Source-linked AI summary
Transfer Learning of Keystroke Dynamics for Cross-Device User Authentication
Nuwan Kaluarachchi, Sevvandi Kandanaarachchi, Kristen Moore, Arathi Arakala, Conrad Sanderson
TL;DR
Cross-device authentication is difficult because device form-factor differences alter typing patterns, requiring burdensome separate training. The paper adapts keystroke dynamics from a source device using inductive transfer learning, limited target-device data, data fusion, and extended features, achieving a 14.2% equal error rate on phone-to-tablet authentication.
Problem
Different device form factors change typing patterns, making cross-device authentication difficult and requiring separate training for each device.
Method
TEDxBC adapts source-device keystroke dynamics with inductive transfer learning, fuses limited target-device data, and uses extended discriminative features for user-specific binary classification.
Results
14.2% equal error rate was achieved for phone-to-tablet authentication on the BBMAS dataset, surpassing DoubleType and Stratified Transfer Learning.
Takeaways & Limitations
The method reduces the training burden for secondary devices when target-device training data is limited.
Takeaways & Limitations
Evaluation on a single dataset may limit generalisability to real-world scenarios.
Abstract
from arXiv · showhide
Keystroke dynamics (typing patterns) can be used as a behavioural biometric modality for user authentication, with applications such as fraud prevention. While the modality has been shown to work well for single device authentication, its application to cross-device scenarios is more challenging. Dynamics learned on one device (eg., phone) may not be directly applicable to authentication on a secondary device with a different form factor (eg., tablet) due to changes in typing patterns that can lead to distribution drifts. To address this, we propose a cross-device user authentication system based on inductive transfer learning, where keystroke dynamics learned on one device are adapted to a secondary device. The adapted data is then combined with necessarily limited training data for the secondary device, which is used to robustly train a binary classifier. Furthermore, an extended set of keystroke features is used to better capture discriminative dynamics. Experiments on the BBMAS dataset show that proposed system achieves an equal error rate of 14.2% for the cross-device scenario, surpassing state-of-the-art methods.
I. Introduction
Keystroke dynamics support user-friendly continuous authentication, but device-specific typing changes make separately training every device burdensome, especially with limited secondary-device data. TEDxBC addresses this through homogeneous inductive transfer learning, combining source-device knowledge with limited target-device data.
- Motivation: Keystroke dynamics offer a user-friendly alternative for continuous device authentication, including fraud prevention in financial applications.The approach complements fingerprint and face features used for device security.
- Cross-device challenge: Typing patterns vary across phones, tablets, and laptops because keyboard size, style, and surface differ, requiring separate training for each device.This repetition and tediousness can discourage adoption of continuous authentication across devices.
- Cross-device challenge: Cross-device model transfer can exploit consistent typing styles, but limited training data on the secondary device creates a key challenge.Standard multi-device machine learning is feasible when enough keystroke data is available for every device.
- Prior limitations: Existing studies may inadequately discriminate users because they use only 4 to 6 keystroke features.The introduction identifies the small feature sets as a limitation of prior cross-device authentication work.
- Proposed approach: TEDxBC is a homogeneous inductive transfer learning system that uses sufficient source data and limited target data to train a transfer encoder for user-specific cross-device authentication.Its name expands to Transfer Encoder Data-fusion cross-device Binary Classification and is designed to reduce secondary-device training burden.
II. Proposed Approach
The proposed TEDxBC system addresses limited target-device keystroke data by transferring source-device features, fusing adapted and target data, and training a target-device binary classifier.
- TEDxBC targets authentication when source-device data are abundant but target-device data are limited.The target device must be trained despite insufficient target-device keystroke data.
- The training phase comprises Transfer Encoder (TE), Data Fusion (D), and Binary Classifier (BC).TE maps source-domain features to the target domain, D combines adapted source data with existing target data, and BC builds a user-specific target-device model.
- The transfer encoder converts source-device keystroke data into the target domain and data fusion combines it with target-domain data to enlarge the target-device training set.
- During testing, the trained binary classifier determines whether a presented typing pattern belongs to the claimed user.
A. Transfer Encoder
The transfer encoder uses labelled source and target samples to learn a cross-device mapping, pairing non-overlapping source-target data for training and validation. Its encoder-decoder architecture transforms source features into a bounded latent space and reconstructs target-domain samples, with user-specific training controls to reduce overfitting.
- A. Transfer Encoder: Labelled source and target domains enable an inductive transfer encoder for cross-device keystroke authentication.Class 1 denotes genuine-user samples, while class 0 denotes impostor samples.
- A. Transfer Encoder: A bipartite sampling strategy pairs source and target data into non-overlapping sets for encoder training and validation.
- A. Transfer Encoder: The encoder maps source features into a latent space through one tanh-activated hidden layer, producing latent values between −1 and +1.The decoder maps the latent vector back to the target domain.
- A. Transfer Encoder: A dropout layer connects the encoder and decoder, whose parameters comprise W, b_1, b_2, and γ.The decoder weight matrix is the transpose of the encoder weight matrix.
- A. Transfer Encoder: User-specific training selects an initializer and encoder hidden-unit count, while validation-based early stopping mitigates overfitting.Candidate initializers include Glorot Uniform, Glorot Normal, He Normal, He Uniform, and Random Uniform.
B. Data Fusion
Data Fusion addresses the target domain’s minimal training data by combining transformed source data with limited target-domain data to enlarge the binary classifier’s training set.
- B. Data Fusion: The validated transfer encoder transforms source data into the target domain to increase available target-domain samples.This transformation addresses the target domain’s minimal classifier-training data.
- B. Data Fusion: Data Fusion combines transformed source data with limited target-domain training data for each user.The combined data form an enlarged training dataset.
- B. Data Fusion: The enlarged dataset is used to train the binary classifier in the target domain.It incorporates both transferred source samples and necessarily limited target-domain samples.
C. Binary Classifier
The system uses a user-specific binary classifier to determine whether a keystroke sample belongs to the user. Random Forest is selected for robustness to overfitting, with hyperparameters tuned through grid search.
- C. Binary Classifier: Random Forest classifies each keystroke sample as belonging to the user (class 1) or not (class 0).The model was chosen because it is generally considered robust to overfitting and has prior use in keystroke-based authentication.
- C. Binary Classifier: Each user has an independently tuned classifier optimized through a straightforward grid search.The search varies tree complexity, leaf and split sample thresholds, ensemble size, and split-quality criteria.
- C. Binary Classifier: Grid search evaluates max_tree_depth, min_samples_leaf, min_samples_split, n_estimators, Gini impurity, and Information gain.These parameters cover tree structure, minimum sample requirements, ensemble size, and split quality.
III. Keystroke Features
The system extracts 24 keystroke features from raw keyboard or touchscreen typing sequences. These features span common temporal, Distance-Enhanced Flight Times, and non-conventional categories.
- Feature Categories: 24 distinct features are extracted from raw keystroke sequences generated on physical keyboards or touchscreen devices.The raw sequence includes pressed keys, pressure direction, and timestamps for each key press and release.
- Feature Categories: 6 common temporal features include hold times and flight times.These features capture timing characteristics of typing behavior.
- Feature Categories: 16 Distance-Enhanced Flight Times features and 2 non-conventional features complete the feature set.Together with the six common temporal features, these categories account for all 24 extracted features.
A. Temporal Features
The section defines temporal keystroke features from press and release timing of individual keys and adjacent key pairs. Median timing statistics produce six common temporal features for each user’s keystroke sequence.
- A. Temporal Features: Temporal features use press and release timing from single keys or adjacent key pairs, including hold time and four flight-time variants.Hold time is the release-to-press difference for one key; flight time is defined from press and release instances of adjacent key pairs.
- A. Temporal Features: Flight 2 measures release latency between the second and first keys, while Flight 3 measures press latency between the first and second keys.Flight 2 is up-up time; Flight 3 is down-down time.
- A. Temporal Features: Six common temporal features comprise median F1, F2, F3, and F4 across key pairs, plus median hold time across all keys and within a tri-graph.The four flight variants include F4 down-up time, measured between release of the second key and press of the first key.
B. Distance-Enhanced Flight Times Features
Distance-Enhanced Flight Times (DEFT) define temporal features for key pairs separated by fixed keyboard distances. They aggregate median flight times by distance and keyboard side.
- Feature definition: DEFT are temporal features defined for key pairs at fixed distances from each other on a keyboard.The feature definition uses keyboard geometry to characterize key-pair relationships.
- Feature construction: The features use median flight times for distance-1, -2, -3, and -4 key pairs on either the keyboard’s left or right side.Examples include A-S and X-D, both distance-1 pairs on the keyboard’s left side.
C. Non-Conventional Features
This section introduces non-conventional keystroke features that capture typing characteristics beyond those covered in preceding subsections. Based on preliminary experiments, the system uses median error rate percentage and median negative up-down features.
- C. Non-Conventional Features: Non-conventional features capture typing characteristics beyond the features discussed in preceding subsections.They focus on semi-timing and editing characteristics as defined in.
- C. Non-Conventional Features: Preliminary experiments selected two non-conventional features for the system.The selected features are the median error rate percentage and median negative up-down feature.
- C. Non-Conventional Features: The selected features are the median error rate percentage and the median negative up-down feature.Both features are identified as non-conventional keystroke dynamic features.
IV. Experiments
Experiments on 114 BBMAS participants with phone and tablet keystroke data evaluate TEDxBC through ablation and comparison with two cross-device methods. TEDxBC achieves the highest performance across all metrics, with both transfer encoding and data fusion contributing critically, especially transfer encoding.
- Dataset and evaluation: The evaluation uses BBMAS data from 114 participants with keystroke sequences available on phones and tablets.The experiments include an ablation study and comparison with two existing cross-device keystroke methods.
- Ablation study: The ablation compares full TEDxBC with TExBC without data fusion and DxBC without the transfer encoder.These variants isolate the contributions of target-data fusion and transfer encoding.
- Experimental setup: All methods use the same setup, including a dropout rate of γ=0.3 and samples containing 150 keystrokes.Each user has an average of 45 samples per device, and the sample size reflects typical social-media message limits.
- Comparison with existing methods: TEDxBC achieves the highest performance across all metrics, surpassing DoubleType and Stratified Transfer Learning.The evaluation uses accuracy, precision, recall, F1 score, and equal error rate, where lower EER is better.
- Ablation study: The transfer encoder and data fusion are both critical components, with the transfer encoder having the greatest effect.The results indicate that transfer encoding transforms source data effectively into the target domain.
V. Main Findings
TEDxBC enables cross-device keystroke authentication under limited secondary-device training data by transferring and fusing device-specific dynamics before user-specific classification. On BBMAS, it achieves a 14.2% equal error rate for phone-to-tablet authentication, while evaluation remains limited to one dataset.
- Problem and contribution: TEDxBC targets cross-device authentication when training data for the secondary device is limited and device form factors alter typing patterns.The motivating scenario is a well-trained phone model being adapted for authentication on a tablet.
- Method: The method combines inductive transfer learning, data fusion, user-specific binary classification, and an extended set of discriminative keystroke features.The extended features include Distance-Enhanced Flight Time features and non-conventional features alongside traditional temporal features.
- Method: The transfer encoder maps source-device feature distributions into the target domain, where converted source data is combined with target data to train a user-specific classifier.The encoder is a multi-layer neural network, and the fusion process creates an enlarged target-device training dataset.
- Novelty: TEDxBC dynamically captures behavioural variations across devices rather than relying solely on model fine-tuning or feature-space alignment.This is intended to preserve distinguishable, personalised typing patterns despite device-induced variation.
- Results: 14.2% equal error rate was achieved on BBMAS for phone-to-tablet authentication, surpassing DoubleType and Stratified Transfer Learning.The result concerns the cross-device scenario evaluated in the paper.
- Limitations and future work: Evaluation on a single dataset may limit real-world generalisability, motivating validation on additional datasets such as KVC-onGoing.Future work also proposes assessing individuals’ keystroke dynamics across various devices in multiple datasets.