Behavioral biometric feature extraction and verification

1. A computer-implemented method comprising:

building a deep neural network for keystroke-based behavioral verification of user identity, the building comprising:

receiving a plurality of recorded keystroke events, each recorded keystroke event of the plurality of recorded keystroke events comprising (i) an indication of whether the recorded keystroke event is a key press or a key release, (ii) a key identifier of the respective key pressed or released, and (iii) a timestamp of the recorded keystroke event;

performing pre-processing of the plurality of recorded keystroke events, the pre-processing providing data structures representing sequential key events for processing by a deep neural network to extract local patterns, wherein the deep neural network comprises at least one convolution layer for feature detection, and wherein the preprocessing comprises:

obtaining processed keystroke event data by (i) converting the timestamps of the plurality of recorded keystroke events to relative times and determining a collection of deltas representing differences in times between consecutive key events, and (ii) normalizing at least some deltas of the collection of deltas to a normal distribution using an exponential distribution function, wherein one or more deltas of the collection of deltas, exceeding a predefined threshold amount of time are not included in the at least some deltas that are transformed by the normalizing; and

converting the processed keystroke event data into the data structures representing sequential key events; and

training the deep neural network using the data structures representing sequential key events; and

providing the trained deep neural network for keystroke-based behavioral verification of user identity based on determinate vectors output from the trained deep neural network.

2. The method of claim 1 , wherein the training comprises feeding the data structures representing sequential key events into the deep neural network for feature extraction.

3. The method of claim 2 , wherein the feature extraction comprises:

applying a first convolution filter to detect features from a single key press and key release series of recorded keystroke events; and

applying a second convolution filter to detect features from across a fixed number of keystrokes occurring within a given duration of time.

4. The method of claim 2 , further comprising:

appending to the deep neural network a linear layer having a linear activation function; and

using the appended linear layer in training the deep neural network as an n-class classification problem using logistic regression to learn linearly-separable features for identifying users.

5. The method of claim 4 , further comprising discarding the linear layer from the deep neural network to obtain the trained deep neural network for keystroke-based behavioral verification of user identity, the trained deep neural network to translate user keystroke data into points within a deep neural network vector space of the deep neural network.

6. The method of claim 4 , wherein the linear layer comprises a one- dimensional vector of length n, where n is a number of subject users represented by keystroke data of the recorded keystroke events.

7. The method of claim 6 , wherein the linear layer comprises output nodes of the deep neural network, and wherein each output node of the linear layer corresponds to a predicted probability that a keystroke data sample is for a specific subject user of the subject users.

8. The method of claim 1 , wherein the providing the trained deep neural network provides the trained deep neural network to a computer system on which user identity of a subject user of the computer system is to be verified as being an identified user.

9. A computer system configured to perform a method, the method comprising:

building a deep neural network for keystroke-based behavioral verification of user identity, the building comprising:

receiving a plurality of recorded keystroke events, each recorded keystroke event of the plurality of recorded keystroke events comprising (i) an indication of whether the recorded keystroke event is a key press or a key release, (ii) a key identifier of the respective key pressed or released, and (iii) a timestamp of the recorded keystroke event;

performing pre-processing of the plurality of recorded keystroke events, the pre-processing providing data structures representing sequential key events for processing by a deep neural network to extract local patterns, wherein the deep neural network comprises at least one convolution layer for feature detection, and wherein the preprocessing comprises:

obtaining processed keystroke event data by (i) converting the timestamps of the plurality of recorded keystroke events to relative times and determining a collection of deltas representing differences in times between consecutive key events, and (ii) normalizing at least some deltas of the collection of deltas to a normal distribution using an exponential distribution function, wherein one or more deltas, of the collection of deltas, exceeding a predefined threshold amount of time are not included in the at least some deltas that are transformed by the normalizing; and

converting the processed keystroke event data into the data structures representing sequential key events; and

training the deep neural network using the data structures representing sequential key events; and

providing the trained deep neural network for keystroke-based behavioral verification of user identity based on determinate vectors output from the trained deep neural network.

10. The computer system of claim 9 , wherein the training comprises feeding the data structures representing sequential key events into the deep neural network for feature extraction, and wherein the feature extraction comprises:

applying a first convolution filter to detect features from a single key press and key release series of recorded keystroke events; and

applying a second convolution filter to detect features from across a fixed number of keystrokes occurring within a given duration of time.

11. The computer system of claim 10 , wherein the method further comprises:

appending to the deep neural network a linear layer having a linear activation function, wherein the linear layer comprises a one-dimensional vector of length n, where n is a number of subject users represented by keystroke data of the recorded keystroke events;

using the appended linear layer in training the deep neural network as an n-class classification problem using logistic regression to learn linearly-separable features for identifying users; and

discarding the linear layer from the deep neural network to obtain the trained deep neural network for keystroke-based behavioral verification of user identity, the trained deep neural network to translate user keystroke data into points within a deep neural network vector space of the deep neural network.

12. The computer system of claim 11 , wherein the linear layer comprises output nodes of the deep neural network, and wherein each output node of the linear layer corresponds to a predicted probability that a keystroke data sample is for a specific subject user of the subject users.

13. The computer system of claim 9 , wherein the providing the trained deep neural network provides the trained deep neural network to a computer system on which user identity of a subject user of the computer system is to be verified as being an identified user.

14. A computer program product comprising:

a non-transitory computer readable storage medium storing instructions for execution to perform a method comprising:

building a deep neural network for keystroke-based behavioral verification of user identity, the building comprising:

receiving a plurality of recorded keystroke events, each recorded keystroke event of the plurality of recorded keystroke events comprising (i) an indication of whether the recorded keystroke event is a key press or a key release, (ii) a key identifier of the respective key pressed or released, and (iii) a timestamp of the recorded keystroke event;

performing pre-processing of the plurality of recorded keystroke events, the pre-processing providing data structures representing sequential key events for processing by a deep neural network to extract local patterns, wherein the deep neural network comprises at least one convolution layer for feature detection, and wherein the preprocessing comprises:

obtaining processed keystroke event data by (i) converting the timestamps of the plurality of recorded keystroke events to relative times and determining a collection of deltas representing differences in times between consecutive key events and (ii) normalizing at least some deltas of the collection of deltas to a normal distribution using an exponential distribution function,

wherein one or more deltas, of the collection of deltas, exceeding a predefined threshold amount of time are not included in the at least some deltas that are transformed by the normalizing; and

converting the processed keystroke event data into the data structures representing sequential key events; and

training the deep neural network using the data structures representing sequential key events; and

providing the trained deep neural network for keystroke-based behavioral verification of user identity based on determinate vectors output from the trained deep neural network.

15. The computer program product of claim 14 , wherein the training comprises feeding the data structures representing sequential key events into the deep neural network for feature extraction, and wherein the feature extraction comprises:

applying a first convolution filter to detect features from a single key press and key release series of recorded keystroke events; and

applying a second convolution filter to detect features from across a fixed number of keystrokes occurring within a given duration of time.

16. The computer program product of claim 15 , further comprising:

appending to the deep neural network a linear layer having a linear activation function, wherein the linear layer comprises a one-dimensional vector of length n, where n is a number of subject users represented by keystroke data of the recorded keystroke events;

using the appended linear layer in training the deep neural network as an n-class classification problem using logistic regression to learn linearly-separable features for identifying users; and

discarding the linear layer from the deep neural network to obtain the trained deep neural network for keystroke-based behavioral verification of user identity, the trained deep neural network to translate user keystroke data into points within a deep neural network vector space of the deep neural network.

17. The computer program product of claim 16 , wherein the linear layer comprises output nodes of the deep neural network, and wherein each output node of the linear layer corresponds to a predicted probability that a keystroke data sample is for a specific subject user of the subject users.