WO2017067103A1 - 基于击键行为的身份认证方法和*** - Google Patents

基于击键行为的身份认证方法和*** Download PDF

Info

Publication number
WO2017067103A1
WO2017067103A1 PCT/CN2016/070988 CN2016070988W WO2017067103A1 WO 2017067103 A1 WO2017067103 A1 WO 2017067103A1 CN 2016070988 W CN2016070988 W CN 2016070988W WO 2017067103 A1 WO2017067103 A1 WO 2017067103A1
Authority
WO
WIPO (PCT)
Prior art keywords
keystroke
legal
estimated
user
sequence
Prior art date
Application number
PCT/CN2016/070988
Other languages
English (en)
French (fr)
Inventor
蒋昌俊
闫春钢
陈闳中
丁志军
宋小双
Original Assignee
同济大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 同济大学 filed Critical 同济大学
Publication of WO2017067103A1 publication Critical patent/WO2017067103A1/zh
Priority to AU2018100672A priority Critical patent/AU2018100672A4/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan

Definitions

  • the present invention relates to the field of Internet, and in particular to a method and system for identity authentication based on keystroke behavior.
  • an object of the present invention is to provide an identity authentication method and system based on a keystroke behavior, which is used to solve the problem of excessive acquisition, high cost, and inability to real-time users in the prior art.
  • the issue of identity confirmation of legality is to provide an identity authentication method and system based on a keystroke behavior, which is used to solve the problem of excessive acquisition, high cost, and inability to real-time users in the prior art.
  • the present invention provides a method for authenticating an identity based on a keystroke behavior, including the following steps:
  • S2 collecting an attempted keystroke behavior when the login user clicks the key to generate a time sequence of the estimated keystroke
  • the step S1 further includes the steps of:
  • the step S1 further includes the steps of:
  • step S3 further comprises the steps of:
  • the step S2 further includes the following steps:
  • the sequence of the to-be-estimated character to be estimated is matched with the user model by a Gaussian model, and the matching formula according to the matching is:
  • tS' represents the sequence of extremely adjacent characters to be estimated
  • ⁇ S and ⁇ S are the expected and standard deviations of the Gaussian distribution in the Gaussian model, respectively;
  • the step of determining whether the behavior of the estimated keystroke of the login user is legal is further:
  • the invention also provides an identity authentication system based on a keystroke behavior, comprising a data acquisition module, a feature extraction module, a model training module, a continuous authentication module and a model library;
  • the data collection module is configured to collect a legal keystroke time sequence when a legitimate user is legally keystroked, and an estimated keystroke time sequence generated by the estimated keystroke behavior when the user is logged, and the legal keystroke Time series and time to be estimated An inter-sequence is sent to the feature extraction module;
  • the feature extraction module is configured to generate a legal polar neighboring character sequence and a neighboring character to be estimated according to the legal keystroke time sequence and the to-be estimated keystroke time sequence respectively;
  • the model training module is configured to construct a user model of a legitimate user keystroke feature according to the legal keystroke behavior and a legal keystroke time sequence;
  • the persistent authentication module is configured to match the to-be-estimated adjacent character sequence with the user model, and determine, according to the matching result, whether the attempted keystroke behavior of the login user is legal, and the behavior of the estimated keystroke is illegal.
  • the alarm is generated and the login user is logged in again; the login user is allowed to log in when the behavior of the keystroke is valid, and the behavior of the estimated keystroke is stored, and the model training module is fed back to update the user model;
  • the model library is used to store a user model of legitimate user keystroke features.
  • the data collection module is further configured to collect a legal keystroke behavior and generate a legal time interval vector
  • the feature extraction module is further configured to traverse the legal time interval vector, and generate a polar neighbor character according to a time interval of two adjacent character sequences of the legal time interval vector and a preset critical time interval;
  • the proportion of the extremely adjacent characters in the number of 2 and 3, and the preset critical time interval when the specific gravity is maximum is a legal critical time interval; and the legal polar neighboring characters are regenerated by the legal critical time interval Sequence, and recording the duration of the legally very adjacent character sequence;
  • the feature extraction module is further configured to extract a temporal feature set of the legal polar neighboring character sequence, and construct a distribution model obeyed by the legal polar neighboring character sequence.
  • the feature extraction module is further configured to generate the to-be-estimated time interval vector of the to-be-estimated key behavior; and generate the to-be-estimated pole adjacent to the estimated critical interval time and the to-be-estimated time interval vector.
  • a sequence of characters are further configured to generate the to-be-estimated time interval vector of the to-be-estimated key behavior; and generate the to-be-estimated pole adjacent to the estimated critical interval time and the to-be-estimated time interval vector.
  • the feature extraction module is further configured to acquire the time series of the key to be estimated, and store the time series of the key to be estimated into a buffer of a preset size. When the buffer is full, the sending station All of the estimated keystroke time series in the buffer.
  • the adaptive modulation method of the present invention has the following beneficial effects:
  • the invention only extracts a small number of representative keystroke features of the user, removes a large number of redundant keystroke feature sequences, and improves the response capability of the continuous authentication while ensuring the authentication accuracy rate; when the user logs in to the network account, Monitor user's keystrokes in real time to provide ongoing account security for legitimate users.
  • FIG. 1 is a flow chart showing a method for authenticating an identity based on a keystroke behavior according to the present invention
  • Figure 2 is a block diagram showing the flow of the user model for constructing a legitimate user keystroke feature in Figure 1;
  • FIG. 3 is a flow chart showing the sequence of generating the adjacent character sequences to be estimated in FIG. 1;
  • Figure 4 is a flow chart showing the process of the authentication process of Figure 1;
  • FIG. 5 is a logic block diagram showing an identity authentication system based on a keystroke behavior of the present invention
  • Fig. 6 is a graph showing the result of the authentication of the present invention.
  • the present invention provides a method for authenticating an identity based on a keystroke behavior, comprising the following steps: S1, constructing a user model of a legitimate user keystroke feature according to legal keystroke behavior during legal user training; S2, collecting The estimated keystroke behavior when the user clicks the keystroke generates a time series of the estimated keystroke; S3, generates a sequence of the adjacent character to be estimated according to the time sequence of the keystroke to be estimated; S4, the sequence of the adjacent character to be estimated and the user model Matching, and judging whether the logged-in user's pending keystroke behavior is legal according to the matching result; if not, generating an alarm and logging the logged-in user back again; if legal, allowing the logged-in user to log in, and storing the pending keystroke behavior and Update the user model.
  • the monitor After the user logs in to the network account, the monitor tracks the user's keystroke behavior in real time and records the user's keystroke behavior time series. In the training phase of the user model, all the keystrokes of the user account usage phase are collected, and the data is sent after the user account is logged out.
  • Table 1 is the user keystroke behavior log table. Where down means that the key is pressed, up means that the key is bounced, and Time means the timestamp when the key is pressed or bounced.
  • the uploaded keystroke behavior log is first processed, and the time interval vector of the user keystroke is extracted.
  • the time interval vector is extracted.
  • it is necessary to iterate over the eigenvalues Interval ⁇ I 1 , I 2 , ... I p-1 > of the time interval vector to mine the critical interval time reflecting the keystroke characteristics of the user.
  • the user's extremely adjacent character sequence is further excavated.
  • step S1 further includes the steps of:
  • a new polar neighbor character is generated by taking the next character of the two adjacent characters as the first character
  • Table 2 is a table of time feature sets of extremely adjacent character sequences.
  • the method when constructing the user model of the legal user keystroke feature, the method further comprises the steps of: extracting a temporal feature set of the legally very adjacent character sequence, and constructing a distribution model obeying the legal polar neighboring character sequence.
  • step S3 further includes the steps of:
  • the duration of its input sequence of closely adjacent characters is assumed to be subject to a normally distributed process.
  • the time feature set of the polar neighboring character sequence excavated by the extraction module is constructed, and a normal distribution model obeyed by each of the extremely adjacent character sequences is constructed.
  • the temporal feature set ⁇ S1, S2, S3, ..., Sk-1, Sk> of the very adjacent character sequence S the expectation and the variance are calculated by the method of maximum likelihood estimation. among them,
  • the extremely adjacent character sequence obtained by the training data of the legitimate user and the normal distribution model obeyed constitute the main part of the user model.
  • the critical time interval, the user keystroke feature is also part of the user model.
  • the module By matching the data of the behavior to be estimated with the user model, the score of the data of the behavior to be estimated is given, and the authentication result is given according to the decision algorithm.
  • the module stores the time feature set of the extremely adjacent character sequence mined by the data to be estimated into a buffer, and when the number of features reaches the set value, The model of the corresponding extremely adjacent character sequence in the model library is updated.
  • step S2 further includes the steps of:
  • the time sequence of the keystroke to be estimated is obtained, and the time series of the keystroke to be estimated is stored in a buffer of a preset size, and when the buffer is full, all time series of the estimated key in the buffer are sent.
  • the data collection module sets a fixed-size character sequence buffer. When the buffer is full, the acquisition module submits the data in the buffer to the feature extraction module for identity authentication.
  • the window value of the buffer in the middle is 30 characters.
  • the Gaussian probability density function is a function of similarity evaluation, and is used in user authentication to evaluate the similarity between the extremely adjacent character sequence to be estimated and the extremely adjacent character sequence in the user model.
  • step S4 the sequence of the extremely adjacent characters to be estimated is matched with the user model by the Gaussian model, and the matching formula according to the matching is:
  • t S ' represents the sequence of extremely adjacent characters to be estimated
  • ⁇ S and ⁇ S are the expected and standard deviations of the Gaussian distribution in the Gaussian model, respectively;
  • the step of determining whether the login user's estimated keystroke behavior is legal is also included:
  • the present invention further provides an identity authentication system based on a keystroke behavior, including a data acquisition module, a feature extraction module, a model training module, a persistent authentication module, and a model library;
  • the data collection module is configured to collect a legal keystroke time sequence when a legitimate user is legally keystroked, and an estimated keystroke time sequence generated by the estimated keystroke behavior when the user is logged in, and the legal keystroke time sequence and the waiting time sequence
  • the estimated key time sequence is sent to the feature extraction module;
  • the feature extraction module is configured to generate legal polar neighbors according to the legal keystroke time sequence and the time-to-evaluation time sequence respectively a sequence of characters and a very adjacent character to be evaluated;
  • the model training module is configured to construct a user model of a legitimate user keystroke feature according to a legal keystroke behavior and a legal keystroke time sequence;
  • the continuous authentication module is configured to match the to-be-estimated adjacent character sequence with the user model, and determine whether the login user's pending keystroke behavior is legal according to the matching result, generate an alarm and re-enter the login user when the estimated keystroke behavior is illegal.
  • Log in allow the login user to log in when the keystroke behavior is legal, and store the behavior to be estimated, and feed back to the model training module to update the user model.
  • the model library is used to store user models of legitimate user keystroke features.
  • the data collection module is further configured to collect a legal keystroke behavior and generate a legal time interval vector
  • the feature extraction module is further configured to traverse the legal time interval vector, and generate polar neighbor characters according to the time interval of two adjacent character sequences of the legal time interval vector and the preset critical time interval; the number of characters is 2 and 3 The proportion of the extremely adjacent characters, and the preset critical time interval when the specific gravity is maximum is the legal critical time interval; the legal extreme adjacent character sequence is regenerated by the legal critical time interval, and the duration of the legal polar neighbor sequence is recorded. time;
  • the feature extraction module is also used to extract the temporal feature set of the legally very adjacent character sequence, and construct a distribution model obeying the legally adjacent character sequence.
  • the feature extraction module is further configured to generate a time interval vector to be estimated of the estimated keystroke behavior; and generate a sequence of the adjacent character to be estimated in combination with the legal critical interval time and the time interval vector to be estimated.
  • the feature extraction module is further configured to acquire a time series of the key to be estimated, and store the time series of the key to be estimated into a buffer of a preset size, and when the buffer is full, all the estimated key times in the buffer are sent. sequence.
  • the user keystroke behavior authentication method is mainly composed of a data acquisition module, a feature extraction module, a model training module, and a continuous authentication module.
  • the data acquisition module is responsible for collecting the keystroke time sequence when the user presses the key;
  • the feature extraction module is responsible for mining the user's extreme adjacent character sequence;
  • the model training module constructs the Gaussian model of the user keystroke feature according to the temporal characteristics of the legal user training data;
  • the module performs decision scoring based on a sequence of characters typed by the user to determine the legitimacy of the user identity, and it stores the keystroke behavior characteristics of the legal user for the most recent period of time. When the number of features satisfies certain conditions, the module constructs with new features.
  • the model is updated and the corresponding sequence model in the model library is updated.
  • the monitor After the user logs in to the network account, the monitor tracks the user's keystroke behavior in real time and records the user's keystroke behavior time series.
  • the data collection module collects all the keystrokes in the user account usage phase, and sends the data to the feature extraction module after the user account is logged out.
  • the data collection module sets a fixed-size character sequence buffer. When the buffer is full, the acquisition module submits the data in the buffer to the feature extraction module for identity authentication.
  • the window value size of the buffer in the case It is 30 characters.
  • Model training module For a user, the duration of its input polar sequence of characters is assumed to be subject to a normal distribution process. The module uses the time feature set of the polar neighboring character sequences mined by the feature extraction module to construct a normal distribution model obeyed by each polar neighboring character sequence. For the temporal feature set ⁇ S1, S2, S3, ..., Sk-1, Sk> of the polar neighbor sequence S, the expectation and the variance are calculated using the method of maximum likelihood estimation.
  • the extremely adjacent character sequence obtained by the training data of the legitimate user and the normal distribution model obeyed constitute the main part of the user model.
  • the critical time interval, the user keystroke feature, is also part of the user model.
  • Continuous authentication module The module matches the data of the behavior to be estimated with the user model, gives the score of the data of the behavior to be estimated, and gives the authentication result according to the decision algorithm.
  • the module stores the time feature set of the extremely adjacent character sequence mined by the data to be estimated into a buffer, and when the number of features reaches the set value, The model of the corresponding extremely adjacent character sequence in the model library is updated.
  • the Gaussian probability density function is a function of similarity evaluation. In user authentication, it is used to evaluate the similarity between the extremely adjacent character sequences to be estimated and the extremely adjacent character sequences in the user model. The scoring formula is given according to the Gaussian probability density function:
  • tS' represents the sequence of extremely adjacent characters mined according to the critical time interval of the user in the data to be estimated
  • ⁇ S, ⁇ S are the expected and standard deviations of the Gaussian distribution of the corresponding sequence in the user model, respectively.
  • the ROC curve of the authentication result using the keystroke-based identity authentication method and system of the present invention indicates that the authentication method and system of the present invention have a false positive rate of 5.3%. In the case of detection rate of up to 90%, it can effectively judge the legality of the user identity and ensure the security of the user account.
  • the present invention extracts only a small number of representative keystroke features of the user, removes a large number of redundant keystroke feature sequences, and improves the responsiveness of the continuous authentication while ensuring the authentication accuracy rate;
  • real-time monitoring of the user's keystrokes provides continuous account security for legitimate users.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Social Psychology (AREA)
  • Biomedical Technology (AREA)
  • Medical Treatment And Welfare Office Work (AREA)
  • Collating Specific Patterns (AREA)

Abstract

一种基于击键行为的身份认证方法，包括以下步骤：S1、根据合法用户训练时的合法击键行为构建合法用户击键特征的用户模型；S2、采集登录用户击键时的待估击键行为生成待估击键时间序列；S3、根据所述待估击键时间序列生成待估极相邻字符序列；S4、将所述待估极相邻字符序列与所述用户模型进行匹配，并根据匹配结果判断登录用户的所述待估击键行为是否合法；若不合法，则生成警报并使登录用户重新登录，若合法，则允许登录用户登录，同时存储所述待估击键行为并更新所述用户模型。仅提取了用户少量的有代表性的击键特征，在保证认证准确率的同时，提高了持续认证的响应能力；实时监控用户的击键行为，为用户提供持续性的账户安全保障。

Description

基于击键行为的身份认证方法和*** 技术领域
本发明涉及互联网领域，特别是涉及一种基于击键行为的身份认证方法和***。
背景技术
随着互联网的迅速发展，用户对互联网中帐号的安全性的要求也随之提高。目前最常见的方法是基于用户名和密码相结合的文本匹配身份认证。这种方法虽简单易行，然而一旦密码泄露，这种身份认证方法就会失效。由于每个人的行为都有其生物特征，而用户的击键行为与用户的年龄、性别、和对计算机键盘的熟悉程度等都有联系，不同用户的击键行为模式是难以被他人模仿和盗用的。而且基于击键行为的认证方法并不需要额外的硬件支持，成本较低，且***能够在后台记录用户的击键行为，因此基于用户击键行为的认证方法具有良好的可行性。但基于传统的击键行为的认证方法，无法实时地对用户身份进行合法性的确认。
发明内容
鉴于以上所述现有技术的缺点，本发明的目的在于提供一种基于击键行为的身份认证方法和***，用于解决现有技术中采集过多、成本较高，且无法实时地对用户身份进行合法性的确认的问题。
为实现上述目的及其他相关目的，本发明提供1、一种基于击键行为的身份认证方法，包括以下步骤：
S1、根据合法用户训练时的合法击键行为构建合法用户击键特征的用户模型；
S2、采集登录用户击键时的待估击键行为生成待估击键时间序列；
S3、根据所述待估击键时间序列生成待估极相邻字符序列；
S4、将所述待估极相邻字符序列与所述用户模型进行匹配，并根据匹配结果判断登录用户的所述待估击键行为是否合法；若不合法，则生成警报并使登录用户重新登录，若合法，则允许登录用户登录，同时存储所述待估击键行为并更新所述用户模型。
优选的，所述步骤S1还包括步骤：
S11、采集合法击键行为，并生成合法时间间隔向量；
S12、遍历所述合法时间间隔向量，并判断所述合法时间间隔向量的两个相邻字符序列的时间间隔是否小于预设临界时间间隔；
若是，则所述两个相邻字符置于同一个极相邻字符；
若否，则以所述两个相邻字符中后一个字符为首字符，生成一个新的所述极相邻字符；
S13、计算字符数量为2和3的所述极相邻字符所占的比重，并设置比重最大时的所述预设临界时间间隔为合法临界时间间隔；
S14、通过所述合法临界时间间隔重新生成合法极相邻字符序列，并记录所述合法极相邻字符序列的持续时间。
优选的，所述步骤S1还包括步骤：
提取所述合法极相邻字符序列的时间特征集，并构建所述合法极相邻字符序列服从的分布模型。
优选的，所述步骤S3还包括步骤：
S31、采集所述待估击键行为；
S32、生成所述待估击键行为的待估时间间隔向量；
S33、结合所述合法临界间隔时间与所述待估时间间隔向量生成所述待估极相邻字符序列。
优选的，所述步骤S2还包括步骤：
获取所述待估击键时间序列，并将所述待估击键时间序列存入预设大小的缓冲区，当所述缓冲区满时，发送所述缓冲区中的所有所述估击键时间序列。
优选的，所述步骤S4中所述待估极相邻字符序列与所述用户模型通过高斯模型进行匹配，所述匹配根据的评分公式为：
Figure PCTCN2016070988-appb-000001
其中，tS’表示待估极相邻字符序列，而μS和σS分别为所述高斯模型中高斯分布的期望和标准差；
所述判断登录用户的所述待估击键行为是否合法的步骤还包括：
计算单个待估极相邻字符序列的评分，再去除低于预设值的所述评分后将所述评分汇总，比较汇总后的所述评分是否大于阈值；若是，则允许登录，同时存储所述待估击键行为并更新所述用户模型；若否，则发出警告并重新登录。
本发明还提供了一种基于击键行为的身份认证***，包括数据采集模块、特征提取模块、模型训练模块、持续认证模块和模型库；
所述数据采集模块用于采集合法用户合法击键行为时的合法击键时间序列和登录用户击键时的待估击键行为生成的的待估击键时间序列，并将所述合法击键时间序列和待估击键时 间序列发送至所述特征提取模块；
所述特征提取模块用于根据所述合法击键时间序列和待估击键时间序列分别对应生成合法极相邻字符序列和待估极相邻字符；
所述模型训练模块用于根据所述合法击键行为和合法击键时间序列构建合法用户击键特征的用户模型；
所述持续认证模块用于将所述待估相邻字符序列与所述用户模型进行匹配，并根据匹配结果判断登录用户的所述待估击键行为是否合法，在待估击键行为不合法时生成警报并使登录用户重新登录；在待估击键行为合法时允许登录用户登录，同时存储所述待估击键行为，并反馈给所述模型训练模块更新所述用户模型；
所述模型库用于存储合法用户击键特征的用户模型。
优选的，所述数据采集模块还用于在采集合法击键行为，并生成合法时间间隔向量；
所述特征提取模块还用于遍历所述合法时间间隔向量，并根据所述合法时间间隔向量的两个相邻字符序列的时间间隔与预设临界时间间隔的大小生成极相邻字符；计算字符数量为2和3的所述极相邻字符所占的比重，并设置比重最大时的所述预设临界时间间隔为合法临界时间间隔；通过所述合法临界时间间隔重新生成合法极相邻字符序列，并记录所述合法极相邻字符序列的持续时间；
所述特征提取模块还用于提取所述合法极相邻字符序列的时间特征集，并构建所述合法极相邻字符序列服从的分布模型。
优选的，所述特征提取模块还用于生成所述待估击键行为的待估时间间隔向量；并结合所述合法临界间隔时间与所述待估时间间隔向量生成所述待估极相邻字符序列。
优选的，所述特征提取模块还用于获取所述待估击键时间序列，并将所述待估击键时间序列存入预设大小的缓冲区，当所述缓冲区满时，发送所述缓冲区中的所有所述估击键时间序列。
如上所述，本发明的自适应调制方法，具有以下有益效果：
本发明仅提取了用户少量的有代表性的击键特征，去除了大量冗余的击键特征序列，在保证认证准确率的同时，提高了持续认证的响应能力；在用户登陆网络账户时，实时监控用户的击键行为，为合法用户提供持续性的账户安全保障。
附图说明
图1显示为本发明基于击键行为的身份认证方法的流程方框图；
图2显示为图1中构建合法用户击键特征的用户模型的流程方框图；
图3显示为图1中生成待估极相邻字符序列的流程方框图；
图4显示为图1中认证过程的流程方框图；
图5显示为本发明基于击键行为的身份认证***的逻辑方框图；
图6显示为本发明的认证结果的曲线图。
具体实施方式
以下通过特定的具体实例说明本发明的实施方式，本领域技术人员可由本说明书所揭露的内容轻易地了解本发明的其他优点与功效。本发明还可以通过另外不同的具体实施方式加以实施或应用，本说明书中的各项细节也可以基于不同观点与应用，在没有背离本发明的精神下进行各种修饰或改变。
请参阅图1至图4。需要说明的是，本实施例中所提供的图示仅以示意方式说明本发明的基本构想，遂图式中仅显示与本发明中有关的组件而非按照实际实施时的组件数目、形状及尺寸绘制，其实际实施时各组件的型态、数量及比例可为一种随意的改变，且其组件布局型态也可能更为复杂。
如图1所示，本发明提供了一种基于击键行为的身份认证方法，包括以下步骤：S1、根据合法用户训练时的合法击键行为构建合法用户击键特征的用户模型；S2、采集登录用户击键时的待估击键行为生成待估击键时间序列；S3、根据待估击键时间序列生成待估极相邻字符序列；S4、将待估极相邻字符序列与用户模型进行匹配，并根据匹配结果判断登录用户的待估击键行为是否合法；若不合法，则生成警报并使登录用户重新登录，若合法，则允许登录用户登录，同时存储待估击键行为并更新用户模型。
在用户登陆网络账号后，监控器会实时地跟踪用户的击键行为，并记录下用户的击键行为时间序列。在用户模型的训练阶段，采集用户账号使用阶段的所有击键行为，并在用户账号登出后将数据发送。
用户的击键行为时间序列如表1所示，表1为用户击键行为日志表。其中down表示键被按下，up表示键弹起，Time表示键按下或弹起时的时间戳。
down up Time(ms)
h   0
e   138
  h 240
  e 335
l   524
表1
在特征提取时，首先会处理上传的击键行为日志，提取出用户击键的时间间隔向量。在用户模型的训练阶段，需要迭代时间间隔向量的特征值Interval＝<I1,I2,......Ip-1>，以挖掘出反映用户击键特征的临界间隔时间ɑ，并根据这一特征进一步挖掘出用户的极相邻字符序列。
所以，如图2所示，步骤S1还包括步骤：
S11、采集合法击键行为，并生成合法时间间隔向量；
S12、遍历合法时间间隔向量，并判断合法时间间隔向量的两个相邻字符序列的时间间隔是否小于预设临界时间间隔；遍历时间间隔特征向量Interval＝<I1,I2,......Ip-1>中的值，
若是，则两个相邻字符置于同一个极相邻字符；
若否，则以两个相邻字符中后一个字符为首字符，生成一个新的极相邻字符；
S13、计算字符数量为2和3的极相邻字符所占的比重，并设置比重最大时的预设临界时间间隔为合法临界时间间隔；
S14、通过合法临界时间间隔重新生成合法极相邻字符序列，并记录合法极相邻字符序列的持续时间。
提取出的极相邻字符序列入表2所示，表2为极相邻字符序列时间特征集表。
极相邻字符序列 持续时间/ms
app <749,758,693,725>
cm <270,280,260,250,240>
表2
优选地，构建合法用户击键特征的用户模型时，还包括了步骤：提取合法极相邻字符序列的时间特征集，并构建合法极相邻字符序列服从的分布模型。
优选地，如图3所示，步骤S3还包括步骤：
S31、采集待估击键行为；
S32、生成待估击键行为的待估时间间隔向量；
S33、结合合法临界间隔时间与待估时间间隔向量生成待估极相邻字符序列。
对于一个用户，假定其输入极相邻字符序列的持续时间服从于一个正态分布的过程。提取模块挖掘出的极相邻字符序列时间特征集，构建每个极相邻字符序列服从的正态分布模型。对于极相邻字符序列S的时间特征集合<S1,S2,S3,…,Sk-1,Sk>，利用最大似然估计的方法计算 期望和方差。其中，
Figure PCTCN2016070988-appb-000002
由合法用户的训练数据挖掘得到的极相邻字符序列及其服从的正态分布模型构成了用户模型的主要部分，临界时间间隔这一用户击键特征也是用户模型的一部分。
通过将待估击键行为数据与用户模型进行匹配，给出待估击键行为数据的评分，根据决策算法给出认证结果。当认证结果显示该击键行为数据属于合法用户时，该模块将此次待估数据挖掘出的极相邻字符序列的时间特征集存入缓冲区，待特征数量达到设定值时，便对模型库中对应的极相邻字符序列的模型进行更新。
进一步地，步骤S2还包括步骤：
获取待估击键时间序列，并将待估击键时间序列存入预设大小的缓冲区，当缓冲区满时，发送缓冲区中的所有估击键时间序列。在用户身份的持续认证阶段，数据采集模块会设定一个固定大小的字符序列缓冲区，当缓冲区满时，采集模块便将缓冲区中的数据提交给特征提取模块，以便进行身份认证，案例中缓冲区的窗口值大小为30个字符。
优选地，高斯概率密度函数是一种相似度评价的函数，在用户认证中，用于评价待估的极相邻字符序列与用户模型中的极相邻字符序列的相似度。步骤S4中待估极相邻字符序列与用户模型通过高斯模型进行匹配，匹配根据的评分公式为：
Figure PCTCN2016070988-appb-000003
其中，tS’表示待估极相邻字符序列，而μS和σS分别为高斯模型中高斯分布的期望和标准差；
入图4所示，判断登录用户的待估击键行为是否合法的步骤还包括：
计算单个待估极相邻字符序列的评分，再去除低于预设值的评分后将评分汇总，比较汇总后的评分是否大于阈值；若是，则允许登录，同时存储待估击键行为并更新用户模型；若否，则发出警告并重新登录。
如图5所示，本发明还提供了一种基于击键行为的身份认证***，包括数据采集模块、特征提取模块、模型训练模块、持续认证模块和模型库；
数据采集模块用于采集合法用户合法击键行为时的合法击键时间序列和登录用户击键时的待估击键行为生成的的待估击键时间序列，并将合法击键时间序列和待估击键时间序列发送至特征提取模块；
特征提取模块用于根据合法击键时间序列和待估击键时间序列分别对应生成合法极相邻 字符序列和待估极相邻字符；
模型训练模块用于根据合法击键行为和合法击键时间序列构建合法用户击键特征的用户模型；
持续认证模块用于将待估相邻字符序列与用户模型进行匹配，并根据匹配结果判断登录用户的待估击键行为是否合法，在待估击键行为不合法时生成警报并使登录用户重新登录；在待估击键行为合法时允许登录用户登录，同时存储待估击键行为，并反馈给模型训练模块更新用户模型。
模型库用于存储合法用户击键特征的用户模型。
优选地，数据采集模块还用于在采集合法击键行为，并生成合法时间间隔向量；
特征提取模块还用于遍历合法时间间隔向量，并根据合法时间间隔向量的两个相邻字符序列的时间间隔与预设临界时间间隔的大小生成极相邻字符；计算字符数量为2和3的极相邻字符所占的比重，并设置比重最大时的预设临界时间间隔为合法临界时间间隔；通过合法临界时间间隔重新生成合法极相邻字符序列，并记录合法极相邻字符序列的持续时间；
特征提取模块还用于提取合法极相邻字符序列的时间特征集，并构建合法极相邻字符序列服从的分布模型。
优选地，特征提取模块还用于生成待估击键行为的待估时间间隔向量；并结合合法临界间隔时间与待估时间间隔向量生成待估极相邻字符序列。
优选地，特征提取模块还用于获取待估击键时间序列，并将待估击键时间序列存入预设大小的缓冲区，当缓冲区满时，发送缓冲区中的所有估击键时间序列。
用户击键行为认证方法主要由数据采集模块、特征提取模块、模型训练模块和持续认证模块构成。数据采集模块负责采集用户击键时的击键时间序列；特征提取模块负责挖掘用户的极相邻字符序列；模型训练模块根据合法用户训练数据的时间特征构建用户击键特征的高斯模型；持续认证模块根据用户键入的一段字符序列进行决策评分，以判断用户身份的合法性，同时它存储合法用户的最近一段时间的击键行为特征，当特征数量满足一定条件时，便用新的特征来构建模型，并对模型库中对应的序列模型进行更新。
数据采集模块：在用户登陆网络账号后，监控器会实时地跟踪用户的击键行为，并记录下用户的击键行为时间序列。在用户模型的训练阶段，数据采集模块会采集用户账号使用阶段的所有击键行为，并在用户账号登出后将数据发送给特征提取模块。而在用户身份的持续认证阶段，数据采集模块会设定一个固定大小的字符序列缓冲区，当缓冲区满时，采集模块便将缓冲区中的数据提交给特征提取模块，以便进行身份认证，案例中缓冲区的窗口值大小 为30个字符。
特征提取模块：该模块首先会处理采集模块上传的击键行为日志，提取出用户击键的时间间隔向量。在用户模型的训练阶段，特征提取模块需要迭代时间间隔向量的特征值Interval＝<I1,I2,......Ip-1>，以挖掘出反映用户击键特征的临界间隔时间ɑ，并根据这一特征进一步挖掘出用户的极相邻字符序列。
模型训练模块：对于一个用户，假定其输入极相邻字符序列的持续时间服从于一个正态分布的过程。该模块利用特征提取模块挖掘出的极相邻字符序列时间特征集，构建每个极相邻字符序列服从的正态分布模型。对于极相邻字符序列S的时间特征集合<S1,S2,S3,…,Sk-1,Sk>，利用最大似然估计的方法计算期望和方差。
其中，
Figure PCTCN2016070988-appb-000004
由合法用户的训练数据挖掘得到的极相邻字符序列及其服从的正态分布模型构成了用户模型的主要部分，临界时间间隔这一用户击键特征也是用户模型的一部分。
持续认证模块：该模块通过将待估击键行为数据与用户模型进行匹配，给出待估击键行为数据的评分，根据决策算法给出认证结果。当认证结果显示该击键行为数据属于合法用户时，该模块将此次待估数据挖掘出的极相邻字符序列的时间特征集存入缓冲区，待特征数量达到设定值时，便对模型库中对应的极相邻字符序列的模型进行更新。
高斯概率密度函数是一种相似度评价的函数，在用户认证中，用于评价待估的极相邻字符序列与用户模型中的极相邻字符序列的相似度。根据高斯概率密度函数给出评分公式:
Figure PCTCN2016070988-appb-000005
其中tS’表示待估击键行为数据中根据用户的临界时间间隔ɑ，挖掘出的极相邻字符序列，而μS，σS分别为用户模型中对应的序列的高斯分布的期望和标准差。
如图6所示，在本发明的一实施例中，使用本发明基于击键行为的身份认证方法和***的认证结果的ROC曲线表明了本发明的认证方法和***在误报率达5.3％的情况下，检测率高达90％以上，能够有效的对用户身份的合法性进行判别，保障用户账号的安全。
综上，本发明，仅提取了用户少量的有代表性的击键特征，去除了大量冗余的击键特征序列，在保证认证准确率的同时，提高了持续认证的响应能力；在用户登陆网络账户时，实时监控用户的击键行为，为合法用户提供持续性的账户安全保障。
上述实施例仅例示性说明本发明的原理及其功效，而非用于限制本发明。任何熟悉此技术的人士皆可在不违背本发明的精神及范畴下，对上述实施例进行修饰或改变。因此，举凡所属技术领域中具有通常知识者在未脱离本发明所揭示的精神与技术思想下所完成的一切等效修饰或改变，仍应由本发明的权利要求所涵盖。

Claims (10)

  1. 一种基于击键行为的身份认证方法，其特征在于，包括以下步骤：
    S1、根据合法用户训练时的合法击键行为构建合法用户击键特征的用户模型；
    S2、采集登录用户击键时的待估击键行为生成待估击键时间序列；
    S3、根据所述待估击键时间序列生成待估极相邻字符序列；
    S4、将所述待估极相邻字符序列与所述用户模型进行匹配，并根据匹配结果判断登录用户的所述待估击键行为是否合法；若不合法，则生成警报并使登录用户重新登录，若合法，则允许登录用户登录，同时存储所述待估击键行为并更新所述用户模型。
  2. 根据权利要求1所述的基于击键行为的身份认证方法，其特征在于，所述步骤S1还包括步骤：
    S11、采集合法击键行为，并生成合法时间间隔向量；
    S12、遍历所述合法时间间隔向量，并判断所述合法时间间隔向量的两个相邻字符序列的时间间隔是否小于预设临界时间间隔；
    若是，则所述两个相邻字符置于同一个极相邻字符；
    若否，则以所述两个相邻字符中后一个字符为首字符，生成一个新的所述极相邻字符；
    S13、计算字符数量为2和3的所述极相邻字符所占的比重，并设置比重最大时的所述预设临界时间间隔为合法临界时间间隔；
    S14、通过所述合法临界时间间隔重新生成合法极相邻字符序列，并记录所述合法极相邻字符序列的持续时间。
  3. 根据权利要求2所述的基于击键行为的身份认证方法，其特征在于，所述步骤S1还包括步骤：
    提取所述合法极相邻字符序列的时间特征集，并构建所述合法极相邻字符序列服从的分布模型。
  4. 根据权利要求3所述的基于击键行为的身份认证方法，其特征在于，所述步骤S3还包括步骤：
    S31、采集所述待估击键行为；
    S32、生成所述待估击键行为的待估时间间隔向量；
    S33、结合所述合法临界间隔时间与所述待估时间间隔向量生成所述待估极相邻字符序列。
  5. 根据权利要求1所述的基于击键行为的身份认证方法，其特征在于，所述步骤S2还包括步骤：
    获取所述待估击键时间序列，并将所述待估击键时间序列存入预设大小的缓冲区，当所述缓冲区满时，发送所述缓冲区中的所有所述估击键时间序列。
  6. 根据权利要求1至5任一项所述的基于击键行为的身份认证方法，其特征在于，所述步骤S4中所述待估极相邻字符序列与所述用户模型通过高斯模型进行匹配，所述匹配根据的评分公式为：
    Figure PCTCN2016070988-appb-100001
    其中，tS’表示待估极相邻字符序列，而μS和σS分别为所述高斯模型中高斯分布的期望和标准差；
    所述判断登录用户的所述待估击键行为是否合法的步骤还包括：
    计算单个待估极相邻字符序列的评分，再去除低于预设值的所述评分后将所述评分汇总，比较汇总后的所述评分是否大于阈值；若是，则允许登录，同时存储所述待估击键行为并更新所述用户模型；若否，则发出警告并重新登录。
  7. 一种基于击键行为的身份认证***，其特征在于，包括数据采集模块、特征提取模块、模型训练模块、持续认证模块和模型库；
    所述数据采集模块用于采集合法用户合法击键行为时的合法击键时间序列和登录用户击键时的待估击键行为生成的的待估击键时间序列，并将所述合法击键时间序列和待估击键时间序列发送至所述特征提取模块；
    所述特征提取模块用于根据所述合法击键时间序列和待估击键时间序列分别对应生成合法极相邻字符序列和待估极相邻字符；
    所述模型训练模块用于根据所述合法击键行为和合法击键时间序列构建合法用户击键特征的用户模型；
    所述持续认证模块用于将所述待估相邻字符序列与所述用户模型进行匹配，并根据匹配结果判断登录用户的所述待估击键行为是否合法，在待估击键行为不合法时生成警报并使登 录用户重新登录；在待估击键行为合法时允许登录用户登录，同时存储所述待估击键行为，并反馈给所述模型训练模块更新所述用户模型；
    所述模型库用于存储合法用户击键特征的用户模型。
  8. 根据权利要求7所述的基于击键行为的身份认证***，其特征在于，
    所述数据采集模块还用于在采集合法击键行为，并生成合法时间间隔向量；
    所述特征提取模块还用于遍历所述合法时间间隔向量，并根据所述合法时间间隔向量的两个相邻字符序列的时间间隔与预设临界时间间隔的大小生成极相邻字符；计算字符数量为2和3的所述极相邻字符所占的比重，并设置比重最大时的所述预设临界时间间隔为合法临界时间间隔；通过所述合法临界时间间隔重新生成合法极相邻字符序列，并记录所述合法极相邻字符序列的持续时间；
    所述特征提取模块还用于提取所述合法极相邻字符序列的时间特征集，并构建所述合法极相邻字符序列服从的分布模型。
  9. 根据权利要求8所述的基于击键行为的身份认证***，其特征在于，
    所述特征提取模块还用于生成所述待估击键行为的待估时间间隔向量；并结合所述合法临界间隔时间与所述待估时间间隔向量生成所述待估极相邻字符序列。
  10. 根据权利要求7所述的基于击键行为的身份认证***，其特征在于，
    所述特征提取模块还用于获取所述待估击键时间序列，并将所述待估击键时间序列存入预设大小的缓冲区，当所述缓冲区满时，发送所述缓冲区中的所有所述估击键时间序列。
PCT/CN2016/070988 2015-10-22 2016-01-15 基于击键行为的身份认证方法和*** WO2017067103A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
AU2018100672A AU2018100672A4 (en) 2015-10-22 2018-05-18 Keystroke behaviour-based identity authentication method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510694805.5A CN105429937B (zh) 2015-10-22 2015-10-22 基于击键行为的身份认证方法和***
CN201510694805.5 2015-10-22

Related Child Applications (1)

Application Number Title Priority Date Filing Date
AU2018100672A Division AU2018100672A4 (en) 2015-10-22 2018-05-18 Keystroke behaviour-based identity authentication method and system

Publications (1)

Publication Number Publication Date
WO2017067103A1 true WO2017067103A1 (zh) 2017-04-27

Family

ID=55507879

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/070988 WO2017067103A1 (zh) 2015-10-22 2016-01-15 基于击键行为的身份认证方法和***

Country Status (2)

Country Link
CN (1) CN105429937B (zh)
WO (1) WO2017067103A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111209551A (zh) * 2020-01-15 2020-05-29 国网河北省电力有限公司信息通信分公司 一种身份认证方法及装置
CN112491875A (zh) * 2020-11-26 2021-03-12 四川长虹电器股份有限公司 基于账号体系的智能跟踪安全检测方法及***

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106039711B (zh) * 2016-05-17 2019-05-14 网易（杭州）网络有限公司 一种用户身份认证方法和装置
CN106911668B (zh) * 2017-01-10 2020-07-14 同济大学 一种基于用户行为模型的身份认证方法及***
CN108304703A (zh) * 2018-01-31 2018-07-20 苏州锦佰安信息技术有限公司 一种用于Windows的验证用户身份的方法和装置
CN109063431B (zh) * 2018-06-21 2021-10-22 西安理工大学 加权击键特征曲线差异度的用户身份识别方法
WO2020000346A1 (en) * 2018-06-29 2020-01-02 Huawei Technologies Co., Ltd. Intruder detection method and apparatus
CN109327597A (zh) * 2018-08-03 2019-02-12 奇酷互联网络科技（深圳）有限公司 移动终端和私密***的进入的方法、装置
CN109446780B (zh) * 2018-11-01 2020-11-27 北京知道创宇信息技术股份有限公司 一种身份认证方法、装置及其存储介质
CN109871673B (zh) * 2019-03-11 2020-11-10 重庆邮电大学 基于不同上下文环境中的持续身份认证方法和***
CN110570199B (zh) * 2019-07-24 2022-10-11 中国科学院信息工程研究所 一种基于用户输入行为的用户身份检测方法及***
CN111209552A (zh) * 2020-04-20 2020-05-29 国网电子商务有限公司 一种基于用户行为的身份认证方法及装置
CN111984952A (zh) * 2020-09-03 2020-11-24 四川长虹电器股份有限公司 一种基于hmm的用户输入行为异常识别方法
CN112100597A (zh) * 2020-09-07 2020-12-18 紫光云(南京)数字技术有限公司 一种通过键盘敲击节奏进行生物特征认证的登陆认证方法
CN112100598A (zh) * 2020-09-08 2020-12-18 紫光云(南京)数字技术有限公司 通过鼠标及键盘敲击节奏进行登陆认证的识别方法及装置
CN112507299B (zh) * 2020-12-04 2022-05-03 重庆邮电大学 持续身份认证***中的自适应击键行为认证方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101478401A (zh) * 2009-01-21 2009-07-08 东北大学 一种基于击键特征识别的认证方法及***
CN101833619A (zh) * 2010-04-29 2010-09-15 西安交通大学 基于键鼠交叉认证的身份判定方法
CN103646197A (zh) * 2013-12-12 2014-03-19 中国石油大学(华东) 基于用户行为的用户可信度认证***及方法
CN104318136A (zh) * 2014-09-29 2015-01-28 同济大学 用户键盘按键行为模式建模与分析***及其身份识别方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101557287A (zh) * 2008-04-07 2009-10-14 冀连有 一种根据用户击键特征进行身份认证的方法
EP2646904B1 (en) * 2010-11-29 2018-08-29 BioCatch Ltd. Method and device for confirming computer end-user identity
CN104809377B (zh) * 2015-04-29 2018-01-05 西安交通大学 基于网页输入行为特征的网络用户身份监控方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101478401A (zh) * 2009-01-21 2009-07-08 东北大学 一种基于击键特征识别的认证方法及***
CN101833619A (zh) * 2010-04-29 2010-09-15 西安交通大学 基于键鼠交叉认证的身份判定方法
CN103646197A (zh) * 2013-12-12 2014-03-19 中国石油大学(华东) 基于用户行为的用户可信度认证***及方法
CN104318136A (zh) * 2014-09-29 2015-01-28 同济大学 用户键盘按键行为模式建模与分析***及其身份识别方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111209551A (zh) * 2020-01-15 2020-05-29 国网河北省电力有限公司信息通信分公司 一种身份认证方法及装置
CN111209551B (zh) * 2020-01-15 2022-10-14 国网河北省电力有限公司信息通信分公司 一种身份认证方法及装置
CN112491875A (zh) * 2020-11-26 2021-03-12 四川长虹电器股份有限公司 基于账号体系的智能跟踪安全检测方法及***
CN112491875B (zh) * 2020-11-26 2022-07-08 四川长虹电器股份有限公司 基于账号体系的智能跟踪安全检测方法及***

Also Published As

Publication number Publication date
CN105429937A (zh) 2016-03-23
CN105429937B (zh) 2018-07-06

Similar Documents

Publication Publication Date Title
WO2017067103A1 (zh) 基于击键行为的身份认证方法和***
US20200195667A1 (en) Url attack detection method and apparatus, and electronic device
Giot et al. Web-based benchmark for keystroke dynamics biometric systems: A statistical analysis
Banerjee et al. Biometric authentication and identification using keystroke dynamics: A survey
TWI592820B (zh) Man-machine recognition method and system
JP6511293B2 (ja) ユーザ監視システム
WO2021135445A1 (zh) 弹幕生成方法、装置和计算机可读存储介质
US20160335425A1 (en) Classifier training method and apparatus, identity authentication method and system
CN106650350B (zh) 一种身份认证方法及***
WO2019136850A1 (zh) 风险行为识别方法、存储介质、设备及***
US9225738B1 (en) Markov behavior scoring
CN105117622B (zh) 使用视频签名的认证的方法及***
US20170171188A1 (en) Non-transitory computer-readable recording medium, access monitoring method, and access monitoring apparatus
US11630886B2 (en) Computer security forensics based on temporal typing changes of authentication credentials
CN116957049B (zh) 基于对抗自编码器的无监督内部威胁检测方法
Mhenni et al. Analysis of Doddington zoo classification for user dependent template update: Application to keystroke dynamics recognition
Alshanketi et al. Multimodal mobile keystroke dynamics biometrics combining fixed and variable passwords
CN102354354A (zh) 一种基于信息指纹技术的图片密码生成认证方法
AU2018100672A4 (en) Keystroke behaviour-based identity authentication method and system
Senathipathi et al. An analysis of particle swarm optimization and genetic algorithm with respect to keystroke dynamics
CN106039711A (zh) 一种用户身份认证方法和装置
CN110636082B (zh) 一种入侵检测方法及装置
Zhang et al. Mahalanobis distance similarity measure based distinguisher for template attack
Tsimperidis et al. Keystroke forensics: are you typing on a desktop or a laptop?
US20240134949A1 (en) System, apparatus, and method for automatically generating negative keystroke examples and training user identification models based on keystroke dynamics

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16856551

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 17/10/2018)

122 Ep: pct application non-entry in european phase

Ref document number: 16856551

Country of ref document: EP

Kind code of ref document: A1