Biometric keystroke attribution
A biometric attribution approach identifies a keyboard actor based on timing between entered keystrokes. Patterns tend to emerge in a timing interval between keystrokes entered by an actor. The keystroke patterns of an actor are analyzed to compute a signature exhibited by the actor. Gathered or intercepted keystroke patterns of an unknown actor are compared to identify a likelihood that typing sessions emanated from a common actor. Keystroke activity of a purported suspect actor can be compared to a database or model of keystroke attributes for determining if the keystroke activity emanated from the same actor as other keystroke sequences. Keystroke patterns rely only on the timing between keystrokes, as key data and upstroke information need not be gathered since the comparisons reply only on keystroke timing deltas.
1. In a computing environment having keyboard input devices operated by actors and responsive to keypresses on the keyboard for generating packets indicative of a respective keypress, a method of assessing an identity of the actor, comprising:
receiving a sequence of packets from a keyboard interface, each packet in the sequence of packets indicative of a keystroke on a keyboard defining the console interface;
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard based on capture of the sequence of packets containing the keystrokes;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes using a feature set comparison, generating the second set of attributes further comprising:
gathering a plurality of typing sessions, each typing session in the plurality of typing sessions resulting from a sequence of keystrokes emanating from an origin;
removing upstroke information to generate a sequence of intervals between each keystroke of a depressed key;
removing keystroke data information indicative of a value associated with the depressed key for the upstroke and downstroke; and
generating a dataset based on timing information between keystrokes in each sequence of keystrokes and the origin of the sequence of keystrokes; and
computing a probability that the keystrokes corresponding to the received sequence of packets and keystrokes corresponding to the second sequence of packets emanated from the same keyboard actor.
2. The method of claim 1 wherein each received packet contains a value resulting from a single keystroke input action.
3. The method of claim 2 wherein the contained value remains undefined throughout determination of the probability.
4. The method of claim 2 wherein the keystroke input action includes a depress and release of a key corresponding to the received keystroke entry.
5. The method of claim 1 wherein computing the probability of an identity of the actor is based on a frequency of the plurality of the keystrokes.
6. The method of claim 1 wherein computing the probability of an identity of the actor is based on a model of features, the features including a standard deviation in the sequence of time intervals for a predetermined number of keystroke entries represented in the sequence of time intervals.
7. The method of claim 1 wherein the timing information includes timing deltas indicative of an interval between each keypress of the depressed keys, further comprising:
generating a plurality of feature set pairs, the feature set pairs based on keystroke sequences of a predetermined length; and
building a model based on classifying a feature set as having a common origin as another feature set in the plurality of feature set pairs.
8. The method of claim 1 further comprising:
transforming the timing information into a frequency domain for denoting patterns of timing intervals between depressed keys over a predetermined number of keystrokes; and
comparing the patterns of timing intervals resulting from a plurality of typing sessions for computing a probability that an origin of a first typing session matches an origin of a second typing session of the plurality of typing sessions.
9. The method of claim 1 further comprising receiving the packets from the console interface during transmission over a communication medium.
10. The method of claim 1 further comprising:
training a model based on features indicative of a typing stylometry based on a frequency of intervals between keypresses;
receiving keystroke timing information resulting from an intercepted typing session having an origin of an unknown actor; and
applying the model to the keystroke timing information for identifying a second typing session having the same origin as the intercepted typing session.
11. The method of claim 1 further comprising filtering the received sequence of packets from other network traffic to identify packets including a keystroke based on a frame size in the packet.
12. The method of claim 1 wherein the identified attributes are based on a sequence of keystrokes received from a sliding window over keystrokes received in a typing session from an actor.
13. The method of claim 1 wherein character data contained in the packet and indicative of a respective keystroke is encrypted and unavailable for analysis.
14. In a computing environment having keyboard input devices operated by actors and responsive to keypresses on the keyboard for generating packets indicative of a respective keypress, a method of assessing an identity of the actor, comprising:
receiving a sequence of packets from a keyboard interface, each packet in the sequence of packets indicative of a keystroke on a keyboard defining the console interface;
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard based on capture of the sequence of packets containing the keystrokes;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes, comparing the identified attributes further comprising:
demarcating a comparison sequence of a predetermined number of keystrokes for the identified attributes and the second set of attributes;
generating a vector having a sequence of elements such that each successive element in the sequence of elements represents a time interval from a previously pressed key; and
performing a comparison of the respective vectors based on the identified attributes and the second set of attributes; and
computing a probability that the keystrokes corresponding to the received sequence of packets and keystrokes corresponding to the second sequence of packets emanated from the same keyboard actor.
15. The method of claim 14 wherein comparing the identified attributes further comprises:
projecting the respective vectors to compute a series of binary proportional pulse based on equidistant, duration invariant time segments indicative of segments during which a key was pressed.
16. A computer program embodying program code on a non-transitory medium that, when executed by a processor, performs steps for implementing, in a computing environment having keyboard input devices operated by actors and responsive to keypresses on the keyboard for generating packets indicative of a respective keypress, a method of assessing an identity of the actor, the method comprising:
receiving a sequence of packets from a keyboard interface, each packet in the sequence of packets indicative of a keystroke on a keyboard defining the console interface;
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard based on capture of the sequence of packets containing the keystrokes;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes using a feature set comparison, further comprising;
generating the second set of attributes further comprises:
gathering a plurality of typing session, each typing session in the plurality of typing sessions resulting from a sequence of keystrokes emanating from an origin;
removing upstroke information to generate a sequence of intervals between each keystroke of a depressed key;
removing keystroke data information indicative of a value associated with the depressed key for the upstroke and downstroke; and
generating a dataset based on timing information between keystrokes in each sequence of keystrokes and the origin of the sequence of keystrokes; and
computing a probability that the keystrokes corresponding to the received sequence of packets and keystrokes corresponding to the second sequence of packets emanated from the same keyboard actor.