One small step for a man
One Giant leap for the mankind

There is no wealth like Knowledge
                            No Poverty like Ignorance
Journal of Emerging Trends in Computing and Information Sciences Logo

Journal of Emerging Trends in Computing and Information Sciences >> Call for Papers Vol. 8 No. 3, March 2017

Journal of Emerging Trends in Computing and Information Sciences

An Anomaly Detector for Keystroke Dynamics Based on Medians Vector Proximity

Full Text Pdf Pdf
Author Mudhafar M. Al-Jarrah
ISSN 2079-8407
On Pages 988-993
Volume No. 3
Issue No. 6
Issue Date June 01, 2012
Publishing Date June 01, 2012
Keywords keystroke dynamics, anomaly detector, detection performance, and authentication


This paper presents an anomaly detector for keystroke dynamics authentication, based on a statistical measure of proximity, evaluated through the empirical study of an independent benchmark of keystroke data. A password typing-rhythm classifier is presented, to be used as an anomaly detector in the authentication process of genuine users and impostors. The proposed user authentication method involves two phases. First a training phase in which a user typing profile is created through repeated entry of password. In the testing phase, the password typing rhythm of the user is compared with the stored typing profile, to determine whether it is a genuine user or an impostor. The typing rhythm is obtained through keystroke timings of key-down / key-up of individual keys and the latency between keys. The training data is stored as a typing profile, consisting of a vector of median values of elements of the feature set, and as a vector of standard deviations for the same elements. The proposed classifier algorithm computes a score for the typing of a password to determine authenticity. A measure of proximity is used in the comparison between feature set medians vector and feature set testing vector. Each feature in the testing vector is given a binary score of 1 if it is within a proximity distance threshold from the stored median of that feature, otherwise the score is 0. The proximity distance threshold for a feature is chosen to be the standard deviation of that feature in the training data. The typing of a password is classified as genuine if the accumulated score for all features meet a minimum acceptance threshold. Analysis of the benchmark dataset using the proposed classifier has given an improved anomaly detection performance in comparison with results of 14 algorithms that were previously tested using the same benchmark.  


    Journal of Computing | Call for Papers (CFP) | Journal Blog | Journal of Systems and Software | ARPN Journal of Science and Technology | International Journal of Health and Medical Sciences | International Journal of Economics, Finance and Management     
© 2015 Journal of Computing