Method and apparatus for verification of a computer user's identification, based on keystroke characteristics

• US 5,557,686 A
• Filed: 01/13/1993
• Issued: 09/17/1996
• Est. Priority Date: 01/13/1993
• Status: Expired due to Term

• Current Assignee: Tangle Limited BH LLC (Intellectual Ventures LLC)
• Original Assignee: University of Alabama (University of Alabama System)
• Inventors: Brown, Marcus E., Rogers, Samuel J.
• Primary Examiner(s): NOT, DEFINED
• Assistant Examiner(s): NOT, DEFINED
• Application Number:
  US08/004,135
• Time in Patent Office: 1,343 Days
• Field of Search: 382/2, 382/30, 382/14, 382/15, 382/115, 382/209, 382/156, 382/159, 382/157, 382/160, 340/825.31, 340/825.34, 395/22, 395/23
• US Class Current: 382/115
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G07C 9/33 by means of a password

Abstract

A method and apparatus for determining whether a user of a system is an authorized user or an imposter by examining the keystroke characteristics of the user. The authorized user initially enters a number of user training samples on a keyboard. The user training samples are then purified to eliminate training samples which are different from other training samples. The purification can be performed by a self-organizing neural network which has input thereto, authorized user training samples, or both authorized training samples and imposter training samples. The purified user training samples are then compared to a sample to be tested to determine whether the sample is from an authorized user or an imposter. The comparison of the purified samples with the sample to be tested can be performed by a neural network such as a back propagation trained network, an ADALINE unit, a distance method or a linear classifier, discriminate function, or piecewise linear classifier. The result of this testing step indicates whether the user is authorized or an imposter and the user can be granted or denied access to the system.

Claims

1. A method for verifying whether a user of a system is authorized using keystroke information, comprising the steps:

creating user training signals from keystroke characteristics of the user, each of said user training signals including a plurality of different portions constructed from keystrokes;

purifying said user training signals by determining variances of the portions of the user training signals, and discarding a same portion of each of said user training signals when the variance of said same portion is above a predetermined threshold;

inputting a signal to be tested containing keystroke data;

determining a similarity between the input signal to be tested and the purified user training signals; and

allowing access to the system if said input signal to be tested and said purified user training signals are determined to have at least a predetermined threshold of similarity.

2. A method for verifying whether a user of a system is authorized using keystroke information according to claim 1, further comprising the step:

creating imposter training signals from a keystroke source; and

wherein the purifying step examines both said imposter training signals and said user training signals to purify said user training signals.

3. A method for verifying whether a user of a system is authorized using keystroke information according to claim 2, wherein the purifying step uses a self-organizing neural network to group said imposter training signals and said user training signals into clusters having similar keystroke characteristics.

4. A method for verifying whether a user of a system is authorized using keystroke information according to claim 2, further comprising the step of:

training an ADALINE processing element using said purified signals and said imposter signals; and

wherein said step of determining a similarity uses the trained ADALINE processing element to determine said similarity.

5. A method for verifying whether a user of a system is authorized using keystroke information according to claim 2, further comprising the step of:

training a back propagation neural network using said purified signals and said imposter signals; and

wherein said step of determining a similarity uses the trained back propagation neural network to determine said similarity.

6. A method for verifying whether a user of a system is authorized using keystroke information according to claim 1, wherein the determining step uses a distance method to determine a distance between a vector representative of the signal to be tested and a vector representative of at least one user training signal and if said determined distance is less than a predetermined distance, allowing access to the system.

7. A method for verifying whether a user of a system is authorized using keystroke information according to claim 1, further comprising the step of:

determining time periods between keystrokes used to create said user training and input signals; and

wherein each of said signals comprises information relating to said timing periods.

8. A method for verifying whether a user of a system is authorized using keystroke information according to claim 7, wherein each of said signals comprises digraph latency time information.

9. A method for verifying whether a user of a system is authorized using keystroke information according to claim 8, wherein each of said signals further comprises key hold time information.

10. A method for verifying whether a user of a system is authorized using keystroke information according to claim 1, further comprising the step:

prohibiting access to the system if said input signal to be tested and said purified user training signals are determined to have less than said predetermined threshold of similarity.

11. A method for verifying whether a user of a system is authorized using keystroke information according to claim 1, further comprising the step:

updating a profile of the purified user training signals by adjusting the profile using the input signal when the input signal is determined to have at least said predetermined threshold of similarity.

12. An apparatus for verifying whether a user of a system is authorized using keystroke information, comprising:

a keyboard;

means for creating user training samples from keystroke characteristics of the user, including at least one of a timer for determining timing characteristics of keystrokes and pressure sensors for detecting pressure characteristics of keystrokes, each of said user training samples including a plurality of different portions constructed from keystrokes;

means for purifying said user training samples by determining variances of the portions of the user training samples, and discarding a same portion of each of said user training samples when the variance of said same portion is above a predetermined threshold;

means for inputting a sample to be tested containing keystroke characteristics;

means for determining a similarity between the input sample to be tested and the purified user training samples; and

means for allowing access to the system if said input sample to be tested and said purified user training samples are determined to have at least a predetermined threshold of similarity.

13. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 12, further comprising:

means for creating imposter training samples from a keystroke source; and

wherein the purifying means examines both said imposter training samples and said user training samples.

14. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 13, wherein the purifying means comprises a self-organizing neural network for grouping said imposter training samples and said user training samples into clusters having similar keystroke characteristics.

15. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 13, further comprising:

means for training an ADALINE processing element using said purified samples and said imposter samples; and

wherein said determining means uses the trained ADALINE processing element to determine said similarity.

16. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 13, further comprising:

means for training a back propagation neural network using said purified samples and said imposter samples; and

wherein said determining means uses the trained back propagation neural network to determine said similarity.

17. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 12, wherein the determining means uses a distance determining method to determine a distance between a vector representative of the sample to be tested and a vector representative of at least one user training sample and if said determined distance is less than a predetermined distance, allowing access to the system.

18. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 12, wherein said means for creating user training samples create said user training samples to have digraph latency time information.

19. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 18, wherein said means for creating user training samples creates said user training samples to have key hold time information.

20. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 12, further comprising:

means for prohibiting access to the system if said input sample to be tested and said purified user training samples are determined to have less than said predetermined threshold of similarity.

21. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 12, further comprising:

means for updating a profile of the purified user training samples by adjusting the profile using the input sample when the input sample is determined to have at least said predetermined threshold of similarity.

22. A method for verifying whether a user of a system is authorized using keystroke information, comprising the steps:

creating user training signals from keystroke characteristics of the user, each of said user training signals including a plurality of different portions constructed from keystrokes;

creating imposter training signals from a keystroke source;

purifying said user training signals by determining variances of the portions of the user training signals, and discarding a same portion of each of said user training signals when the variance of said same portion is above a predetermined threshold;

training an ADALINE processing element using said user training signals and said imposter training signals;

inputting a signal to be tested contain keystroke data;

determining a similarity between the input signal to be tested and the purified user training signals using said trained ADALINE processing element; and

allowing access to the system if said input signal to be tested and said purified user training signals are determined to have at least a predetermined threshold of similarity using said trained ADALINE processing element.

23. A method for verifying whether a user of a system is authorized using keystroke information according to claim 22, wherein the purifying step uses a self-organizing neural network to group said imposter training signals and said user training signals into clusters having similar keystroke characteristics.

24. A method for verifying whether a user of a system is authorized using keystroke information according to claim 22, wherein the purifying step performs a statistical analysis to eliminate at least one user training signal which is statistically different from other user training signals.

25. A method for verifying whether a user of a system is authorized using keystroke information according to claim 22, further comprising the step of:

determining time periods between keystrokes used to create said signals; and

wherein each of said signals comprises information relating to said time signals.

26. A method for verifying whether a user of a system is authorized using keystroke information according to claim 22, wherein each of said signals comprises digraph latency time information.

27. A method for verifying whether a user of a system is authorized using keystroke information according to claim 26, wherein each of said signals further comprises key hold time information.

28. A method for verifying whether a user of a system is authorized using keystroke information according to claim 22, further comprising the step:

prohibiting access to the system if said input signal to be tested and said purified user training signals are determined to have less than said predetermined threshold of similarity.

29. A method for verifying whether a user of a system is authorized using keystroke information according to claim 22, further comprising the step:

updating a profile of the purified user training signals by adjusting the profile using the input signal when the input signal is determined to have at least said predetermined threshold of similarity.

30. An apparatus for verifying whether a user of a system is authorized using keystroke information, comprising:

a keyboard;

means for creating user training samples from keystroke characteristics of the user, including at least one of a timer for determining timing characteristics of keystrokes, pressure sensors for detecting pressure characteristics of keystrokes, and accelerometers for detecting acceleration characteristics of keystrokes, each of said user training samples including a plurality of different portions constructed from keystrokes;

means for creating imposter training samples from a keystroke source;

means for purifying said user training samples by determining variances of the portions of the user training samples, and discarding a same portion of each of said user training samples when the variance of said same portion is above a predetermined threshold;

means for training an ADALINE processing element using said user training samples and said imposter training samples;

means for inputting a sample to be tested containing keystroke characteristics;

means for determining a similarity between the input sample to be tested and the purified user training samples, said means for determining including said trained ADALINE processing element; and

means for allowing access to the system if said input sample to be tested and said purified user training samples are determined to have at least a predetermined threshold of similarity by said means for determining including said trained ADALINE processing element.

31. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 30, wherein the purifying means comprises a self-organizing neural network for grouping said imposter training samples and said user training samples into clusters having similar keystroke characteristics.

32. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 30, wherein the purifying means performs a statistical analysis to eliminate at least one user training sample which is statistically different from other user training samples.

33. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 30, wherein said means for creating user training samples creates said user training samples to have digraph latency time information.

34. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 33, wherein said means for creating user training samples creates said user training samples to further have key hold time information.

35. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 30, further comprising:

means for prohibiting access to the system if said input sample to be tested and said purified user training samples are determined to have less than said predetermined threshold of similarity.

36. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 30, further comprising:

means for updating a profile of the purified user training samples by adjusting the profile using the input sample when the input sample is determined to have at least said predetermined threshold of similarity.

37. A method for verifying whether a user of a system is authorized using keystroke information, comprising the steps:

creating user training signals from keystroke characteristics of the user, each of said user training signals including a plurality of different portions constructed from keystrokes;

creating imposter training signals from a keystroke source;

purifying said user training signals by determining variances of the portions of the user training signals, and discarding a same portion of each of said user training signals when the variance of said same portion is above a predetermined threshold;

training a back propagation neural network using said user training signals and said imposter training signals;

inputting a signal to be tested containing keystroke characteristics;

determining a similarity between the input signal to be tested and the purified user training signals using said trained back propagation neural network; and

allowing access to the system if said input signal to be tested and said purified user training signals are determined to have at least a predetermined threshold of similarity using said trained back propagation neural network.

38. A method for verifying whether a user of a system is authorized using keystroke information according to claim 37, wherein the purifying step uses a self-organizing neural network to group said imposter training signals and said user training signals into clusters having similar keystroke characteristics.

39. A method for verifying whether a user of a system is authorized using keystroke information according to claim 37, wherein the purifying step performs a statistical analysis to eliminate at least one user training signal which is statistically different from other user training signals.

40. A method for verifying whether a user of a system is authorized using keystroke information according to claim 37, further comprising the step of:

determining time periods between keystrokes used to create said signals; and

wherein each of said signals comprises information relating to said time periods.

41. A method for verifying whether a user of a system is authorized using keystroke information according to claim 40, wherein each of said signals comprises digraph latency time information.

42. A method for verifying whether a user of a system is authorized using keystroke information according to claim 41, wherein each of said signals further comprises key hold time information.

43. A method for verifying whether a user of a system is authorized using keystroke information according to claim 37, further comprising the step:

prohibiting access to the system if said input signal to be tested and said purified user training signals are determined to have less than said predetermined threshold of similarity.

44. A method for verifying whether a user of a system is authorized using keystroke information according to claim 37, further comprising the step:

updating a profile of the purified user training signals by adjusting the profile using the input signal when the input signal is determined to have at least said predetermined threshold of similarity.

45. An apparatus for verifying whether a user of a system is authorized using keystroke information, comprising:

a keyboard;

means for creating user training samples from keystroke characteristics of the user including at least one of a timer for determining timing characteristics of keystrokes and pressure sensors for detecting pressure characteristics of keystrokes, each of said user training samples including a plurality of different portions constructed from keystrokes;

means for creating imposter training samples from a keystroke source;

means for purifying said user training samples by determining variances of the portions of the user training samples, and discarding a same portion of each of said user training samples when the variance of said same portion is above a predetermined threshold;

means for training a back propagation neural network using said user training samples and said imposter training samples;

means for inputting a sample to be tested containing keystroke characteristics;

means for determining a similarity between the input sample to be tested and the purified user training samples, said means for determining including said trained back propagation neural network; and

means for allowing access to the system if said input sample to be tested and said purified user training samples are determined to have at least a predetermined threshold of similarity by said means for determining including said trained back propagation neural network.

46. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 45, wherein the purifying means comprises a self-organizing neural network for grouping said imposter training samples and said user training samples into clusters having similar keystroke characteristics.

47. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 45, wherein the purifying means performs a statistical analysis to eliminate at least one user training sample which is statistically different from other user training samples.

48. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 45, wherein said means for creating user training samples creates said user training samples to have digraph latency time information.

49. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 48, wherein said means for creating user training samples creates said user training samples to further have key hold time information.

50. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 45, further comprising:

means for prohibiting access to the system if said input sample to be tested and said purified user training samples are determined to have less than said predetermined threshold of similarity.

51. An apparatus for verifying whether a user of a system is authorized using keystroke information according to claim 45, further comprising:

means for updating a profile of the purified user training samples by adjusting the profile using the input sample when the input sample is determined to have at least said predetermined threshold of similarity.