Daniele Gunetti

User authentication through keystroke dynamics

Unlike other access control systems based on biometric features, keystroke analysis has not led to techniques providing an acceptable level of accuracy. The reason is probably the intrinsic variability of typing dynamics, versus other---very stable---biometric characteristics, such as face or fingerprint patterns. In this paper we present an original measure for keystroke dynamics that limits the instability of this biometric feature. We have tested our approach on 154 individuals, achieving a False Alarm Rate of about 4% and an Impostor Pass Rate of less than 0.01%. This performance is reached using the same sampling text for all the individuals, allowing typing errors, without any specific tailoring of the authentication system with respect to the available set of typing samples and users, and collecting the samples over a 28.8-Kbaud remote modem connection.

Keystroke analysis of free text

Keystroke dynamics can be useful to ascertain personal identity even after an authentication phase has been passed, provided that we are able to deal with the typing rhythms of free text, chosen and entered by users without any specific constraint. In this paper we present a method to compare typing samples of free text that can be used to verify personal identity. We have tested our technique with a wide set of experiments on 205 individuals, obtaining a False Alarm Rate of less than 5&percent; and an Impostor Pass Rate of less than 0.005&percent;. Different trade-offs are, however, possible. Our approach can rely on what is typed by people because of their normal job, and a few lines of text, even collected in different working sessions, are sufficient to reach a high level of accuracy, which improves proportionally to the amount of available information: As a consequence, we argue that our method can be useful in computer security as a complementary or alternative way to user authentication and as an aid to intrusion detection.

Testing by means of inductive program learning

Given a program P and a set of alternative programs //’, we generate a sequence of test cases that are adequate, in the sense that they distinguish the given program from all alternatives The, m(,thod is related to fault-based approaches to test case generation, but programs in P need not he s]mp]e mutations of P. The technique for generating an adequate test set is based on the inductive learning of programs from finite sets of input-output examples: given a partial test set. we generate inductively a program P’ E P which is consistent with P on those input values; then we look for an input value that distinguishes P from P’, and we repeat the process until no program except P can be induced from the generated examples. We show that the obtained test set is adequate with respect to the alternatives belonging to P. The method IS made possible by a program induction procedure which has evolved from recent research in mnchine Iei]rnlng and inductive logic programming. An implemented version of the test case ~encration procedure is demonstrated on simple and more complex list-processing programs. and tb(, scalability of’ the approach is discussed,

Keystroke analysis of different languages: a case study

Typing rhythms are one of the rawest form of data stemming from the interaction between humans and computers. When properly analyzed, they may allow to ascertain personal identity. In this paper we provide experimental evidence that the typing dynamics of free text can be used for user identification and authentication even when typing samples are written in different languages. As a consequence, we argue that keystroke analysis can be useful even when people may use different languages, in those areas where ascertaining personal identity is important or crucial, such as within Computer Security.

Dealing with different languages and old profiles in keystroke analysis of free text

In this paper we show experimentally that typing dynamics of free text provide useful information for user identification and authentication even when a long time has passed since typing profiles of users were formed, and even when users are writing in a language different from the one used to form their profiles. Hence, we argue that keystroke analysis can be an effective aid in different areas where ascertaining user identity is important or crucial, including Computer Security and User Modeling.

Side-Channel Analysis for Detecting Protocol Tunneling

Protocol tunneling is widely used to add security and/or privacy to Internet applications. Recent research has exposed side channel vulnerabilities that leak information about tunneled protocols. We first discuss the timing side channels that have been found in protocol tunneling tools. We then show how to infer Hidden Markov models (HMMs) of network protocols from timing data and use the HMMs to detect when protocols are active. Unlike previous work, the HMM approach we present requires no a priori knowledge of the protocol. To illustrate the utility of this approach, we detect the use of English or Italian in interactive SSH sessions. For this example application, keystroke-timing data associates inter-packet delays with keystrokes. We first use clustering to extract discrete information from continuous timing data. We use discrete symbols to infer a HMM model, and finally use statistical tests to determine if the observed timing is consistent with the language typing statistics. In our tests, if the correct window size is used, fewer than 2% of data windows are incorrectly identified. Experimental verification shows that on-line detection of language use in interactive encrypted protocol tunnels is reliable. We compare maximum likelihood and statistical hypothesis testing for detecting protocol tunneling. We also discuss how this approach is useful in monitoring mix networks like The Onion Router (Tor).

Inductive Synthesis of Logic Programs and Inductive Logic Programming

Inductive Logic Programming deals with the problem of generating logic programs from examples, normally given as ground atoms. We briefly survey older methods (Shapiro’s MIS and Plotkin’s least general generalizations) which have set the foundations of the field and inspired more recent top-down and bottom-up approaches, respectively. Recent research has suggested that practical program induction requires a hypothesis space which is restricted a priori. We show that, if this trend is brought to the extreme consequence of requiring a well-defined and finite set of allowed clauses, efficient induction procedures can be devised to produce programs which are consistent and complete with the examples. On this basis, we suggest that “Examples + Hypothesis Space” can become an alternative way to specify a logic program. Software can be developed and reused by adding or modifying examples, and by refining the set of allowed clauses. Inductive synthesis is then proposed as a software engineering tool for the development, reuse and testing of logic programs.

The difficulties of learning logic programs with cut

As real logic programmers normally use cut (!), an effective learning procedure for logic programs should be able to deal with it. Because the cut predicate has only a procedural meaning, clauses containing cut cannot be learned using an extensional evaluation method, as is done in most learning systems. On the other hand, searching a space of possible programs (instead of a space of independent clauses) is unfeasible. An alternative solution is to generate first a candidate base program which covers the positive examples, and then make it consistent by inserting cut where appropriate. The problem of learning programs with cut has not been investigated before and this seems to be a natural and reasonable approach. We generalize this scheme and investigate the difficulties that arise. Some of the major shortcomings are actually caused, in general, by the need for intensional evaluation. As a conclusion, the analysis of this paper suggests, on precise and technical grounds, that learning cut is difficult, and current induction techniques should probably be restricted to purely declarative logic languages.

Funtional Inductive Logic Programming with Queries to the User

The FILP learning system induces functional logic programs from positive examples. For every predicate P, the user is asked to provide a mode (input or output) for each of its argument, and the system assumes that the mode corresponds to a total function, i.e., for a given input there is one and only one corresponding output that makes the predicate true. Functionality serves two goals: it restricts the hypothesis space and it allows the system to ask existential queries to the user. By means of these queries, missing examples can be added to the ones given initially, and this makes the learned programs complete and consistent and the system adequate for learning multiple predicates and recursive clauses in a reliable manner.

Learning relations and logic programs

Inductive Logic Programming (ILP) is an emerging research area at the intersection of machine learning, logic programming and software engineering. The first workshop on this topic was held in 1991 in Portugal (Muggleton, 1991). Subsequently, there was a workshop tied to the Future Generation Computer System Conference in Japan in 1992, and a third one in Bled, Slovenia, in April 1993 (Muggleton, 1993). Ideas related to ILP are also appearing in major AI and machine learning conferences and journals. Although European-based and mainly sponsored by ESPRIT, ILP aims at becoming equally represented elsewhere; for example, among researchers in America who are investigating relational learning and first order theory revision (see, for example, the papers in Birnbaum and Collins, 1991) and within the computational learning theory community. This years IJCAI workshop on ILP is a first step in this direction, and includes recent work with a broader range of perspectives and techniques. Many different problem settings have been proposed, but it is still possible to abstract similarities and identify one simplified ILP problem: