I can be You: Questioning the use of Keystroke Dynamics as Biometrics
I can be You: Questioning the use of Keystroke Dynamics as Biometrics
复制标题
我可以成为你：质疑击键动力学作为生物识别技术的使用
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
Debin Gao
中科院分区：
文献类型：
--
作者：
Chee Meng Tey;Payas Gupta;Debin Gao
击键动态指的是有关个人打字模式的信息，例如个人按下和释放每个键时的相对时间。先前的研究表明，这种模式是独特的，不能轻易模仿。这为在认证系统中使用生物识别技术奠定了基础。迄今为止，这一领域的研究工作主要集中在新的检测技术，以区分合法用户和冒名顶替者。在本文中，我们展示了一种新的反馈和培训接口名为Mimesis。Mimesis对提交的模式与参考模式之间的差异提供了积极和消极的反馈。这允许一个人通过逐渐调整打字模式来模仿另一个人。我们表明，即使对于其键入模式仅部分已知的目标，使用Mimesis进行训练也可以让攻击者击败使用生物识别技术的最佳异常检测引擎之一。对于一组84名参与者扮演攻击者的角色和2个不同难度的8字符密码，容易和困难的密码的错误接受率（FAR）分别从0.24和0.20（Mimesis训练前）分别增加到0.63和0.42（Mimesis训练后，受害者的部分信息）。在完整信息的情况下，14个最佳攻击者的两个密码的FAR增加到0.99。
Keystroke dynamics refer to information about the typing patterns of individuals, such as the relative timing when the individual presses and releases each key. Prior studies suggest that such patterns are unique and cannot be easily imitated. This lays the foundation for the use of keystroke biometrics in authentication systems. The research effort in this area has thus far focused on novel detection techniques to differentiate between legitimate users and imposters. In this paper, we demonstrate a novel feedback and training interface named Mimesis. Mimesis provides both positive and negative feedback on the differences between a submitted pattern vs. a reference pattern. This allows one person to imitate another through incremental adjustment of typing pattern. We show that even for targets whose typing patterns are only partially known, training with Mimesis allows attackers to defeat one of the best anomaly detection engines using keystroke biometrics. For a group of 84 participants playing the role of attackers and 2 eight-character passwords of different difficulty, the false acceptance rate (FAR) of the easy and difficult password increases from 0.24 and 0.20 respectively (before Mimesis training) to 0.63 and 0.42 respectively (after Mimesis training with partial information of the victim). With full information, the FAR increases to 0.99 for both passwords for the 14 best attackers.