Examining a large keystroke biometrics dataset for statistical-attack openings

ACM Transactions on Information and System Security

Volumn 16, Issue 2, 2013, Pages

  Serwadda, Abdul ^a   Phoha, Vir V ^a  

^a LOUISIANA TECH UNIVERSITY   (United States)

Author keywords

Biometrics; Keystroke dynamics; Spoofing attacks

Indexed keywords

ALGORITHMIC APPROACH; ALGORITHMIC ATTACKS; AUTHENTICATION SYSTEMS; BIOMETRIC SYSTEMS; KEYSTROKE DYNAMICS; PERFORMANCE DEGRADATION; SPOOFING ATTACKS; VERIFICATION SYSTEMS;

ALGORITHMS; AUTHENTICATION;

BIOMETRICS;

EID: 84885006760     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/2516960     Document Type: Article

References (49)

1. Aivils, S. 2005. Ubuntu manuals. http://manpages.ubuntu.com/manpages/ gutsy/man8/xsendkeycode.8.html.
2. Balagani, K. S., Phoha, V. V., Ray, A., and Phoha, S. 2011. On the discriminability of keystroke feature vectors used in fixed text keystroke authentication. Patt. Recog. Lett.
3. Ballard, L. 2008. Robust techniques for evaluating biometric cryptographic key generators. Ph.D. thesis, John Hopkins University.
4. Ballard, L., Lopresti, D., and Monrose, F. 2006a. Evaluating the security of handwriting biometrics. In Proceedings of the 10th International Workshop on the Foundations of Handwriting Recognition. 461-466.
5. Ballard, L., Monrose, F., and Lopresti, D. 2006b. Biometric authentication revisited: Understanding the impact of wolves in sheep's clothing. In Proceedings of the 15th Conference on USENIX Security Symposium. Vol. 15, USENIX Association, Berkeley, CA.
6. Ballard, L., Lopresti, D., Member, S., and Monrose, F. 2007. Forgery quality and its implications for behavioral biometric security. IEEE Trans. Syst. Man Cybernet. (Special Edition).
7. Ballard, L., Kamara, S., Monrose, F., and Reiter, M. K. 2008a. Towards practical biometric key generation with randomized biometric templates. In Proceedings of the 15th ACM Conference on Computer and Communications Security. ACM, New York, 235-244.
8. Ballard, L., Kamara, S., and Reiter, M. K. 2008b. The practical subtleties of biometric key generation. In Proceedings of the 17th Annual USENIX Security Symposium. 61-74.
9. Barford, P. and Crovella, M. 1998. Generating representative web workloads for network and server performance evaluation. In Proceedings of the ACM SIGMETRICS Joint International Conference on Measurement and Modeling of Computer Systems. ACM, New York, 151-160. (Pubitemid 128593231)
10. Bergadano, F., Gunetti, D., and Picardi, C. 2002. User authentication through keystroke dynamics. ACM Trans. Inf. Syst. Secur. 5, 367-397.
11. Bulmer, M. G. 1979. Principles of Statistics 2nd Ed. Dover.
12. Doane, P. D. and Seward, E. L. 2007. Applied Statistics in Business and Economics 1st Ed., McGraw-Hill.
13. François, D., Wertz, V., and Verleysen, M. 2006. The permutation test for feature selection by mutual information. In Proceedings of the European Symposium on Artificial Neural Networks (ESANN'06). 239-244.
14. Gibbons, R. D. 1985. Nonparametric Statistical Inference 2nd Ed., M. Dekker.
15. Gummadi, R., Balakrishnan, H., Maniatis, P., and Ratnasamy, S. 2009. Not-a-Bot (NAB): Improving service availability in the face of Botnet attacks. In Proceedings of NSDI'09.
16. Khandaker, R., Balagani, K., and Phoha, V. 2011. Making impostor pass rates meaningless: A case of snoop-forge-replay attack on continuous cyber-behavioural verification with keystrokes. In Proceedings of the IEEE Computer Society and IEEE Biometrics Council Workshop on Biometrics (BIOM).
17. Kifer, D., Ben-David, S., and Gehrke, J. 2004. Detecting change in data streams. In Proceedings of the 30th International Conference on Very Large Data Bases (VLDB'04). Vol. 30, 180-191.
18. Killourhy, K. and Maxion, R. 2011. Should security researchers experiment more and draw more inferences? In Proceedings of the 4th Workshop on Security Experimentation and Test (CSET-11).
19. Killourhy, K. S. and Maxion, R. A. 2009. Comparing anomaly-detection algorithms for keystroke dynamics. In Proceedings of the DSN. 125-134.
20. Lan, K.-C. and Heidemann, J. 2002. Rapid model parameterization from traffic measurements. ACM Trans. Model. Comput. Simul. 12, 3, 201-229.
21. Leggett, J. J. and Williams, G. 1988. Verifying identity via keystroke characteristics. Int. J. Man-Machine Stud. 28, 1, 67-76. (Pubitemid 18653526)
22. Lilliefors, H. 1967. On the Kolmogorov-Smirnov test for normality with mean and variance unknown. J. Amer. Statist. Assoc.
23. Marseguerra, M., Zio, E., Podofillini, L., and Coit, D. W. 2005. Optimal design of reliable network systems in presence of uncertainty. IEEE Trans. Reliabil. 54, 2, 243-253. (Pubitemid 41005024)
24. Massey, F. J. 1951. The Kolmogorov-Smirnov test for goodness of fit. J. Amer. Statist. Assoc. 46, 253, 68-78.
25. McDougall, M. K. and Rayner, G. D. 2004. Robustness to non-normality of various tests for the one-sample location problem. J. Appl. Math. Decision Sci. 8, 4, 235-246.
26. Meng, T. C., Gupta, P., and Gao, D. 2013. I can be you: Questioning the use of keystroke dynamics as a biometric. In Proceedings of NDSS'13.
27. Monrose, F., Reiter, M. K., Li, Q., Lopresti, D. P., and Shih, C. 2002. Toward speech-generated cryptographic keys on resource-constrained devices. In Proceedings of the 11th USENIX Security Symposium. USENIX Association, Berkeley, CA, 283-296.
28. Monrose, F., Reiter, M. K., and Wetzel, S. 1999. Password hardening based on keystroke dynamics. Int. J. Inf. Sec. ACM Press, 73-82. (Pubitemid 32213902)
29. Parno, B. 2008. Bootstrapping trust in a "trusted" platform. In Hot Sec. USENIX Association.
30. Peacock, A., Ke, X., and Wilkerson, M. 2004. Typing patterns: A key to user identification. IEEE Sec. Priv. 2, 40-47. (Pubitemid 40168625)
31. R Development Core Team. 2008. R: A Language and Environment for Statistical Computing. R Foundation for Statistical Computing, Vienna, Austria. ISBN 3-900051-07-0.
32. Rahman, K. A., Balagani, K. S., and Phoha, V. V. 2013. Snoop-forge-replay attacks on continuous verification with keystrokes. IEEE Trans. Inf. Foren. Sec. 8, 3, 528-541.
33. Ruska, J. 2009. Most common passwords lists from 3 Databases. http://blog.jimmyr.com/Passwordanalysisofdatabasesthatwerehacked282009.php.
34. Scutari, M. and Brogini, A. 2011. Bayesian network structure learning with permutation tests. In Statistics for Complex Problems: The Multivariate Permutation Approach and Related Topics, Communications in Statistics Theory & Methods.
35. Serwadda, A., Phoha, V. V., and Kiremire, A. 2011. Using global knowledge of users' typing traits to attack keystroke dynamics templates. In Proceedings of 13th Workshop on Multimedia and Security. 461-466.
36. Sheng, Y., Phoha, V., and Rovnyak, S. 2005. A parallel decision tree-based method for user authentication based on keystroke patterns. IEEE Trans. Syst. Man, Cybernet. Part B: Cybernetics 35, 4, 826-833. (Pubitemid 41644063)
37. Shrijit, J. 2009. Naive bayes and similarity based methods for identifying computer users using keystroke patterns. Ph.D. thesis, Louisiana Tech University.
38. Sim, T. and Janakiraman, R. 2007. Are digraphs good for free-text keystroke dynamics? In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR'07). 1-6.
39. Song, D. X., Wagner, D., and Tian, X. 2001. Timing analysis of keystrokes and timing attacks on ssh. In Proceedings of the 10th Conference on USENIX Security Symposium. Vol. 10.
40. Stefan, D., Shu, X., and Yao, D. D. 2011. Robustness of Keystroke-Dynamics based biometrics against synthetic forgeries. Comput. Secur.
41. Stephens, M. A. 1972. EDF statistics for goodness-of-fit: Part 1. Tech. rep., Office of Naval Research.
42. T̈urpe, S., Poller, A., Steffan, J., Stotz, J.-P., and Trukenm̈uller, J. 2009. Attacking the bitlocker boot process. In Proceedings of the 2nd International Conference on Trusted Computing (Trust'09). Springer-Verlag, Berlin, 183-196.
43. Wang, Z., Serwadda, A., Balagani, K., and Phoha, V. 2012. Transforming animals in a cyber-behavioral biometric menagerie with frog-boiling attacks. In Proceedings of the 5th IEEE International Conference on Biometrics: Theory Applications and Systems (BTAS).
44. Weir, M., Aggarwal, S., Collins, M., and Stern, H. 2010. Testing metrics for password creation policies by attacking large sets of revealed passwords. In Proceedings of the 17th ACM Conference on Computer and Communications Security (CCS'10). ACM, New York, 162-175.
45. Weiss, N. A. 1999. Introductory Statistics 5th Ed., Addison Wesley.
46. Whitley, E. and Ball, J. 2002. Statistics review 6: Nonparametric methods. Critical Care 6, 6, 509-513. (Pubitemid 35414582)
47. Wilk, M. and Gnanadesikan, R. 1968. Probability plotting methods for the analysis of data. Biometrica Trust 55, 1, 1-17.
48. Witten, I. H. and Frank, E. 2005. Data Mining: Practical Machine Learning Tools and Techniques 2nd Ed., Morgan-Kaufmann, San Francisco.
49. Yu, E. and Cho, S. 2003. Ga-svm wrapper approach for feature subset selection in keystroke dynamics identity verification. In Proceedings of the International Joint Conference on Neural Networks. Vol. 3, 2253-2257.