Keystroke Dynamics - Authentication Versus Identification

Authentication Versus Identification

Keystroke dynamics is part of a larger class of biometrics known as behavioral biometrics; their patterns are statistical in nature. It is a commonly held belief that behavioral biometrics are not as reliable as physical biometrics used for authentication such as fingerprints or retinal scans or DNA. The reality here is that behavioral biometrics use a confidence measurement instead of the traditional pass/fail measurements. As such, the traditional benchmarks of False Acceptance Rate (FAR) and False Rejection Rates (FRR) no longer have linear relationships.

The benefit to keystroke dynamics (as well as other behavioral biometrics) is that FRR/FAR can be adjusted by changing the acceptance threshold at the individual level. This allows for explicitly defined individual risk mitigation–something physical biometric technologies could never achieve.

Another benefit of keystroke dynamics: they can be captured continuously—not just at the start-up time—and may be adequately accurate to trigger an alarm to another system or person to come double-check the situation.

In some cases, a person at gun-point might be forced to get start-up access by entering a password or having a particular fingerprint, but then that person could be replaced by someone else at the keyboard who was taking over for some bad purpose. In other less dramatic cases, an employee might violate business rules by sharing his password with his secretary, or by logging onto a system but then leaving the computer logged-in while someone else he knows about or doesn't know about uses the system. Keystroke dynamics is one way to detect such problems sufficiently reliably to be worth investigating, because even a 20% true-positive rate would send the word out that this type of behavior is being watched and caught.

Researchers are still a long way from being able to read a keylogger session from a public computer in a library or cafe somewhere and identify the person from the keystroke dynamics, but we may be in a position to confidently rule out certain people from being the author, who we are confident is "a left-handed person with small hands who doesn't write in English as their primary language."