Effects of User Habituation in Keystroke Dynamics on Password Security Policy

Abstract

Access control systems rely on a variety of methods for authenticating legitimate users and preventing malicious ones from accessing the system. The most commonly used system is a simple username and password approach. This technology has been the de-facto standard for remote authentication applications. A username-password based system assumes that only the genuine users know their own credentials. However, breaching this type of system has become a common occurrence in today's age of social networks and modern computational devices. Once broken, the system will accept every authentication trial using compromised credentials until the breach is detected. In this paper, we explore certain aspects of utilizing keystroke dynamics in username-password based systems. We show that as users get habituated to typing their credentials, there is a significant reduction in the variance of the keystroke patterns. This trend is more pronounced for long and complex passwords as opposed to short dictionary based passwords. We also study the time window necessary to perceive habituation in user typing patterns. Furthermore, we show that habituation plays a key role in classification of genuine login attempts by reducing the equal error rate (EER) over time. Finally, we explore an authentication scheme that employs the security of complex passwords and keystroke dynamics.

Contributions to empirical analysis of keystroke dynamics in passwords

“…Moreover, if we take for training the very first samples (1)(2)(3)(4)(5), instead of samples from 196 to 200 (where we believe the user got used to the password), the resulting EER increases from 5.6 ± 1.3% to 35.2 ± 5.5% . A related conclusion was put forward by Syed et al [22] concerning the significant improvement of classifiers rebuilt after users were habituated to the password.…”

“…This heuristics is in agreement with empirical conclusions presented by Giot et al [9], according to which "it is better to choose passwords based on short, simple and known words". Indeed, habituation/familiarity of the keyed string was also considered as a relevant factor in other works, such as [6,17,18,22].…”

Keystroke and Touch-dynamics Based Authentication for Desktop and Mobile Devices

“…The Bayes classifier [16], hidden Markov [15], Gaussian mixture [36] and k -nearest neighbor models [37] have been explored, as have different distance measures in [35,46]. More recently neural networks [60,61,52], Support Vector Machines [72,81], and ensemble learning through random forests [6,73] have also been studied.…”

“…The physical characteristics of keystroke dynamics, such as keyboard layout [76], habituation [73,4,43,44] and model update techniques [44,43,4] received increased attention. In [73] the authors theorized that habituation was dependent on the type of password and could be leveraged for building more effective classifiers through the reduction of Equal Error Rates (EER). However, the study was confounded by the presence of larger training samples and lacked a rigorous statistical analysis of the effect of habituation over time.…”

“…Further research is needed to determine whether the best performing algorithms are robust to noise. In a related behavioral biometrics domain (keystroke dynamics) it has been shown that user habituation affects classifier performance [73]. It is likely that this phenomenon affects the performance of mouse dynamics based authentication too.…”