregrounds (targets),
backgrounds (environments), different environmental conditions (e.g., weather, time) and any other factors that remove
information from the image. Collaboration on the library content is encouraged between other interested parties and would have
an additive effect. Combining our understanding of how the human brain learns from our sensory system, with current Motion
Picture and Gaming industry AR technology, we will develop effective, individualized training media. By regularly updating and
creating realistic and interactive library content with scripts compiled from recent stories of soldiers, we can help expose trainees
to new challenges faced by deployed soldiers. Could AR provide more rapid and appropriate responses to hostile intentions seen
on the battlefield? Can we utilize AR for eye-hand coordination training to help soldiers operate a special purpose surveillance
camcorder and ward off hostile attackers from a distance? In this paper we will be addressing human perception and learning by
exploring the missing link between eye-hand coordination for enhancement of both Network security as well as training material.
We begin with a historic overview of the ‘Fist’ in sect. 2, followed by a discussion of biological evidence in sect. 3. New
mathematical theorems to capture Keystroke Dynamics are presented in Sect. 4, followed by a discussion of experiments and
simulation results in Sect. 5. We conclude in Sect. 6 with a discussion of results, and the ramifications thereof.
2. THE FIST OF THE SENDER: THEN AND NOW
The ‘FIST’ is not a new concept. It was introduced during World War II by telegraph receivers who were able to uniquely
and reliably identify operators by the time spacing of the consecutive ‘dits and dots’ (long and short taps on the Telegraph,
respectively) that compose letters, as well as the time between letters, words, etc. During World War II, communications
between commanders and squadrons occurred through hand-sent Morse code via a Telegraph. Morse code works on a fairly
straightforward principle; each letter and number of the English language is represented by a different combination of 1-5
successive short (‘dits’) and/or long (‘dots’) rhythmic taps by the finger on the ‘knob’. The effectiveness of this communication
was increased significantly by using radio waves to transmit Morse code. Rapidly moving armies in the field could not have
fought effectively without radio telegraphy, because they moved faster than telegraph and telephone lines could be erected. If a
battalion needed to be reinforced, telegraph operators would send a message containing their location and request back to base.
To prevent enemy capture operators had to remain anonymous. Despite their observation of this condition, telegraph receivers
who deciphered messages could often identify the sender by the subtle time differences between letters. This novel discovery has
since been acknowledged as a ‘Soft’ or ‘Behavioral Biometric’. More recent advances in this field have been slowly converging
towards a general authentication method to confirm identity and access systems based on individual keystroke behavior (cf. 2)[3].
These methods compute the mean and variance of Air time and Touch time, and observe how new login values vary these [6][7].
Fig 2. - Keystroke Dynamics Timeline [1]
Despite these efforts to strengthen soft biometric authentication, it is still only an authentication method designed to supplement
more popular identification techniques. According to some, there still isn’t enough confidence to deem a soft biometric a reliable
identification method due to a higher False Acceptance Rate (FAR) and False Rejection Rate (FRR) than Fingerprint and
Voiceprint (DeepNet, 2006). While a high FAR and FRR error could be viewed as a barrier for a reliable biometric, keystroke
dynamics allows for adjustment of the acceptance threshold at the individual level. Also, keystroke dynamics can pose another
issue; physical and logical security multi-factor authentication methods cannot be correlated due to speed constraints. Recent
Proc. of SPIE Vol. 8058 80581N-2
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
developments (by the authors) in the understanding of human cross-sensory correlation and its role in our fault-tolerant working
memory access/retrieval may provide a solution which reduces FAR and FRR on a case by case basis, while providing nearly
instantaneous results. Our system must be robust enough to handle a very large user group, while requiring minimum
administrator intervention. The human body produces over 10 billion neurons in a lifetime. These neurons (nerves) are the
principal conduit of information flow through the body. The biological chronology of typing a PIN number may indicate the
sources of this error, and perhaps this understanding will suggest how our body can save time and energy in recalling arbitrary
muscle memory associated with a frequently repeated task.
3. BIOLOGICAL REVIEW
The anatomy of our Human Visual System (HVS) is a well documented and studied topic. In comparison to other sensory
systems, the HVS is a somewhat different and less understood story. The information carried by light can be filtered by the retina
(back of the eye) and sent to the brain by Retinal Ganglion Cells (RGC) at a fixed rate (~1/17 sec.) due to the periodic cycle of
depletion and replenishment of nutrients available to a group (or one) of photoreceptors
1
. The brain sends messages to the eye as
well via other Ganglion Cells (Ciliary) for varying the pupil size by contracting and expanding the iris. Rods and cones
separately communicate the presence and intensity of light via molecular nutrients. Attached to the rods and cones are various
cells (horizontal, bipolar, amacrine, intrinsically photoreceptive RGC’s) which provide high resolution by lateral inhibition of
neighborhood cells, nutrients, and some which continue to send light responses through the chain to the brain. Upon reaching the
RGC’s, rod and cone signals are arranged in circular overlapping regions (On Center/Off Surround, and vice versa, Receptive
Fields) which resemble a Mexican hat wavelet [8] all over the eye, increasing in width when moving away from the fovea
2
. If a
receptive field provides enough of a signal to the RGC, they will fire action potentials (nerve impulses) via the optic nerve
towards the Lateral Geniculate Nucleus (LGN) located in the center of the head. The LGN is arranged in similar receptive fields
which eliminates signals that are uncorrelated between both eyes. The LGN projects to the back of the head where the Visual
Cortex is located, processing more detailed information about the image. There are more receptive fields here, but they are
directionally selective (simple cells) and some are even selective to motion in a certain direction (complex cells). The various
paths that light takes on its journey causes randomly mixed information to be split up into many categories, such as colors,
ambient (overall background) intensity, size, edge in the image, etc. for eventual semantic understanding. So why are we
ignoring light in the scene that isn’t changing? Despite the fact our Visual Cortex has an area specific for directed motion, our
eye undergoes saccadic jittering (the eye wiggles back and forth very fast), causing an image to quickly excite numerous
neighboring photoreceptors. Our eyes seem to follow rapid motion by utilizing ‘local memory’ (the sharing among neighboring
photoreceptors of extra nutrients requested by photoreceptors that are frequently stimulated) on the retina for detecting the
change of the changes in an image before the usual 1/17 sec. This adaptive foveal blur tracking (for direction of motion and
perhaps or other information) makes our eye a truly smart sensor; we only sample the information we need (i.e. the changes in the
image, which may form a blur when the object travels faster than the eye can relay subtle changes), while throwing away excess
information. This reduces the amount of energy our brain needs to use for quick responses. An unconscious reduction in the
amount of energy used by our brain seems to imply that it takes less work to understand the image [9].
How could a baseball batter hit an unpredictable pitch in about a half second if the brain only receives 8 still images from the
sequence? Intuitively, our brain might anticipate what object we will see. Before we see the ball, we may try and recall a
preconceived mental image of the ball, storing it in our working memory. Picking up at the tail end of the HVS, exiting the
Visual Cortex, neurons containing spatial information travel into the Thalamus
3
and provide input for the posterior parietal cortex
(parietal lobe), which also receives input from two other sensory systems that serve roles in the localization of the body and
external objects in space: the auditory system, and the Somatosensory system. The Somatosensory system plays a significant role
in our ability to physically react to sensory perception. Since we wish to train soldiers on how to detect and respond to hostile
intent, this feedback system linking visual stimulus to hand movement is of great interest. Initially, the location of the hands is
stored in a few places within the frontal motor cortex (where much of the output of the posterior parietal cortex goes): the
dorsolateral prefrontal cortex, various areas of the secondary motor cortex and the frontal eye field. When the hand is moved, its
location is updated in the frontal motor cortex. Premotor area 6 is also important to planned and improvised movement
sequences. The first of these is the lateral premotor area. Together with the basal ganglia, it is involved in the selection of
movements to external cues. The other part of area 6 is the supplementary motor area (SMA), which is involved in the selection

1Photoreceptor(s): light sensors, rods and cones for high resolution night and day vision, respectively.
2 Fovea: “A tiny depression in the retina where light falls directly on the cones, the cells that give the sharpest image.”
3 Thalamus: Structure in the brain located between the mid-brain and cerebral cortex. It's function is to relay sensory information to the cortex.
Proc. of SPIE Vol. 8058 80581N-3
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
of movement sequences from internal cues. After the cortex encodes the spatiotemporal message to move a finger, a combined
message is sent from the anterior intraparietal (AIP) area (containing neurons responsive to shape, size, and orientation of objects
to be grasped as well as for manipulation of hands themselves, both to viewed and remembered stimuli) and by the SMA to the
Thalamus. From here the signal is sent through the lateral cortico-spinal tract; projecting to lateral motoneurons. Some fibers
make monosynaptic connections on motoneurons of distal muscles. The lateral cortico-spinal tract extends into the brainstem and
into the spinal cord. In the spine, large openings between the vertebrae called intervertebral foramina allow spinal nerves to enter
and exit the vertebral column. As they pass through the foramina, each spinal nerve splits into two roots in the brachial plexus:
the ventral root (allows motor neurons to exit the spinal cord) and the dorsal root (allows sensory neurons to enter the spinal
cord). A small bulge called the dorsal root ganglion (spinal ganglion) occurs between each vertebrae of the spine. Inside of this
area are the cell bodies of the sensory neurons. Extending from the brachial plexus of each vertebrae, are spinal nerve roots C5,
C6, C7, C8, T1. After emerging from around the neck area, these five roots become three long nerves at about the shoulder,
called: median, ulnar, radial. These three nerves feed into the muscles of our five fingers and hand.
Fig. 3 - Conceptual Neural Pathway for eye-hand coordination, basis for experimental test bed for individual muscle control habits.
The path going from the 5 fingertips back to the brain is similar, yet shorter than the path from brain to the fingertips.
Interestingly enough, the way that sensory neurons beneath the skin sense temperature (corpuscles
4
of Ruffini), pressure
(Meissner‘s corpuscles), and vibration (bulboid corpuscles) is through their arrangement of connected circular regions called
“On-center Off-surround” receptive fields, very similar to our retina. These sensors have an approximate nutrient replenishment
rate of 1/15 second [5]. Their receptive fields are circular regions that enclose a group of afferent nerves entering the Dorsal
Root Ganglion (DRG). The Subiculum, a component of the hippocampal formation, is thought to relay signals originating in the
hippocampus to many other parts of the brain [10]. In order to perform this function, it uses intrinsically bursting neurons to
convert promising single stimuli into longer lasting ‘burst patterns’ as a way to better focus attention on new stimuli and activate
important processing circuits[2][9]. Once these circuits have been activated, the subicular signal reverts to a single spiking mode
[10]. There are only a few different places that information can travel next, based on the context. It takes approximately .3
seconds for most age groups to react (yes/no, ignoring semantic meaning) when prompted to do so, meaning the whole visual
process, as well as tactile process could be occurring in parallel through locally grouped memories from different senses.
Our senses of touch and sight could be treated as a non-linear feedback system which forms joint information from
tactile and visual receptive fields to associate sensory inputs with either an action or semantic meaning. Let’s revisit the piano
example to sketch out an intuitive thought process (for an experienced player) used to read a few notes from sheet music and
playing it on the piano. We look at a note and its octave (pitch), store alphabetical representation of the note in associative
memory (Hippocampus), access muscle memory for recalling the position of the new note on the keyboard (updated by neuronal
synaptic weights in the motor cortex by the current position of the hand’s difference from muscle memory), move hand to that
position, press down on the key. This first part of the loop involves recalling memory and carrying out an action which imposes
a condition to move on; if you don’t press hard enough to hear the note, push down harder until you can match your mental
conception of that note with the incoming sensory data from the piano. If this condition is met, our Somatosensory cortex sends a

4 Corpuscles: Nerve endings in skin.
Proc. of SPIE Vol. 8058 80581N-4
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
signal to muscles in the finger which played the key to release it. Once pressure sensors in our finger stop firing, we know that
the note has been played and can move on to the next note, looking at it, recalling its position, starting the process all over again.
Although this may not be how every piano player plays, it is almost certainly the way every person types their PIN
number into a computer keyboard (the analogous ‘notes’ are each number or letter of the PIN), or how some fire a weapon
(‘notes’ could be anticipated targets). For a user typing in a PIN, we can capture statistical data of the time spent on each key
(Touch time) and the time taken traversing between two keys (Air time). Assuming the neural pathway for the typical computer
user follows this trend, we could potentially infer from time series analysis other information from the time spent on each key.
We have observed that touch time is more or less a finger dependent constant through many trials, but it varies from person to
person. Touch time can be imagined similar to knowing when to remove your finger from the trigger after quickly shooting one
bullet. If Higher Order statistical independence (Kurtosis) could be measured in a recursive manner, network administrators
could be provided with an indication that the data is becoming more uncorrelated while the user is still typing their PIN. An air
time could be predicted as well with a recursive Artificial Neural Network approach. Due to the uncertainty of what finger
presses each key, predictions will not accurate until the derivative of the user’s kurtosis value approaches zero, meaning their PIN
typing routine is being accessed from their muscle memory. The predicted value in our ANN algorithm arises from a 3
rd
order
chaotic logistic mapping. These methods will provide a reliable solution to Keystroke Dynamics by incorporating fault tolerance;
every user’s typing behavior will vary, but perhaps within a range. Like the human working memory, we propose to save the
change of the changes between the next value collected and its prediction by quickly updating the weight matrix. If the weight
matrix update falls outside of the user’s norm, network administrators could again be notified. In the next section, we provide
derivations of both formulae and discuss experimental results in section 5.
4. MATHEMATICAL APPROACH
We want to compute the change in a human’s sensing. Thus, we will formulate a sequential update algorithm of our
sensing, including our ‘FIST’. We conjecture that upon each key press, the information (energy) being sent down the three
nerves in the arm through the wrist and into our five fingers is part of a larger signal that is modulated based on the distance that
the next key is away from the current one. When we say “identifying the typing” we are really trying to understand the spatio-
temporal encoding. The time it takes from one key to another, Air time, can be achieved with a variety of nerve combinations.
The neural pathways our brain uses to move our hand to different keys is described above. We can assume that over time we
learn the neural path taken to type a repetitive sequence of keys (a PIN number) to the point where it becomes part of our
memory. We can use recursive higher order statistics to observe when the weight between synapses converges to a stable value,
implying that something has been learned. Our dual approach is as follows:
4A - RECURSIVE STATISTICS OF FIST
We believe that KD is a representation of our nervous system’s motor control mechanism. Touch time may be
controlled by a feedback loop located in the vertebrae of our spinal cord which causes our finger to instantaneously release each
key pending sensory confirmation. We have derived a recursive formula to rapidly predict a user’s next touch time with
statistical moments up to the fourth order (kurtosis). A large scale implementation of a Keystroke Dynamics system must
account for multiple simultaneous user access attempts. Instead of storing a huge database of all past login times for statistical
referencing, one could quickly store and retrieve a trivial decimal number, and allow access based on whether or not the user is
within their own variance bound. The dynamics of an individual’s ‘fist’ while typing a Personnel Identification Number (PIN),
after the insertion of a Computer Access Card (CAC) may be derived. This optimism is due to the fact that an individual may
have a unique typing habit and muscle memory. Thus, this behavior might be captured by analyzing chaotic dynamics by
recording the time interval between each different key typed and the time for the duration of each key touched on the keyboard of
an individual’s PIN. While the computer verifies the degree of correctness for each PIN associated with the CAC, we will
provide a secondary soft biometric of typing habits as a potential way to ward off a hacker who possesses a CAC card and knows
the corresponding PIN.
To begin, we take the batch mode statistics of an individual in order to keep building accumulative statistics moments
as follows. We define a uniform weighted batched average of our data set to be the angular brackets

Proc. of SPIE Vol. 8058 80581N-5
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms

1


1
We first prove a useful Lemma of Recursive Averages to any m-th moments

1


1
1

2
Then, we can build in order all the lower moments sequentially, before the Kurtosis:
(i) Mean
1


3

1
1
1


(ii) Variance
Given:




4
Then,










.
(iii) Skewness
Given:



(5)
3

3



3

Then


3
















. (C)
(iv) Kurtosis
Given:



3
(6)

4
6
4

3



,where the invariant remainder is

4

3

6


3
3
4
6

3
. (7)
Thus, for any batched mode N=1,2,3…,


, we have sequentially obtained the Kurtosis formula by the
recursion lemma:

















(D)
Proc. of SPIE Vol. 8058 80581N-6
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
The method of attaining (A)(B)(C)(D) recursively in that order will provide an efficient and fast update of individual statistics.
However, if the update statistics (A-D)
N+1
are too much out the percentage norm .7 of the individual previous records (A-
D)
N
,


%

%


%

%


%

%


%

%
This set of percentage departures are tailored to an individual and may be a suitable warning signal for a potential attacker.
Either requesting the user to repeat typing their PIN or entry of their last four social security numbers are necessary to access of
the specific computer after warning signs. We have shown that Air Time is controlled by any of 15 combinations of nerves from
the left and right hands. What about touch time? We believe that since touch time is governed by a non-linear feedback system,
we must use a different method to unravel the underlying dynamics. Touch time seems to involve a feedback loop starting in sub
dermal sensory receptive fields, traveling up the spinal cord to the SMA for key press confirmation, then back to the finger to
release the key.
4B - ANN MODELING BASED ON SLOPE OF KURTOSIS, A 3RD ORDER LOGISTIC MAP
We assume that the duration of time spacing between keystrokes is specific and thus different to the individual PIN
owner and user(s). Namely, we assume that each individual typing habit may be governed by an underlying habitual probability
density function (h-pdf). Although we do not know the j-th PIN typed by the k-th finger, we can measure its effect at the i-th
time spacing between two consecutive keys typed:



;

;

(1)
Here, subscript is an index for the time interval between the jth and the j+1 pin.

is the median time for this case,
is
the time between the j-th and the j+1 pin. This may be characterized as a non-Gaussian behavior, which can be seen through
higher order cumulant statistics of the Kurtosis

3
0, known as a super-Gaussian multi-modal
image distribution or sub-Gaussian ‘speech-like’ Laplacian Levy distribution. Then, we further assume that the dynamics among
keystrokes which depart from an individual h-pdf are controlled by a generalized chaotic 1-D Feigenbaum logistic map of order
3. Any departure from the prediction may reveal a warning signal for a neurological disorder (i.e., Parkinsons, Carpal Tunnel).
With this formula, if the next value is predictable, we can compare the real next value with the prediction for five consecutive
times for one pin, 5 strikes and you’re out.
We may represent the combined wetware (human body) and hardware (computer) by its performance using an artificial neural
network (ANN) over consecutive time spacing. We wish to discover a unique and long term invariant memory of a specific PIN
number from a user. Thus we should sequentially acquire the execution timeline for every key stroke. To model the synaptic
weight memory
that controls the duration of the keystrokes and their time spacing fluctuation in powers
,
and
we
apply an iterative learning approach of the fluctuation of duration time as follows.







,



; i=1,2,3,…,m-1, (2)
Define the combined weight matrix element as follows:
,,,
(3)
…
,
(4)
Proc. of SPIE Vol. 8058 80581N-7
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
,

1

1



. (5)
Then, we can rewrite m-batch mode result as follows:



1

1




(6)
And obtain the result:


1

1




, (7)
where the inverse of a non-squared matrix may be done with Penrose-Moore Pseudo-Inverse defined to achieve the LMS
estimate.



1

1





1

1



1

1





1

1



(8)
Furthermore, we wish to have a sequential update algorithm of the weight vector which is suited for keystroke entry. Thus, we
add one more data point to the batch mode matrix [A] and adopt Schur’s complement lemma for a sub-matrix inversion.
1

1































(9)
The formula is reduced to a familiar inversion when a single element exists each sub-matrix






(10)
Again, we apply Penrose-Moore pseudo-inverse formula to each group of sub-matrices. When this is done, then we get a new
weight vector


1

1


 (11)
Where

is the predicted value from the logistic map.




(12)
From this, we can predict the next fluctuation spacing

using






% (13)
We can allow five consecutive accumulated errors to either prompt a retyping of the PIN or demand additional information such
as a four digit social.
Proc. of SPIE Vol. 8058 80581N-8
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
5. EXPERIMENTAL RESULTS
We limited our data to include 3 different PIN numbers from two users, providing about 300 trials for each PIN. All trials for
each PIN was typed in the same day, different days for subsequent PIN numbers. Time capture software was written in-house
with Java, implementation of the above theorems and graphs were produced with MatLab. The first user used all fingers on their
right hand to type each pin on the number pad on the right side of the keyboard. The second user used one finger on each hand to
type all three PINs on the horizontally positioned numbers in the middle of the keyboard. For future experiments it would be
nice to incorporate newer keyboards with pressure sensors. These sensors could reveal further information about the time series
data, and could be another soft biometric characteristic.
Fig. 4 ~ Statistical graphs for 2 users with the same 6 digit PIN. a) Recursively computed mean, variance, skewness, and kurtosis.
(one digit from Trial 1). b) Derivative of Kurtosis (for every touch time digit in Trial 1). c) Difference between predicted and actual
values for each Air time (1-5)
From above, we observe that the predicted value versus the actual value became more accurate as the derivative of
kurtosis approached zero for a given air time. By taking the mode of touch time values, we observed a biological linkage
between different nerves and coincided with the approximate firing rate mentioned earlier (1/15 sec.) We also noticed that the
each predicted Air time seemed to approach the actual value in increments of about 50 trials, implying that implementation of
ANN predictions for each digit in the PIN would have to wait for each key transition to become a part of the user’s memory.
This may be discovered upon a near zero value when comparing predicted and actual times, where the error margin could be
determined by the variability of sequential statistical moments.
Jeffrey
Quang
Proc. of SPIE Vol. 8058 80581N-9
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
6. CONCLUSION
Touch time was very stable time for both users, depending on which key was pressed. Air time was fairly consistent
for all times of user 1, varying only between new 6-digit PINs. User 2 was fairly consistent over time for separate keys, but had
more outliers. It would be interesting if an outlier in air time represented a change in the hand used to press the key. Perhaps
user 1’s consistent use of one hand explains the absence of outliers. The slope (derivative) of the sequential kurtosis from user
1’s non-linear, curve approaches zero. The slope of User 2’s graphs had a more linear appearance, where a zero derivative is not
approached as rapidly. We believe there is a correlation between (i) the slope of kurtosis in Air Time and/or Touch time and (ii)
the error margin of the predicted time vs. the actual time. Comparing the trial number for (i) and (ii) may indicate that the
number of required entries before accurate predictions vary between users. A non-zero kurtosis value with a derivative
approaching zero may indicate that our brain has added the PIN number to memory, now accessible by muscle memory. When
predictions become viable, FAR/FRR can be further reduced by a secondary prompt, perhaps asking the user to provide a social
security, telephone, or some other number assumed to be memorized. These numbers have a separate muscle memory space in
the brain, likely containing a different set air times. Future experiments should explore the link of muscle memory to visual
perception. Muscle memories of physical reactions might be strengthened by visual stimulus. Perhaps Keystroke Dynamics can
serve as a metric of measuring one’s reaction time to imagery, and over many trials reveal the variability between individual
cross-sensory correlation speed, and what can decrease the time of memory retrieval and execution. We can utilize a Turing-like
system to sharpen the statistical boundary with an iterative process [4]. Age may play a big role in this variability, which has
implications for biomedical wellness applications. Could we extend statistical variability of habitual typing to both wellness
monitoring and Network security? Our results indicate that a departure from predicted typing times may indicate a change in
physiological state when a PIN is assumed to be part of muscle memory. Our new approach to KD may prove useful to the
medical industry and pave the way for neurological ground truth. Only time will tell.
ACKNOWLEDGEMENTS: This work was funded by the 2010-2012 ILIR program, supported by US Army NVESD.
References:
1) Checco, J. C. (2006). Keystroke dynamics & corporate security. Retrieved August 21,
2006 from http://www.wsta.org/publications/articles/1003_article06.html
2) Cooper, DC; Ellenberger, H.; Ballanyi, K; Richter, D.; Feldman, J. (2002). "The significance of action potential bursting in the brain
reward circuit". Neurochemistry international 254 (5032): 726–9
3) Monrose, Fabian, and Aviel Rubin. "Keystroke Dynamics as a Biometric for Authentication." Future Generation Computer Systems 16.4
(2000). Print.
4) Von Ahn, Luis, Benjamin Maurer, Colin McMillen, David Abraham, and Manuel Blum. "ReCAPTCHA: Human-Based Character
Recognition via Web Security Measures." Science 321.5895 (2008): 1465-468. Print.
5) GEORGOPOULOS, APOSTOLOS P., GIUSEPPE PELLIZZER, ANDREW V. POLIAKOV, and MARC H. SCHIEBER. "Neural Coding
of Finger and Wrist Movements." Journal of Computational Neuroscience 6.3 (1999)): 279-88. Print.
6) Kapczyński, Adrian, Paweł Kasprowski, and Piotr Kuźniacki. "Modern Access Control Based on Eye Movement Analysis and Keystroke
Dynamics." Proceedings of the International Multiconference on ISSN 1896-7094 Computer Science and Information Technology (2006):
477-83. Print.
7) Rehmeyer, Julie J. "Digital Fingerprints: Tiny Behavioral Differences Can Reveal Your Identity Online." Science News 171.2 (2007): 26.
Print.
8) Jenkins, Jeffrey C., and Harold H. Szu. "Recognizing Foreground-Background Interaction." Proceedings of the SPIE: Independent
Component Analyses, Wavelets, Neural Networks, Biosystems, and Nanoengineering VIII 7703 (2010). Print.
9) Swadlow, H; A Gusev, T Bezdudnaya (2002-01-01). "Activation of a cortical column by a thalamocortical impulse". Journal of
Neuroscience 22 (17): 7766–7773.
10) Cooper, DC; S Chung, N Spruston (2005-06). "Output-mode transitions are controlled by prolonged inactivation of sodium channels in
pyramidal neurons of subiculum". PLOS Biology 3 (6): 1123
Proc. of SPIE Vol. 8058 80581N-10
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
... Telegraph operators noticed that the timing interval between when a dot and a dash is transmitted appeared to be unique to the user on the other end. Therefore, a pair of telegraph operators can become familiar with their counterpart's timing intervals and thus could identify each other and authenticate the transmission (Jenkins et al., 2011). ...
... During World War II, the American military intelligence community developed the "FIST, " which attempted to improve the security of Morse Code over wireless networks (Jenkins et al., 2011). Rapidly moving army units needed to communicate with their rear echelon commanders in real time. ...
... Rapidly moving army units needed to communicate with their rear echelon commanders in real time. However, the dynamic nature of a battlefield made it impossible to erect telephone poles along the battle routes (Jenkins et al., 2011). Therefore, field units used Morse Code over portable two-way radios to communicate with each other. ...
Article
Full-text available
At present, interfaces between users and smart devices such as smart phones rely primarily on passwords. This has allowed for the intrusion and perturbation of the interface between the user and the device and has compromised security. Recently, Frank et al. have suggested that security could be improved by having an interface with biometric features of finger swiping. This approach has been termed touchalytics, in maintaining cybersecurity. The number of features of finger swiping have been large (32) and have been made available as a public database, which we utilize in our study. However, it has not been shown which of these features uniquely identify a particular user. In this paper, we study whether a subset of features that embody human cognitive motor features can be used to identify a particular user. We consider how the security might be made more efficient embodying Principal Component Analysis (PCA) into the interface, which has the potential of reducing the features utilized in the identification of intruders. We compare the accuracy and performance of the reduced feature space to that of having all the features. Embodying a robust continuous authentication system will give users an extra layer of security and an increased sense of peace of mind if their devices are lost or stolen. Consequently, such improvements may prevent access to sensitive information and thus will save businesses money. Consequently, such improvements may prevent access to sensitive information and thus will save businesses money. If continuous authentication models become successful and easily implementable, embodiment and co-adaptation of user authentication would inhibit the growing problem of mobile device theft.
... we can plot changes based on the telescopic viewpoint to aid in the quantitative analysis of microscopic measurement and how it's changes alter the macroscopic picture. Following the equations outlined below, one can represent a nano-scale telescopic imaging system mathematically [11][15]: We define a uniform weighted batched average of our data set to be the angular brackets ...
Conference Paper
Full-text available
To ensure a self-consistent scaling approximation, the underlying microscopic fluctuation components can naturally influence macroscopic means, which may give rise to emergent observable phenomena. In this paper, we describe a consistent macroscopic (cm-scale), mesoscopic (micron-scale), and microscopic (nano-scale) approach to introduce Telescopic Multi-Resolution (TMR) into current Augmented Reality (AR) visualization technology. We propose to couple TMR-AR by introducing an energy-matter interaction engine framework that is based on known Physics, Biology, Chemistry principles. An immediate payoff of TMR-AR is a self-consistent approximation of the interaction between microscopic observables and their direct effect on the macroscopic system that is driven by real-world measurements. Such an interdisciplinary approach enables us to achieve more than multiple scale, telescopic visualization of real and virtual information but also conducting thought experiments through AR. As a result of the consistency, this framework allows us to explore a large dimensionality parameter space of measured and unmeasured regions. Towards this direction, we explore how to build learnable libraries of biological, physical, and chemical mechanisms. Fusing analytical sensors with TMR-AR libraries provides a robust framework to optimize testing and evaluation through data-driven or virtual synthetic simulations. Visualizing mechanisms of interactions requires identification of observable image features that can indicate the presence of information in multiple spatial and temporal scales of analog data. The AR methodology was originally developed to enhance pilot-training as well as ‘make believe’ entertainment industries in a user-friendly digital environment We believe TMR-AR can someday help us conduct thought experiments scientifically, to be pedagogically visualized in a zoom-in-and-out, consistent, multi-scale approximations.
Conference Paper
Full-text available
We seek to augment the current Common Access Control (CAC) card and Personal Identification Number (PIN) verification systems with an additional layer of classified access biometrics. Among proven devices such as fingerprint readers and cameras that can sense the human eye's iris pattern, we introduced a number of users to a sequence of 'grandmother images', or emotionally evoked stimuli response images from other users, as well as one of their own, for the purpose of authentication. We performed testing and evaluation of the Authenticity Privacy and Security (APS) brainwave biometrics, similar to the internal organ of the human eye’s iris which cannot easily be altered. ‘Aha’ recognition through stimulus-response habituation can serve as a biomarker, similar to keystroke dynamics analysis for inter and intra key fluctuation time of a memorized PIN number (FIST). Using a non-tethered Electroencephalogram (EEG) wireless smartphone/pc monitor interface, we explore the appropriate stimuli-response biomarker present in DTAB low frequency group waves. Prior to login, the user is shown a series of images on a computer display. They have been primed to click their mouse when the image is presented. DTAB waves are collected with a wireless EEG and are sent via Smartphone to a cloud based processing infrastructure. There, we measure fluctuations in DTAB waves from a wireless, non-tethered, single node EEG device between the Personal Graphic Image Number (PGIN) stimulus image and the response time from an individual’s mental performance baseline. Towards that goal, we describe an infrastructure that supports distributed verification for web-based EEG authentication. The performance of machine learning on the relative Power Spectral Density EEG data may uncover features required for subsequent access to web or media content. Our approach provides a scalable framework wrapped into a robust Neuro-Informatics toolkit, viable for use in the Biomedical and mental health communities, as well as numerous consumer applications.
Article
Full-text available
Can the background affect a foreground target in distant, low-quality imagery? If it does, it might occur in our mind, or perhaps it may represent a snapshot of our early vision. An affirmative answer, one way or another, may affect our current understanding of this phenomena and potentially for related applications. How can we be sure about this in the psycho-physical sense? We begin with the physiology of our brain's homeostasis, of which an isothermal equilibrium is characterized by the minimum of Helmholtz isothermal Free Energy: A = U - T0S >= 0, where T0 = 37°C, the Boltzmann Entropy S = KB1n(W), and U is the unknown internal energy to be computed.
Article
Full-text available
Previous work (Schieber and Hibbard, 1993) has shown that single motor cortical neurons do not discharge specifically for a particular flexion-extension finger movement but instead are active with movements of different fingers. In addition, neuronal populations active with movements of different fingers overlap extensively in their spatial locations in the motor cortex. These data suggested that control of any finger movement utilizes a distributed population of neurons. In this study we applied the neuronal population vector analysis (Georgopoulos et al., 1983) to these same data to determine (1) whether single cells are tuned in an abstract, three-dimensional (3D) instructed finger and wrist movement space with hand-like geometry and (2) whether the neuronal population encodes specific finger movements. We found that the activity of 132/176 (75%) motor cortical neurons related to finger movements was indeed tuned in this space. Moreover, the population vector computed in this space predicted well the instructed finger movement. Thus, although single neurons may be related to several disparate finger movements, and neurons related to different finger movements are intermingled throughout the hand area of the motor cortex, the neuronal population activity does specify particular finger movements.
Article
Full-text available
Transitions between different behavioral states, such as sleep or wakefulness, quiescence or attentiveness, occur in part through transitions from action potential bursting to single spiking. Cortical activity, for example, is determined in large part by the spike output mode from the thalamus, which is controlled by the gating of low-voltage-activated calcium channels. In the subiculum--the major output of the hippocampus--transitions occur from bursting in the delta-frequency band to single spiking in the theta-frequency band. We show here that these transitions are influenced strongly by the inactivation kinetics of voltage-gated sodium channels. Prolonged inactivation of sodium channels is responsible for an activity-dependent switch from bursting to single spiking, constituting a novel mechanism through which network dynamics are controlled by ion channel gating.
Article
The paper presents key aspects connected with modern access control based on behavioral patterns of human being. Two biometric techniques based on eye movement and keystroke dynamics were presented. Quantitative results obtained during examination of systems based on mentioned behavioral methods are convincing to undertake further research work.
Article
More than ever before the Internet is changing computing as we know it. Global access to information and resources is becoming an integral part of nearly every aspect of our lives. Unfortunately, with this global network access comes increased chances of malicious attack and intrusion. In an effort to confront the new threats unveiled by the networking revolution of the past few years reliable, rapid, and unintrusive means for automatically recognizing the identity of individuals are now being sought. In this paper we examine an emerging non-static biometric technique that aims to identify users based on analyzing habitual rhythm patterns in the way they type.
Article
CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) are widespread security measures on the World Wide Web that prevent automated programs from abusing online services. They do so by asking humans to perform a task that computers cannot yet perform, such as deciphering distorted characters. Our research explored whether such human effort can be channeled into a useful purpose: helping to digitize old printed material by asking users to decipher scanned words from books that computerized optical character recognition failed to recognize. We showed that this method can transcribe text with a word accuracy exceeding 99%, matching the guarantee of professional human transcribers. Our apparatus is deployed in more than 40,000 Web sites and has transcribed over 440 million words.
Article
The brain reward circuit consists of specialized cortical and subcortical structural components that code for various cognitive aspects of goal-directed behavior. These components include the prefrontal cortex (PFC), amygdala (AMY), nucleus accumbens (Nac), subiculum (SUB) of the hippocampal formation, and the dopamine (DA) neurons in the ventral tegmental area (VTA). Both serial and parallel processing in the different components of the circuit code the various aspects of reward-related behavior. Individual neurons within each component have developed specialized intrinsic membrane properties that have led them to be typically defined as either single spiking or high frequency burst-firing neurons. However, a strict definition based on the output mode may not be appropriate. Under the right conditions, neurons can switch between bursting and single-spiking modes, therefore providing a conditional output state. The preferred mode of each individual neuron depends on a combination of different plastic neuronal properties such as, dendritic architecture, neuromodulation, intracellular calcium (Ca(++)) buffering, excitatory and inhibitory synaptic strength, and the spatial distribution and density of voltage and ligand-gated channels. It is likely that, in vivo, most neurons in the circuit, despite variations in intrinsic membrane properties, are conditional output neurons equipped with the versatility of switching between output modes under appropriate conditions. Bursting mode may be used to boost the gain of neural signaling of important or novel events by enhancing transmitter release and enhancing dendritic depolarization, thereby increasing synaptic potentiation. Conversely, single spiking mode may be used to dampen neuronal signaling and may be associated with habituation to unimportant events. Mode switching may provide flexibility to the circuit allowing different sets of neurons to conditionally code for the various aspects of reward-related memory and behavior.
Article
Thalamocortical (TC) impulses potently influence the sensory neocortex, but the functional impact of individual TC neurons throughout the layers of the cortex has proved difficult to assess. Here we examine, in awake rabbits, the vertical distribution of monosynaptic currents generated in a somatosensory cortical "barrel" column by spontaneous impulses of single, topographically aligned TC neurons. We show that closely neighboring TC neurons generate widely differing patterns of monosynaptic activation within layers 4 and 6 of their aligned column. Moreover, synaptic currents generated by TC impulses with long preceding interspike intervals are greatly enhanced in both of these layers. The degree of this enhancement differs reliably among neighboring TC neurons but, for a given neuron, is very similar in layers 4 and 6. Our results indicate that in the awake state, TC synapses throughout the depth of the cortex serve as powerful filters of sensory information that reflect individual characteristics of their parent TC neuron.
Keystroke dynamics & corporate security
  • J C Checco
Checco, J. C. (2006). Keystroke dynamics & corporate security. Retrieved August 21, 2006 from http://www.wsta.org/publications/articles/1003_article06.html