Content uploaded by Harold Szu
Author content
All content in this area was uploaded by Harold Szu on Jul 08, 2015
Content may be subject to copyright.
Content uploaded by Harold Szu
Author content
All content in this area was uploaded by Harold Szu on Jul 01, 2015
Content may be subject to copyright.
THE PHYSIOLOGY OF KEYSTROKE DYNAMICS
Jeff Jenkins, Quang Nguyen, Joseph Reynolds, William Horner, Harold Szu
US Army NVESD
ABSTRACT
A universal implementation for most behavioral Biometric systems is still unknown since some behaviors aren’t individual
enough for identification. Habitual behaviors which are measurable by sensors are considered ‘soft’ biometrics (i.e., walking
style, typing rhythm), while physical attributes (i.e., iris, fingerprint) are ‘hard’ biometrics. Thus, biometrics can aid in the
identification of a human not only in cyberspace but in the world we live in. Hard biometrics have proven to be a rather
successful form of identification, despite a large amount of individual signatures to keep track of. Virtually all soft biometric
strategies, however, share a common pitfall. Instead of the classical pass/fail decision based on the measurements used by hard
biometrics, a confidence threshold is imposed, increasing False Alarm and False Rejection Rates. This unreliability is a major
roadblock for large scale system integration. Common computer security requires users to log-in with a six or more digit PIN
(Personal Identification Number) to access files on the disk. Commercially available Keystroke Dynamics (KD) software can
separately calculate and keep track of the mean and variance for each time travelled between each key (air time), and the time
spent pressing each key (touch time). Despite its apparent utility, KD is not yet a robust, fault-tolerant system. We begin with a
simple question: how could a pianist quickly control so many different finger and wrist movements to play music? What
information, if any, can be gained from analyzing typing behavior over time? Biology has shown us that the separation of arm
and finger motion is due to 3 long nerves in each arm; regulating movement in different parts of the hand. In this paper we wish
to capture the underlying behavioral information of a typist through statistical memory and non-linear dynamics. Our method
may reveal an inverse Compressive Sensing mapping; a unique individual signature.
Keywords: Keystroke Dynamics, Neural Networks, Time Series Analysis, Recursive Statistics, Compressive Sensing, Physiology
1. INTRODUCTION
Learning to play the piano can be a challenging endeavor, but experienced pianists will say that ‘practice makes perfect’.
But how do we use our sense of touch, sight, and hearing to learn how to play the piano? When trying to play a piece of music,
beginners tend to get frustrated by wrong notes. They may begin to hum the song and try to play it with a note-by-note approach.
Others who have taken many lessons can strike a series of harmonious chords without even looking. How much practice does
one need to learn the scales and the movement techniques before they gain confidence and play from memory? Playing an
instrument is just one example of cross-sensory activities that requires supervised learning to shape what kind of memory is
formed about a particular event, experienced together, yet differently by multiple senses. Multi-sensory activities require our
brain to quickly coordinate movements or responses based on the combined input from different sensor systems (i.e. eyes, hands,
ears). Over the past century, digital communication technology has improved by leaps and bounds, yet ironically humans can’t
seem to master interpersonal verbal communication. The Mammalian nervous system possesses a carbon-based, short and long
distance communication architecture, which has remained relatively unchanged. Our sensory system can rapidly acquire, detect,
and store the changes in intensity from varied stimuli over time to associate with a mental representation (image, sound, etc.)
from our long-term memory in a minimal number of steps. These days, Soldiers face an enemy that no longer wears a uniform,
and fight in unconventional battlegrounds. This unfortunate constraint, coupled with minimal cultural awareness would certainly
reduce sensory coordination through semantic confusion. It would be nice if we could gain insight into aspects of human nature
through observing a transition between physical states of wellness through studying individual statistical variability.
How could we use our physiological understanding to guide a mathematically model of our Nervous system? Unique to our
nervous system and ubiquitous throughout our sensors are these principles: we can learn, we have memory retention and
replenish rate, and habituation. There are structural similarities between the sensors in the human body. The back of our eye
(retina) and our skin has separate, overlapping circular groups of n sensors (1 ≤ n ≤ 100), of varying diameters; each set of n
sensors is connected to a ganglion. The approximately 1 million ganglions from each eye form the optic nerves. These nerves
further reduce irrelevant light upon entering the Lateral Geniculate Nucleus, where remaining information from both eyes is
fused and sent to the visual cortex in the back of the head. We observe that the human Central Nervous System always seeks to
maintain Isothermal equilibrium, maintaining constant pressure and Temperature (37° C) through free energy minimization. This
may provide a basis for biological Compressive Sensing’s (CS: if you don’t need to sense some stimuli, ignore it) habituation.
Independent Component Analyses, Wavelets, Neural Networks, Biosystems, and Nanoengineering IX,
edited by Harold Szu, Liyi Dai, Proc. of SPIE Vol. 8058, 80581N · © 2011 SPIE
CCC code: 0277-786X/11/$18 · doi: 10.1117/12.887419
Proc. of SPIE Vol. 8058 80581N-1
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
Could CS help us determine how much faster an instinctive reaction is than a decision? Although we will not be addressing it in
this paper, we believe that CS may impact future perception experiments.
Soldiers rely heavily on quick reaction speed and good instincts. If we expect them to respond most efficiently in life or
death situations, we must fully understand the adversary and the terrain; what kind of observable indicators cause the experienced
Soldier to instantly flip their mental state from protector to warrior. We may gain an understanding of the phenomenon known
as hostile intent by reaching out to veterans and deployed soldiers on the front lines and learn from their social and cultural
experiences. In this spirit, an effort has been underway at NVESD to introduce an intranet-based Soldier-Centric Augmented
Reality Training system to conduct perceptual variability testing. It will provide (but is certainly not limited to) a robust library
of different culturally related interactions (for many different cultures) with libraries of different foregrounds (targets),
backgrounds (environments), different environmental conditions (e.g., weather, time) and any other factors that remove
information from the image. Collaboration on the library content is encouraged between other interested parties and would have
an additive effect. Combining our understanding of how the human brain learns from our sensory system, with current Motion
Picture and Gaming industry AR technology, we will develop effective, individualized training media. By regularly updating and
creating realistic and interactive library content with scripts compiled from recent stories of soldiers, we can help expose trainees
to new challenges faced by deployed soldiers. Could AR provide more rapid and appropriate responses to hostile intentions seen
on the battlefield? Can we utilize AR for eye-hand coordination training to help soldiers operate a special purpose surveillance
camcorder and ward off hostile attackers from a distance? In this paper we will be addressing human perception and learning by
exploring the missing link between eye-hand coordination for enhancement of both Network security as well as training material.
We begin with a historic overview of the ‘Fist’ in sect. 2, followed by a discussion of biological evidence in sect. 3. New
mathematical theorems to capture Keystroke Dynamics are presented in Sect. 4, followed by a discussion of experiments and
simulation results in Sect. 5. We conclude in Sect. 6 with a discussion of results, and the ramifications thereof.
2. THE FIST OF THE SENDER: THEN AND NOW
The ‘FIST’ is not a new concept. It was introduced during World War II by telegraph receivers who were able to uniquely
and reliably identify operators by the time spacing of the consecutive ‘dits and dots’ (long and short taps on the Telegraph,
respectively) that compose letters, as well as the time between letters, words, etc. During World War II, communications
between commanders and squadrons occurred through hand-sent Morse code via a Telegraph. Morse code works on a fairly
straightforward principle; each letter and number of the English language is represented by a different combination of 1-5
successive short (‘dits’) and/or long (‘dots’) rhythmic taps by the finger on the ‘knob’. The effectiveness of this communication
was increased significantly by using radio waves to transmit Morse code. Rapidly moving armies in the field could not have
fought effectively without radio telegraphy, because they moved faster than telegraph and telephone lines could be erected. If a
battalion needed to be reinforced, telegraph operators would send a message containing their location and request back to base.
To prevent enemy capture operators had to remain anonymous. Despite their observation of this condition, telegraph receivers
who deciphered messages could often identify the sender by the subtle time differences between letters. This novel discovery has
since been acknowledged as a ‘Soft’ or ‘Behavioral Biometric’. More recent advances in this field have been slowly converging
towards a general authentication method to confirm identity and access systems based on individual keystroke behavior (cf. 2)[3].
These methods compute the mean and variance of Air time and Touch time, and observe how new login values vary these [6][7].
Fig 2. - Keystroke Dynamics Timeline [1]
Despite these efforts to strengthen soft biometric authentication, it is still only an authentication method designed to supplement
more popular identification techniques. According to some, there still isn’t enough confidence to deem a soft biometric a reliable
identification method due to a higher False Acceptance Rate (FAR) and False Rejection Rate (FRR) than Fingerprint and
Voiceprint (DeepNet, 2006). While a high FAR and FRR error could be viewed as a barrier for a reliable biometric, keystroke
dynamics allows for adjustment of the acceptance threshold at the individual level. Also, keystroke dynamics can pose another
issue; physical and logical security multi-factor authentication methods cannot be correlated due to speed constraints. Recent
Proc. of SPIE Vol. 8058 80581N-2
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
developments (by the authors) in the understanding of human cross-sensory correlation and its role in our fault-tolerant working
memory access/retrieval may provide a solution which reduces FAR and FRR on a case by case basis, while providing nearly
instantaneous results. Our system must be robust enough to handle a very large user group, while requiring minimum
administrator intervention. The human body produces over 10 billion neurons in a lifetime. These neurons (nerves) are the
principal conduit of information flow through the body. The biological chronology of typing a PIN number may indicate the
sources of this error, and perhaps this understanding will suggest how our body can save time and energy in recalling arbitrary
muscle memory associated with a frequently repeated task.
3. BIOLOGICAL REVIEW
The anatomy of our Human Visual System (HVS) is a well documented and studied topic. In comparison to other sensory
systems, the HVS is a somewhat different and less understood story. The information carried by light can be filtered by the retina
(back of the eye) and sent to the brain by Retinal Ganglion Cells (RGC) at a fixed rate (~1/17 sec.) due to the periodic cycle of
depletion and replenishment of nutrients available to a group (or one) of photoreceptors
1
. The brain sends messages to the eye as
well via other Ganglion Cells (Ciliary) for varying the pupil size by contracting and expanding the iris. Rods and cones
separately communicate the presence and intensity of light via molecular nutrients. Attached to the rods and cones are various
cells (horizontal, bipolar, amacrine, intrinsically photoreceptive RGC’s) which provide high resolution by lateral inhibition of
neighborhood cells, nutrients, and some which continue to send light responses through the chain to the brain. Upon reaching the
RGC’s, rod and cone signals are arranged in circular overlapping regions (On Center/Off Surround, and vice versa, Receptive
Fields) which resemble a Mexican hat wavelet [8] all over the eye, increasing in width when moving away from the fovea
2
. If a
receptive field provides enough of a signal to the RGC, they will fire action potentials (nerve impulses) via the optic nerve
towards the Lateral Geniculate Nucleus (LGN) located in the center of the head. The LGN is arranged in similar receptive fields
which eliminates signals that are uncorrelated between both eyes. The LGN projects to the back of the head where the Visual
Cortex is located, processing more detailed information about the image. There are more receptive fields here, but they are
directionally selective (simple cells) and some are even selective to motion in a certain direction (complex cells). The various
paths that light takes on its journey causes randomly mixed information to be split up into many categories, such as colors,
ambient (overall background) intensity, size, edge in the image, etc. for eventual semantic understanding. So why are we
ignoring light in the scene that isn’t changing? Despite the fact our Visual Cortex has an area specific for directed motion, our
eye undergoes saccadic jittering (the eye wiggles back and forth very fast), causing an image to quickly excite numerous
neighboring photoreceptors. Our eyes seem to follow rapid motion by utilizing ‘local memory’ (the sharing among neighboring
photoreceptors of extra nutrients requested by photoreceptors that are frequently stimulated) on the retina for detecting the
change of the changes in an image before the usual 1/17 sec. This adaptive foveal blur tracking (for direction of motion and
perhaps or other information) makes our eye a truly smart sensor; we only sample the information we need (i.e. the changes in the
image, which may form a blur when the object travels faster than the eye can relay subtle changes), while throwing away excess
information. This reduces the amount of energy our brain needs to use for quick responses. An unconscious reduction in the
amount of energy used by our brain seems to imply that it takes less work to understand the image [9].
How could a baseball batter hit an unpredictable pitch in about a half second if the brain only receives 8 still images from the
sequence? Intuitively, our brain might anticipate what object we will see. Before we see the ball, we may try and recall a
preconceived mental image of the ball, storing it in our working memory. Picking up at the tail end of the HVS, exiting the
Visual Cortex, neurons containing spatial information travel into the Thalamus
3
and provide input for the posterior parietal cortex
(parietal lobe), which also receives input from two other sensory systems that serve roles in the localization of the body and
external objects in space: the auditory system, and the Somatosensory system. The Somatosensory system plays a significant role
in our ability to physically react to sensory perception. Since we wish to train soldiers on how to detect and respond to hostile
intent, this feedback system linking visual stimulus to hand movement is of great interest. Initially, the location of the hands is
stored in a few places within the frontal motor cortex (where much of the output of the posterior parietal cortex goes): the
dorsolateral prefrontal cortex, various areas of the secondary motor cortex and the frontal eye field. When the hand is moved, its
location is updated in the frontal motor cortex. Premotor area 6 is also important to planned and improvised movement
sequences. The first of these is the lateral premotor area. Together with the basal ganglia, it is involved in the selection of
movements to external cues. The other part of area 6 is the supplementary motor area (SMA), which is involved in the selection
1Photoreceptor(s): light sensors, rods and cones for high resolution night and day vision, respectively.
2 Fovea: “A tiny depression in the retina where light falls directly on the cones, the cells that give the sharpest image.”
3 Thalamus: Structure in the brain located between the mid-brain and cerebral cortex. It's function is to relay sensory information to the cortex.
Proc. of SPIE Vol. 8058 80581N-3
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
of movement sequences from internal cues. After the cortex encodes the spatiotemporal message to move a finger, a combined
message is sent from the anterior intraparietal (AIP) area (containing neurons responsive to shape, size, and orientation of objects
to be grasped as well as for manipulation of hands themselves, both to viewed and remembered stimuli) and by the SMA to the
Thalamus. From here the signal is sent through the lateral cortico-spinal tract; projecting to lateral motoneurons. Some fibers
make monosynaptic connections on motoneurons of distal muscles. The lateral cortico-spinal tract extends into the brainstem and
into the spinal cord. In the spine, large openings between the vertebrae called intervertebral foramina allow spinal nerves to enter
and exit the vertebral column. As they pass through the foramina, each spinal nerve splits into two roots in the brachial plexus:
the ventral root (allows motor neurons to exit the spinal cord) and the dorsal root (allows sensory neurons to enter the spinal
cord). A small bulge called the dorsal root ganglion (spinal ganglion) occurs between each vertebrae of the spine. Inside of this
area are the cell bodies of the sensory neurons. Extending from the brachial plexus of each vertebrae, are spinal nerve roots C5,
C6, C7, C8, T1. After emerging from around the neck area, these five roots become three long nerves at about the shoulder,
called: median, ulnar, radial. These three nerves feed into the muscles of our five fingers and hand.
Fig. 3 - Conceptual Neural Pathway for eye-hand coordination, basis for experimental test bed for individual muscle control habits.
The path going from the 5 fingertips back to the brain is similar, yet shorter than the path from brain to the fingertips.
Interestingly enough, the way that sensory neurons beneath the skin sense temperature (corpuscles
4
of Ruffini), pressure
(Meissner‘s corpuscles), and vibration (bulboid corpuscles) is through their arrangement of connected circular regions called
“On-center Off-surround” receptive fields, very similar to our retina. These sensors have an approximate nutrient replenishment
rate of 1/15 second [5]. Their receptive fields are circular regions that enclose a group of afferent nerves entering the Dorsal
Root Ganglion (DRG). The Subiculum, a component of the hippocampal formation, is thought to relay signals originating in the
hippocampus to many other parts of the brain [10]. In order to perform this function, it uses intrinsically bursting neurons to
convert promising single stimuli into longer lasting ‘burst patterns’ as a way to better focus attention on new stimuli and activate
important processing circuits[2][9]. Once these circuits have been activated, the subicular signal reverts to a single spiking mode
[10]. There are only a few different places that information can travel next, based on the context. It takes approximately .3
seconds for most age groups to react (yes/no, ignoring semantic meaning) when prompted to do so, meaning the whole visual
process, as well as tactile process could be occurring in parallel through locally grouped memories from different senses.
Our senses of touch and sight could be treated as a non-linear feedback system which forms joint information from
tactile and visual receptive fields to associate sensory inputs with either an action or semantic meaning. Let’s revisit the piano
example to sketch out an intuitive thought process (for an experienced player) used to read a few notes from sheet music and
playing it on the piano. We look at a note and its octave (pitch), store alphabetical representation of the note in associative
memory (Hippocampus), access muscle memory for recalling the position of the new note on the keyboard (updated by neuronal
synaptic weights in the motor cortex by the current position of the hand’s difference from muscle memory), move hand to that
position, press down on the key. This first part of the loop involves recalling memory and carrying out an action which imposes
a condition to move on; if you don’t press hard enough to hear the note, push down harder until you can match your mental
conception of that note with the incoming sensory data from the piano. If this condition is met, our Somatosensory cortex sends a
4 Corpuscles: Nerve endings in skin.
Proc. of SPIE Vol. 8058 80581N-4
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
signal to muscles in the finger which played the key to release it. Once pressure sensors in our finger stop firing, we know that
the note has been played and can move on to the next note, looking at it, recalling its position, starting the process all over again.
Although this may not be how every piano player plays, it is almost certainly the way every person types their PIN
number into a computer keyboard (the analogous ‘notes’ are each number or letter of the PIN), or how some fire a weapon
(‘notes’ could be anticipated targets). For a user typing in a PIN, we can capture statistical data of the time spent on each key
(Touch time) and the time taken traversing between two keys (Air time). Assuming the neural pathway for the typical computer
user follows this trend, we could potentially infer from time series analysis other information from the time spent on each key.
We have observed that touch time is more or less a finger dependent constant through many trials, but it varies from person to
person. Touch time can be imagined similar to knowing when to remove your finger from the trigger after quickly shooting one
bullet. If Higher Order statistical independence (Kurtosis) could be measured in a recursive manner, network administrators
could be provided with an indication that the data is becoming more uncorrelated while the user is still typing their PIN. An air
time could be predicted as well with a recursive Artificial Neural Network approach. Due to the uncertainty of what finger
presses each key, predictions will not accurate until the derivative of the user’s kurtosis value approaches zero, meaning their PIN
typing routine is being accessed from their muscle memory. The predicted value in our ANN algorithm arises from a 3
rd
order
chaotic logistic mapping. These methods will provide a reliable solution to Keystroke Dynamics by incorporating fault tolerance;
every user’s typing behavior will vary, but perhaps within a range. Like the human working memory, we propose to save the
change of the changes between the next value collected and its prediction by quickly updating the weight matrix. If the weight
matrix update falls outside of the user’s norm, network administrators could again be notified. In the next section, we provide
derivations of both formulae and discuss experimental results in section 5.
4. MATHEMATICAL APPROACH
We want to compute the change in a human’s sensing. Thus, we will formulate a sequential update algorithm of our
sensing, including our ‘FIST’. We conjecture that upon each key press, the information (energy) being sent down the three
nerves in the arm through the wrist and into our five fingers is part of a larger signal that is modulated based on the distance that
the next key is away from the current one. When we say “identifying the typing” we are really trying to understand the spatio-
temporal encoding. The time it takes from one key to another, Air time, can be achieved with a variety of nerve combinations.
The neural pathways our brain uses to move our hand to different keys is described above. We can assume that over time we
learn the neural path taken to type a repetitive sequence of keys (a PIN number) to the point where it becomes part of our
memory. We can use recursive higher order statistics to observe when the weight between synapses converges to a stable value,
implying that something has been learned. Our dual approach is as follows:
4A - RECURSIVE STATISTICS OF FIST
We believe that KD is a representation of our nervous system’s motor control mechanism. Touch time may be
controlled by a feedback loop located in the vertebrae of our spinal cord which causes our finger to instantaneously release each
key pending sensory confirmation. We have derived a recursive formula to rapidly predict a user’s next touch time with
statistical moments up to the fourth order (kurtosis). A large scale implementation of a Keystroke Dynamics system must
account for multiple simultaneous user access attempts. Instead of storing a huge database of all past login times for statistical
referencing, one could quickly store and retrieve a trivial decimal number, and allow access based on whether or not the user is
within their own variance bound. The dynamics of an individual’s ‘fist’ while typing a Personnel Identification Number (PIN),
after the insertion of a Computer Access Card (CAC) may be derived. This optimism is due to the fact that an individual may
have a unique typing habit and muscle memory. Thus, this behavior might be captured by analyzing chaotic dynamics by
recording the time interval between each different key typed and the time for the duration of each key touched on the keyboard of
an individual’s PIN. While the computer verifies the degree of correctness for each PIN associated with the CAC, we will
provide a secondary soft biometric of typing habits as a potential way to ward off a hacker who possesses a CAC card and knows
the corresponding PIN.
To begin, we take the batch mode statistics of an individual in order to keep building accumulative statistics moments
as follows. We define a uniform weighted batched average of our data set to be the angular brackets
∑
Proc. of SPIE Vol. 8058 80581N-5
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
1
1
We first prove a useful Lemma of Recursive Averages to any m-th moments
1
1
1
2
Then, we can build in order all the lower moments sequentially, before the Kurtosis:
(i) Mean
1
3
1
1
1
(ii) Variance
Given:
4
Then,
.
(iii) Skewness
Given:
(5)
3
3
3
Then
3
. (C)
(iv) Kurtosis
Given:
3
(6)
4
6
4
3
,where the invariant remainder is
4
3
6
3
3
4
6
3
. (7)
Thus, for any batched mode N=1,2,3…,
, we have sequentially obtained the Kurtosis formula by the
recursion lemma:
(D)
Proc. of SPIE Vol. 8058 80581N-6
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
The method of attaining (A)(B)(C)(D) recursively in that order will provide an efficient and fast update of individual statistics.
However, if the update statistics (A-D)
N+1
are too much out the percentage norm .7 of the individual previous records (A-
D)
N
,
%
%
%
%
%
%
%
%
This set of percentage departures are tailored to an individual and may be a suitable warning signal for a potential attacker.
Either requesting the user to repeat typing their PIN or entry of their last four social security numbers are necessary to access of
the specific computer after warning signs. We have shown that Air Time is controlled by any of 15 combinations of nerves from
the left and right hands. What about touch time? We believe that since touch time is governed by a non-linear feedback system,
we must use a different method to unravel the underlying dynamics. Touch time seems to involve a feedback loop starting in sub
dermal sensory receptive fields, traveling up the spinal cord to the SMA for key press confirmation, then back to the finger to
release the key.
4B - ANN MODELING BASED ON SLOPE OF KURTOSIS, A 3RD ORDER LOGISTIC MAP
We assume that the duration of time spacing between keystrokes is specific and thus different to the individual PIN
owner and user(s). Namely, we assume that each individual typing habit may be governed by an underlying habitual probability
density function (h-pdf). Although we do not know the j-th PIN typed by the k-th finger, we can measure its effect at the i-th
time spacing between two consecutive keys typed:
;
;
(1)
Here, subscript is an index for the time interval between the jth and the j+1 pin.
is the median time for this case,
is
the time between the j-th and the j+1 pin. This may be characterized as a non-Gaussian behavior, which can be seen through
higher order cumulant statistics of the Kurtosis
3
0, known as a super-Gaussian multi-modal
image distribution or sub-Gaussian ‘speech-like’ Laplacian Levy distribution. Then, we further assume that the dynamics among
keystrokes which depart from an individual h-pdf are controlled by a generalized chaotic 1-D Feigenbaum logistic map of order
3. Any departure from the prediction may reveal a warning signal for a neurological disorder (i.e., Parkinsons, Carpal Tunnel).
With this formula, if the next value is predictable, we can compare the real next value with the prediction for five consecutive
times for one pin, 5 strikes and you’re out.
We may represent the combined wetware (human body) and hardware (computer) by its performance using an artificial neural
network (ANN) over consecutive time spacing. We wish to discover a unique and long term invariant memory of a specific PIN
number from a user. Thus we should sequentially acquire the execution timeline for every key stroke. To model the synaptic
weight memory
that controls the duration of the keystrokes and their time spacing fluctuation in powers
,
and
we
apply an iterative learning approach of the fluctuation of duration time as follows.
,
; i=1,2,3,…,m-1, (2)
Define the combined weight matrix element as follows:
,,,
(3)
…
,
(4)
Proc. of SPIE Vol. 8058 80581N-7
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
,
1
1
. (5)
Then, we can rewrite m-batch mode result as follows:
…
1
1
…
(6)
And obtain the result:
…
1
1
…
, (7)
where the inverse of a non-squared matrix may be done with Penrose-Moore Pseudo-Inverse defined to achieve the LMS
estimate.
1
1
1
1
1
1
1
1
(8)
Furthermore, we wish to have a sequential update algorithm of the weight vector which is suited for keystroke entry. Thus, we
add one more data point to the batch mode matrix [A] and adopt Schur’s complement lemma for a sub-matrix inversion.
1
1
(9)
The formula is reduced to a familiar inversion when a single element exists each sub-matrix
(10)
Again, we apply Penrose-Moore pseudo-inverse formula to each group of sub-matrices. When this is done, then we get a new
weight vector
…
1
1
…
(11)
Where
is the predicted value from the logistic map.
(12)
From this, we can predict the next fluctuation spacing
using
% (13)
We can allow five consecutive accumulated errors to either prompt a retyping of the PIN or demand additional information such
as a four digit social.
Proc. of SPIE Vol. 8058 80581N-8
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
5. EXPERIMENTAL RESULTS
We limited our data to include 3 different PIN numbers from two users, providing about 300 trials for each PIN. All trials for
each PIN was typed in the same day, different days for subsequent PIN numbers. Time capture software was written in-house
with Java, implementation of the above theorems and graphs were produced with MatLab. The first user used all fingers on their
right hand to type each pin on the number pad on the right side of the keyboard. The second user used one finger on each hand to
type all three PINs on the horizontally positioned numbers in the middle of the keyboard. For future experiments it would be
nice to incorporate newer keyboards with pressure sensors. These sensors could reveal further information about the time series
data, and could be another soft biometric characteristic.
Fig. 4 ~ Statistical graphs for 2 users with the same 6 digit PIN. a) Recursively computed mean, variance, skewness, and kurtosis.
(one digit from Trial 1). b) Derivative of Kurtosis (for every touch time digit in Trial 1). c) Difference between predicted and actual
values for each Air time (1-5)
From above, we observe that the predicted value versus the actual value became more accurate as the derivative of
kurtosis approached zero for a given air time. By taking the mode of touch time values, we observed a biological linkage
between different nerves and coincided with the approximate firing rate mentioned earlier (1/15 sec.) We also noticed that the
each predicted Air time seemed to approach the actual value in increments of about 50 trials, implying that implementation of
ANN predictions for each digit in the PIN would have to wait for each key transition to become a part of the user’s memory.
This may be discovered upon a near zero value when comparing predicted and actual times, where the error margin could be
determined by the variability of sequential statistical moments.
Jeffrey
Quang
Proc. of SPIE Vol. 8058 80581N-9
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
6. CONCLUSION
Touch time was very stable time for both users, depending on which key was pressed. Air time was fairly consistent
for all times of user 1, varying only between new 6-digit PINs. User 2 was fairly consistent over time for separate keys, but had
more outliers. It would be interesting if an outlier in air time represented a change in the hand used to press the key. Perhaps
user 1’s consistent use of one hand explains the absence of outliers. The slope (derivative) of the sequential kurtosis from user
1’s non-linear, curve approaches zero. The slope of User 2’s graphs had a more linear appearance, where a zero derivative is not
approached as rapidly. We believe there is a correlation between (i) the slope of kurtosis in Air Time and/or Touch time and (ii)
the error margin of the predicted time vs. the actual time. Comparing the trial number for (i) and (ii) may indicate that the
number of required entries before accurate predictions vary between users. A non-zero kurtosis value with a derivative
approaching zero may indicate that our brain has added the PIN number to memory, now accessible by muscle memory. When
predictions become viable, FAR/FRR can be further reduced by a secondary prompt, perhaps asking the user to provide a social
security, telephone, or some other number assumed to be memorized. These numbers have a separate muscle memory space in
the brain, likely containing a different set air times. Future experiments should explore the link of muscle memory to visual
perception. Muscle memories of physical reactions might be strengthened by visual stimulus. Perhaps Keystroke Dynamics can
serve as a metric of measuring one’s reaction time to imagery, and over many trials reveal the variability between individual
cross-sensory correlation speed, and what can decrease the time of memory retrieval and execution. We can utilize a Turing-like
system to sharpen the statistical boundary with an iterative process [4]. Age may play a big role in this variability, which has
implications for biomedical wellness applications. Could we extend statistical variability of habitual typing to both wellness
monitoring and Network security? Our results indicate that a departure from predicted typing times may indicate a change in
physiological state when a PIN is assumed to be part of muscle memory. Our new approach to KD may prove useful to the
medical industry and pave the way for neurological ground truth. Only time will tell.
ACKNOWLEDGEMENTS: This work was funded by the 2010-2012 ILIR program, supported by US Army NVESD.
References:
1) Checco, J. C. (2006). Keystroke dynamics & corporate security. Retrieved August 21,
2006 from http://www.wsta.org/publications/articles/1003_article06.html
2) Cooper, DC; Ellenberger, H.; Ballanyi, K; Richter, D.; Feldman, J. (2002). "The significance of action potential bursting in the brain
reward circuit". Neurochemistry international 254 (5032): 726–9
3) Monrose, Fabian, and Aviel Rubin. "Keystroke Dynamics as a Biometric for Authentication." Future Generation Computer Systems 16.4
(2000). Print.
4) Von Ahn, Luis, Benjamin Maurer, Colin McMillen, David Abraham, and Manuel Blum. "ReCAPTCHA: Human-Based Character
Recognition via Web Security Measures." Science 321.5895 (2008): 1465-468. Print.
5) GEORGOPOULOS, APOSTOLOS P., GIUSEPPE PELLIZZER, ANDREW V. POLIAKOV, and MARC H. SCHIEBER. "Neural Coding
of Finger and Wrist Movements." Journal of Computational Neuroscience 6.3 (1999)): 279-88. Print.
6) Kapczyński, Adrian, Paweł Kasprowski, and Piotr Kuźniacki. "Modern Access Control Based on Eye Movement Analysis and Keystroke
Dynamics." Proceedings of the International Multiconference on ISSN 1896-7094 Computer Science and Information Technology (2006):
477-83. Print.
7) Rehmeyer, Julie J. "Digital Fingerprints: Tiny Behavioral Differences Can Reveal Your Identity Online." Science News 171.2 (2007): 26.
Print.
8) Jenkins, Jeffrey C., and Harold H. Szu. "Recognizing Foreground-Background Interaction." Proceedings of the SPIE: Independent
Component Analyses, Wavelets, Neural Networks, Biosystems, and Nanoengineering VIII 7703 (2010). Print.
9) Swadlow, H; A Gusev, T Bezdudnaya (2002-01-01). "Activation of a cortical column by a thalamocortical impulse". Journal of
Neuroscience 22 (17): 7766–7773.
10) Cooper, DC; S Chung, N Spruston (2005-06). "Output-mode transitions are controlled by prolonged inactivation of sodium channels in
pyramidal neurons of subiculum". PLOS Biology 3 (6): 1123
Proc. of SPIE Vol. 8058 80581N-10
Downloaded From: http://spiedigitallibrary.org/ on 07/08/2015 Terms of Use: http://spiedl.org/terms
