![](bg2.png)
In Section 2 a problem statement is provided to-
gether with a discussion of current issues with respect
to keystroke continuous authentication. This is fol-
lowed. in Section 3, with some definitions and pre-
liminaries concerning the proposed model. Section
4 then discusses the proposed process for finding the
similarity between keystroke sinusoidal signals, while
Section 5 presents the proposed KCASA model. The
evaluation of the proposed approach is given in Sec-
tion 6. Finally, the paper is concluded with a summary
of the main findings, and some recommendations for
further work, in Section 7.
2 PREVIOUS WORK
The fundamental approach of using keystroke dy-
namics for user authentication is founded on two
keystroke timing features: (i) key hold time (KH
t
),
the elapsed time between a key press and a key re-
lease; and (ii) flight time (F
t
), the time between n
consecutive key presses (releases), also sometimes
referred to as flight time latency or simply latency
(Obaidat and Sadoun, 1997). Both can be indexed
using either a temporal or a consecutive numeric ref-
erence. Whatever the case, both flight time and hold
time can be used to construct a distinctive typing pro-
file associated with individual users (Gaines et al.,
1980). These profiles are typically encapsulated using
a feature vector representation of some form. In other
words, typing profiles are frequently constructed us-
ing vectors of statistical values, such as the average
and standard deviation of hold times, or the digraph
flight time latency of selected frequently occurring di-
graphs. Authentication is then conducted by compar-
ing the similarity between stored feature vectors rep-
resented typing (reference) profiles, which are known
to belong to a specific user, and a previously unseen
profile that is claimed to belong to a particular user.
Although there has been only limited reported work
directed at keystroke continuous authentication, what
reported work there has been has used a feature vector
representation; this has met with some success.
However, there are some limitations regarding the
utilisation of the feature vector representation in the
context of keystroke continuous authentication. One
of the main limitations is the size of the required fea-
ture vectors; a significant number of digraphs and/or
trigraphs has to be considered which is infeasible in
the context of real-time continuous authentication. In
(Monrose and Rubin, 1997) the feature vectors were
composed of the flight time means of all digraphs in
the training dataset. The continuous authentication
was then conducted by repeatedly generating “test”
feature vectors for a given user, one every minute,
and comparing with stored reference profiles. If a
statistically similar match was found, then this was
considered to be an indication of user authentication.
Although the typing profile was composed of all di-
graph features, the overall reported accuracy was a
dsappoiting 23%. Similarly, in (Dowland and Fur-
nell, 2004) the mean and Standard Deviation (SD) of
the flight times for all digraphs and trigraphs in the
training dataset were used. Some 6,390 digraphs were
needed to make up a sufficient typing profile.
Some researchers have attempted to use an abstrac-
tion of typing features to decrease the size of the fea-
ture vectors. In (Gunetti and Picardi, 2005) the flight
time, for frequent n-graphs, was used, although the
approach was applied in the context of user identifica-
tion (as opposed to user authentication). Thus, given
a previously unseen sample, the shared n-graphs in
the sample and the stored n-graphs were identified
and collected in separate arrays. The elements in
the arrays were then ordered according to flight time
and the difference between the arrays computed by
considering the orderings of the elements; a measure
referred to as the degree of disorder was used (an
idea motivated by Spearman’s rank correlation co-
efficient (Zar, 1972)). Identifying a new sample re-
quired comparison with all stored sample (reference)
profiles, a computationally expensive process. In the
reported evaluation, 600 reference profiles were con-
sidered (generated from 40 users, each with 15 sam-
ples); the time taken for a single match was 140 sec-
onds (using a Pentium IV, 2.5 GHz). However, con-
struction typing profile using the average flight time
of only shared n-graphs contained in the training data
might not be representative of the n-graphs in the sam-
ples to be authenticated. This can, in turn, affect the
authentication accuracy, especially in the context of
real-time continuous authentication where typing pat-
terns are extracted from free text; a substantial num-
ber of n-graphs are required. Furthermore, it can be
observed from the study presented in (Gunetti and Pi-
cardi, 2005) that the authentication of one sample re-
lies on all other samples in the training data. This can
also lead to an efficiency issue in the context of con-
tinuous authentication.
In (Ahmed and Traore, 2014) an Artificial Neural
Network classifier was used to build a prediction
model to overcome the limitation of the work pre-
sented in (Gunetti and Picardi, 2005). Key-down
time was used together with average digraph and
monograph flight times to predict missing digraphs
based on the limited information in the training data;
thus, there was no need to involve a great number of
keystroke features while constructing the typing pro-
Spectral Analysis of Keystroke Streams: Towards Effective Real-time Continuous User Authentication
63