Deep learning improves continuous authentication by monitoring keystroke changes
Deep Learning Based Behavioral Drift Modeling for Continuous Biometric Authentication
Cryptography and SecurityHuman-Computer InteractionMachine Learning
Summary
People’s typing styles change subtly over time, which can make it hard for computers to tell if the same person is typing during extended sessions. The authors created a two-part system where the first part uses deep learning to recognize a password typed in a fixed way, and the second part continuously checks how the user types naturally. If the typing behavior changes suspiciously, the system asks for the password again to confirm the user’s identity. This approach helps catch unauthorized users who take over a session and adapts to natural changes in typing habits.
What this means in practice
- •For security software developers: Enhance user login systems by adding continuous keystroke behavior monitoring to detect session hijacking and suspicious activity during use.
- •For enterprise it security teams: Integrate adaptive keystroke authentication to maintain user identity verification throughout long sessions in corporate environments.
Authors
Suprava Saha Dibya, Minar, Abdulla Al Noman, Md. Zafir Abid Shresto, Ahmed Sayef
Abstract
This research proposes a two-level keystroke dynamics authentication system that provides defense-in-depth security through continuous behavioral drift monitoring. Level 1 employs fixed-text password authentication using Temporal Convolutional Networks (TCN) with contrastive learning and population-based training (PBT), achieving 3.77% EER for high-security login verification. Upon successful authentication, Level 2 continuously monitors user typing during natural free-text sessions using a 4-Model Deep Learning Ensemble. If suspicious behavioral drift is detected during monitoring, the system re-authenticates the user by returning to Level 1, providing a feedback loop against session hijacking and behavioral anomalies. The system explicitly models long-term behavioral drift through the fixed-text component's PBT mechanism, which adapts to temporal variations in password typing patterns. This research leverages free-text (Buffalo dataset) and fixed-text (GREYC dataset) keystroke dynamics datasets, extracting temporal and spatial features including hold times, up-down latencies, down-down intervals, and trigram patterns. The final system achieves 96%+ accuracy for fixed-text authentication (3.77% EER) and 83.53% True Acceptance Rate (TAR) at 5% False Acceptance Rate (FAR) for free-text continuous authentication (10.05% EER), demonstrating superior performance and strong resistance to impostor attacks through continuous behavioral monitoring.