Enhanced Authentication System Performance Based on Keystroke Dynamics using Classification algorithms

Abstract

Nowadays, most users access internet through mobile applications. The common way to authenticate users through websites forms is using passwords; while they are efficient procedures, they are subject to guessed or forgotten and many other problems. Additional multi modal authentication procedures are needed to improve the security. Behavioral authentication is a way to authenticate people based on their typing behavior. It is used as a second factor authentication technique beside the passwords that will strength the authentication effectively. Keystroke dynamic rhythm is one of these behavioral authentication methods. Keystroke dynamics relies on a combination of features that are extracted and processed from typing behavior of users on the touched screen and smart mobile users. This Research presents a novel analysis in the keystroke dynamic authentication field using two features categories: timing and no timing combined features. The proposed model achieved lower error rate of false acceptance rate with 0.1%, false rejection rate with 0.8%, and equal error rate with 0.45%. A comparison in the performance measures is also given for multiple datasets collected in purpose to this research.

1. Introduction

Nowadays, mobile technologies are developing in fast manners. The mobiles continue tosuffer from high security risks. These days most internet activities are being done through mobile devices. It is well known that the common way to authenticate users is using passwords [1-3]. While the techniques using password is not enough since it is subject to be guessed, stolen or forgotten and many other problems. Therefore, we are in a need to introduce anadditional authentication technique that could strengthen the password [1][2].

Multiple techniques were provided in the literature; second factor authentication is al ready applied and used to strengthen the authentication mechanism and enhance the security. It iscommonly known that authentication using biometric is expensive to establish; as we needextra hardware and inapplicability through internet. This made the behavioral based systemsone of these cheap and easy to establish this mechanism through internet [3][4].

Keystroke dynamics (KSD) is one of these behavioral based systems. In which it is stated that the typing behavioral of users is should be unique. Is it possible to establish authenticationsystems that relying on the typing behavior of their users.

This study introduces the use of KSD on android touch screen mobile devices. We have proposed a programmed prototype for a software keyboard application, which developedespecially for collecting timing and non-timing information. This prototype enables users totype freely any designated text consisted of any complex combination, which consists of text, numbers, and special characters. Our proposed method collecting a combination of various features; they are mainly divided in to two main categories: timing and non-timing featured. Using neural networking and machine learning models, we successfully classified users based on their typing. Different experiments will be implemented using timing and non-timing features. Proofing that the KSD is providing a significant role in authenticating user & rsquo;sperformance based on their typing behavior.

This paper is ordered as the following, Section two will highlight the background. Techniques and methods will be proposed in section three. Experiments and results will bediscussed in Section four and conclusion will be proposed in Section five.

2. Related Work

Authentication is simply the process of determining whether someone is the one whodeclared to be for the system [3][4]. User authentication could be achieved by using many techniques; something that the user knows (e.g., password), carries (e.g., credit card), or has (e.g., iris); and recently, a new mechanism for user authentication is based on how he/she behaves (e.g., typing behavior) [5].

Multiple features could be extracted from tying behavior. Timing and non-timing features are known in these systems. These features are characterized by up and down events. The Events recording in which when and how each key on the keyboard is pressed or released. Collecting features during typing could be statically collected or dynamic. Static collection could be done by storing predefined profile of typing in a database that could be used later incomparisons between the predefined typing text and the stored profile. While dynamic one is continuous authentication is dynamically setting the profile of users during their typing [5][6].

Multiple methods and techniques were provided in the literature to classify users typing behavior; statistical mechanisms were used early to classify users. Using the mathematical equations is somehow good but not sufficient. Neural networks and machine learning techniques were also proposed. The better method was the less error that gotten from the system [6][7].

2.1 KSD Features

Typing behavior is about collecting typing user behavior by extracting features during usertyping on keyboards. These features are divided into two main categories timing and non-timing features [4-13].

Timing Features: The events time in which user press or release the key on the keyboards. They can be extracted with a special timer on keyboard, which pick up when a key is pressed and/or released [8][9]. There are two main event times: pressing time which is the time stamprecorded when the key is held down (D) and releasing time: which is the timestamp recorded when the key is released up (U). So, the timing features are extracted by capturing all timestamps of each event. These events could be consecutives of two or more events. The simplest two consecutive events could be one of the following combinations (Down-Up, Up-Up, Down-Down, and Up-Down) [4-9].

Non-Timing Features: These are related for and other non-related timing features; such as finger pressure, finger position on the screen, as well as the size of key surface touched by finger, typing speed, …, etc. For every key pressed or released and based on touch screen properties, we can extract many other features such as finger placement angle, finger identifier (which finger used to type), …, etc. [9-13].

2.2 Performance measures

Like any authentication system, we need a performance measures to evaluate and compareany two or more systems. The classification capabilities could be compared based on performance of the system each time the user access to the system. Based on the literature we have the following measures: 

• False Rejection Rate (FRR) describes the percentage of true users of the system, which is rejected by wrong classification of their features. This measure is known in statistics as Type I error [6][8].
• False Acceptance Rate (FAR) describes the percentage of false users of the system that is accepted by wrong classification of their features. This measure is known in statistics as Type II error [2][8].
• Equal Error Rate (EER) is the most used performance measure of biometric systems in the literature is the EER. It describes the state of the system where percentage of true users of the system who are rejected by wrong classification of their features (FRR), and the percentage of false users of the system who are  accepted by wrong classification of their features (FAR) are being equal. As the all describing an error rate the lower of these values the better performance of the system [3-11].

2.3 Benchmarking, datasets, and challenges

A number of studies have been performed in the area of keystrokes analysis since it is founded on the field of biometric based systems [10-15]. Many authors proposing good contribution trials for existing unique datasets benchmarks [14][15]. It was difficult tocompare the performance among different researches based on KSD, so different public datasets were published in this field to provide one unique evaluation research based on onereference. These datasets can be used by the community to evaluate researches results and asses in comparative analysis [16][17]. The first public dataset benchmark was coined by the Carnegie Mellon School (CMS) in 2009. It is well known by CMU-Keystroke Dynamics dataset, since they introduced their dataset for timing information only for personal computers and regular keyboards. Much other non-timing information was not included [18].

KSD used in the literature for more than twenty years [19]; and their analysis shown a promising performance with novel results. For example, the authors in [19] got 0% errors inauthentication systems by using timing information only. Their datasets were built by theirown and based on KSD derived from regular keyboards in personal computers. A dedicated dataset for mobile and touch screen devices are still few in literature and they were not covering all the provided non-timing features we mentioned in the literature. So, we are in badneeds for public touch screen devices benchmarks [20-28].

2.4 Typing rhythm mode

Based on the literature, the various researches were being classified upon the typing rhythm test mode; static and dynamic.

Static text: in which the user typing is being predefined during typing trials. This method isearly determined a predefined text that the user asked to type multiple times [3]. Changing thetext each time implies repeating enrollment process for the user to the system. Although this procedure was a robust technique in most researches, the continues security is not provided here. Any change in the text typed by a user, the overall procedure for building the user profile will be repeated from scratch [4].

Dynamic text: these dynamic modes are situations that are more real, as the user was being freely typing on the keyboard. This text mode verification sometimes called a continuousauthentication in literature as the systems can classify the behavior of a user, whatever the textwas being typed [1-8].

2.5 KSD Analysis Approaches

KSD analysis approaches can be based on the extracted features. These features arecategorized into timing and non-timing categories. Behavioral authentication features can beextracted, preprocessed, and measured in multiple experimental methods, such as using the statistical techniques and could be carried on static text and dynamic text. Other techniques are the neural networks (NNs), which could be also carried on static text as well as dynamic text. Analyzing these features in extensive and efficient manner will maximize soon the performance of authentication in computerized systems [6].

In Table 1, we have summed up the latest researches done in the literature. Each research chosen were being done using mobile devices with touch screen and Android operating systembased. The classification was being divided upon multiple criteria’s such as the features were being used, the text mode and the classification techniques. The reported results of the performance measures use the measure (EER), which was the common measure between all reported results.

Table 1. Performance comparisons between recent studies.

3. KSD Methods and techniques

3.1 Authentication phases Implementation

To authenticate users using KSD on mobile phones, we have implemented our procedure into two important phases [6-9]. The first phase, called the enrollment; which sometimes called the profile building in the literature. The typing rhythm was being collected in many trials tochoose the most similar profile for the user typing behavior. In this phase, the user asked to enter many trials (i.e 10 times) and the average of the data is collected and stored in the databaseas user signature. In the enrollment phase, it is good to note that many researches were excluded the first two trials for typing, as the users want some time to feel familiar with the designated keyboard. Outlier’s signature resulted from varied typing behavior for the user at each trial. These outliers are most likely to appear at the beginning of typing trials.

The second phase is the actual authentication process. Here, the user asked again to type his cadential to be compared and matched with the stored one. At each time the user authenticated, he/she asked to enroll few times to the systems to be compared with the stored profile in the database. Enrollment and Authentication phases are described in Fig. 1 and Fig. 2 respectively [11][12].

Fig. 1. Enrollment phase [13]

Fig. 2. Authentication phase [13]

3.2 System design interface

To provide our KSD based system, we have developed a software virtual keyboard, that being installed easily on each device used to authenticate users. This keyboard was dedicated for all Android platform mobile devices with touch screen. All the Experiments in this research were performed using Sony Xperia tablet Z, and with Android version (5.1.1).

Fig. 3 describes the developed interface for the application and the soft keyboard. The keyboard enable users to type text (A-Z) (a-z), numbers (0-9), and special characters such as (!@#$%^& *) and others [13].

Fig. 3. KSD application interface [13]

In Table 2, we have summed up the main Android call functions that used in developing the soft keyboard. Each call was dedicated to extract one feature at each Key Up and Key Down events.

Table 2. Function calls events for Android System [13]

3.3 Neural network classifier (NN)

Multilayer Perceptron (MLP) is one of the chosen classifiers that being used in this research. A feed forward neural network classifier maps sets of input data onto a set of outputs. Thestructure of MLP consists of multiple layers and each layer consisted of multiple nodes [13][22]. MLP has main features such as:

a. Layers

The MLP consists of three or more layers. MLP usually used as a fully connected network(mesh). Each node, applying some weight on the input and propagate the result to the next layer [13]. The number of nodes should be determined each time we carried out the experiment. Thenotation of MLP classifier (x,y,z) represents the number of neurons in each layer with threelayers structure. For example, if we used the notation MLP (10, 10, 20) to represent MLPstructure; then we have three layer with 10, 10, and 20 nodes in each layer respectively.

Fig. 4. MLP classifier architecture [24]

Fig. 4 shows MLP simplest architecture with one hidden layer. This simplest architecture was used in this paper. The left side represents the input layers where the features are inserted to the classifier, the middle part is the hidden layer and the right side represents the output of the classifier. In this work, the architecture was extracted from WEKA tool. We have used it in this paper.

b. Weights

Weights are being configured initially in random way, then, they should be adapted using the training set that flows from input layers to the output layer in the network. They continued to be adapted until we reach a specific error threshold. There are many other parameters such as gradient, momentum (value should be between 0 and 1, while the default value always = 0.2), and learning rate (value should be between 0 and 1, while the default value = 0.3) they areaffecting the behavior of MLP classifier [22]. Fig. 5 describes the flow of the MLP algorithm in Pseudocode.

Fig. 5. MLP classifier Pseudo code [25]

3.4 Decision Trees

Decision Trees and Random Trees providing a simple and fast way of learning a function that maps data x to outputs y, where x can be a mix of categorical and numeric variables and y can be categorical for classification, or numeric for regression. A Decision Tree is a tree (and atype of directed, acyclic graph) in which the nodes represent decisions (a square box), random transitions (a circular box) or terminal nodes, and the edges or branches are binary (yes/no, true/false) representing possible paths from one node to another [28-36]. The specific type of decision tree used for machine learning contains no random transitions. To use a decision treefor classification or regression, one grabs a row of data or a set of features and starts at the root, and then through each subsequent decision node to the terminal node. The process is very intuitive and easy to interpret, which allows trained decision trees to be used for variableselection or more generally, feature engineering [28-36]. Fig. 6 describes the simple randomforest (RF) architecture. Fig. 7 describes the pseudocode of the classification algorithm.

Fig. 6. RF classifier architecture [26]

Table 3. Trees Classifier important parameters [28]

Random forests (RF): it is the generalized form of random tree or decision tree. It is known from the literature that it is more efficient than the random trees. At each candidate tree, it is doing a split in the learning process, with a random subset of the features. This processsometimes is called "feature bagging". If one or a few features are very strong predictors in the classification decision for the target output, these features will be selected in many of the generated trees, causing them to become correlated and dominated in the forest domain. Thestronger features are, the less error for classification results will be gotten. Main features are described briefly in Table 3 [28-30]

Fig. 7. RF classifier Pseudocode [27]

4. Experimental Classification Results and Analysis

These analyses examined the KSD use as a behavioral authentication in multiple experiments. The study focused on enhancing security level and strengthening access controlusing artificial neural networking model based on MLP, random tree and random forest classifiers. The proposed work was trained and tested using real dataset samples we have collected and stored in several datasets [13].

4.1 Experiment one

The main goal for this experiment is to examine the training factor effect of the user on his/hertyping behavior performance measures. We highlighted this by finding out the relationship between the learning rate of the model and the training factor improvement of the user (this would be implemented in the experiment by the trials numbers). The classification capability of the model is a good indication of the model in this experiment to reach the desired goal. Experiment setup details are described in Table 4. We have conducted the experiments t wice. Each time, we have changed the trial numbers of typing for volunteers. The first session was conducted with 10 trials and the second one was with 30 trials.

Table 4. Experiment 1 setup

Table 5 provides KSD performance measures in term of error ratios such as FRR and FAR. Comparative analyses of performance measures for experiment in two sessions are provided. Fig. 8 clearly describes that the training factor has a significant role in the classification capability of the model. It is clear that the classification with respect of True Positive (TP) isimproved in the second session and the error rate measured in FAR, FRR and EER. EER is decreased by increasing the training factor for each user.

Table 5. Experiment 1 result using our random datasets

Fig. 8. Experiment 1 results

4.2 Experiment two

In this experiment, seven volunteers were asked to type multiple complex passwords. We have improved user’s behavioral performance of typing on KSD keyboard more and more; by providing multiple complex passwords’ templates. We used complex passwords combinationsin our work to reflect the nature of typing real password in a public application. Userssometimes feeling confused to write their real passwords for testing experimental work. We have many users didn’t accept typing their real passwords even for research use, while others were being comfortable to share some of their password’s combinations to public. Many applications on the internet forced users to use complex passwords combinations. Thesecombinations were provided with passwords templates as shown in Table 6. Note that we have used the same experiment 1 setup for this experiment also.

Table 6. Experiment 2 setup

In this experiment, the MLP classifier reached a significant performance levels in term of (EER). This is clearly described in Table 7 for higher trials provided by the users. See Fig. 9which describes experiment 2 results.

Table 7. Performance measures for experiment 2

Fig. 9. Experiment 2 results

4.3 Experiment three

In this experiment, we have raised the training factor of the MLP classifier for comparative analysis manners. Although, this will increase the cost of the implementation of the classification, we still have the chance to propose the model implementation with minimum typing effort provided from the volunteer’s side. They have really feeling annoyed to type many times of the same template more than thirty times. We have deduced the analysis to dosome tradeoff system implementation issue. The new learning factor is increased to be (0.5) and the momentum is (0.4). The reduction in error rate was noticed in the new obtained results. The reduction in experiment 1 is highlighted in Table 8 and Table 9.

Table 8. Performance measures comparisons for experiment 1

The second experiment was also being deduced using the new learning rate, and the error rate was reduced as highlighted in Table 9.

Table 9. Performance measures comparisons for experiment 2

4.4 Experiment four

In this experiment, we used the tree classifiers for comparative analysis manners. W deduced the analysis to do some performance improvements. The implementation carried outaccording to specific configurations summed up in Table 10. The result of experiment 4 ishighlighted in Table 11.

Table 10. Experiment 4 setup

The fourth experiment was also being deduced using the new classifier and the error measures were reduced to significant rates as highlighted in Table 11.

Table 11. Performance measures for experiment 4

This paper presents a novel technique for authenticating users using KSD based systems. Combining timing and non-timing features together, using several non-timing features. The proposed model (RF) achieved lower error rate of false acceptance with 0.1%, false rejection with 0.8%, and equal error rate with 0.45% compared to previous results of using MLP. Theseanalyses were carried out on the same dataset and same selected features. We also, provided the use of strong complex passwords in static text mode. This complex combination is being more real and reflecting the nature of passwords templates being recommended to be used inauthentication systems via applications on the internet.

Classifiers such as MLP provided good results. However, despite its power against largerand more complex datasets, they are extremely hard to interpret, and neural nets can take many iterations and hyper parameter adjustments before a good result is achieved. As well, one of the biggest advantages of using Decision Trees and Random Forests is the ease in which we can see what features or variables contribute to the classification or regression and their relative importance based on their location depth wise in the tree.

We have summed up our results in the last experiments as shown in Fig. 10. This figureshows that we provided a good promise for using and implementation an authenticationsystem based on KSD using the random tree and forest classifiers. The RF reached a minimum EER in this experiment when the user provided nine trials for training set.

Fig. 10. Summarizing the experiments result

In addition, we have summed up our results to be compared with other researches have done in the literature. Although there was a shortage of available similar studies carried out using common techniques, feature extraction, or password combination, we still have the ability tocompare the available similar techniques. Table 12 described the comparison between multiple researches from different perspectives. We have reached significant performance improvement and achieved lower error rate when comparing our technique with similar ones.

Table 12. Performance measures for recent researched based on KSD

5. Conclusion

This research proposed the use of KSD based as a second factor authentication for mobile users and smart phone devices. Besides the cheap cost provided by KSD since no extrahardware were installed, the KSD provides a significant performance for authenticating remoteusers through internet applications. This performance with acceptable level in performance as a second factor authentication model. The contribution of using the Timing and Non-timing infeatures in our analysis improved the security level for the authentication systems.

Many datasets were being provided in the literature but the benchmarking needs in this fieldis major issue in these type of researches in order to provide a way to do fair comparative analysis among researches. The CMU benchmark exists so far which is not afforded to mobile devices; because it targets personal computers with classical physical keyboards only with timing features. We are in a bad need to find, build a benchmark dataset that targets the touch screen devices, so we can make fair comparative analysis among researches.