TypeNet: Deep Learning Keystroke Biometrics

Abstract

We study the performance of Long Short-Term Memory networks for keystroke biometric authentication at large scale in free-text scenarios. For this we introduce TypeNet, a Recurrent Neural Network (RNN) trained with a moderate number of keystrokes per identity. We evaluate different learning approaches depending on the loss function (softmax, contrastive, and triplet loss), number of gallery samples, length of the keystroke sequences, and device type (physical vs touchscreen keyboard). With 5 gallery sequences and test sequences of length 50, TypeNet achieves state-of-the-art keystroke biometric authentication performance with an Equal Error Rate of 2.2% and 9.2% for physical and touchscreen keyboards, respectively, significantly outperforming previous approaches. Our experiments demonstrate a moderate increase in error with up to 100,000 subjects, demonstrating the potential of TypeNet to operate at an Internet scale. We utilize two Aalto University keystroke databases, one captured on physical keyboards and the second on mobile devices (touchscreen keyboards). To the best of our knowledge, both databases are the largest existing free-text keystroke databases available for research with more than 136 million keystrokes from 168,000 subjects in physical keyboards, and 60,000 subjects with more than 63 million keystrokes acquired on mobile touchscreens. I. INTRODUCTIONKeystroke dynamics is a behavioral biometric trait aimed at recognizing individuals based on their typing habits. The velocity of pressing and releasing different keys [1], the hand postures during typing [2], and the pressure exerted when pressing a key [3] are some of the features taken into account by keystroke biometric algorithms aimed to discriminate among subjects. Although keystroke biometrics suffer high intra-class variability for person recognition, especially in freetext scenarios (i.e. the input text typed is not fixed between enrollment and testing), the ubiquity of keyboards as a method of text entry makes keystroke dynamics a near universal modality to authenticate subjects on the Internet.Text entry is prevalent in day-to-day applications: unlocking a smartphone, accessing a bank account, chatting with acquaintances, email composition, posting content on a social network, and e-learning [4]. As a means of subject authentication, keystroke dynamics is economical because it can be deployed on commodity hardware and remains transparent to the user. These properties have prompted several companies to capture and analyze keystrokes. The global keystroke biometrics market is projected to grow from $129.8 million dollars (2017 estimate) to $754.9 million by 2025, a rate of up to 25% per year 1 . As an example, Google has recently committed $7

A Survey of Privacy Vulnerabilities of Mobile Device Sensors

“…From these raw data, it is possible to extract more complex features, such as the hold time, inter-press time, inter-release time, etc. [11]. In addition to keystroke, touchscreen panels significantly enlarged the input data space including touch data.…”

Mobile behavioral biometrics for passive authentication

“…Regarding touch data information it is worth mentioning several studies in the literature. Taking into account keystroke gestures, Acien et al proposed a Long Short-Term Memory (LSTM) RNN network for authentication at large scale in free-text scenarios, evaluating different loss functions (softmax, contrastive, and triplet loss), number of gallery samples, length of the keystroke sequences, and device type (physical vs touchscreen keyboard) [7]. They obtained an EER of 9.2% for touchscreen keyboards.…”

“…In contrast, on the one hand, gesturebased related studies take into account unimodal systems [7,16,17,18,19,20,21]; on the other hand, related studies based on DL models for multimodal behavioral biometrics do not have a specific focus on human gestures [26,27]; ii) we analyze the information captured by the touchscreen in combination with simultaneous background sensor data to exploit the complementarity between taskdependent features and background sensors features (accelerometer, gravity sensor, gyroscope, linear accelerometer, magnetometer). Interaction database), a novel and public database comprising more than 5GB from a wide range of mobile sensor data acquired under unsupervised scenario for user passive authentication [30].…”

“…CA on mobile devices can be achieved by employing behavioral biometrics. All the means that enable or contribute to differentiating between individuals throughout the way they perform activities such as gait, typing, scrolling, etc., can be ascribed to such category [7]. They have been also explored in conjunction with physiological biometrics in particular circumstances, such as placing a call [8], or during the entry-point authentication process [9].…”

Biometric Identification Based on Keystroke Dynamics

“…Finally, in [24], the authors presented an LSTM-based network that was trained to convert keystroke data into embeddings the way that the embeddings collected for the same person are similar when the Euclidean distance between them is calculated. The method was successfully tested for a very big dataset containing data collected from thousands of users.…”