Keystroke dynamics: Typing samples
 

Hello,

It's been shown that no two people type in the same manner, enabling the
addition of a security layer to your computer based on keystroke
patterns. However, the field lacks public-domain algorithms that may be
used in the implementation of such technique on open-source projects.

To remedy to that, I'm going to need some typing samples from as many
people as possible. All you have to do is type a small text. Start here: http://www.malti.org

The idea afterwards would be make public the samples' database, come up with an efficient algorihtm and eventually implement it as an optional unintrusive security layer in Linux. Please take a couple of minutes and help me in my quest to provide an alternative to the commercial proprietary solutions out there.

Thanks for your time,

/Lixy
__________

Ok I just did it...

BTW I'm from Mexico and that text is completely bovine excrement.

Thanks a bunch.

Call me paranoid (everybody else does), but this looks a bit suspicious to me. Next thing you'll be wanting fingerprints and DNA samples.
P.S
What's it like working for the CIA?

This makes no sense.

The only way to get any meaningful data would be to somehow log the ERRORS made when typing. You will need to run controlled tests which include the subjects being unaware that they are being tested. The experiment as you are doing it now is not going to yield anything useful.

Indeed, the way one types (or writes) is classified as a biometric. Physiological biometrics are fingerprints, iris etc. Behavioral biometrics are the ones that are acquired thru experience rather than hardcoded into your genetic material.

I fully understand the concern for privacy, but I'm guessing nobody uses his real name around here. You should therefore be safe. The forensics departments of the Swedish police has been looking extensively into this matter, and they have perfected methods that might hold in court (that's at least what an insider told me; there's no precedent yet.) Anyway, the final application shall be localized. I just need a few samples to get started. Dozens of academic papers have been written on the matter, but everytime someone new gets in, he has to start from scratch for lack of data to analyze. None of the researchers I contacted was able to share his/her samples.

If you're so much worried about privacy, put on your tin foil hat before punching in the text.

The idea is nothing new. Telegraphists could tell who was sending the message by the speed and intervals at which code was received. In the early 80's, the concept was already being applied to typists on computers.

The idea is to design an algorithm that optimizes false positives and negatives, then release it the wild with some kind of AI so that it may evolve. This is only the first step to see which metrics (time between press and release scancodes, latency between two successive keys) are best suited for the task. Subsequent steps will of course involve the natural environment as opposed to a predefined text. In those latter stages, privacy becomes a real concern.

Thanks for the input.

Again, the point is that you have to have controlled experiments, which include the subjects not being aware of what the test is. You will not get valid data by the method you propose.

I type v--e--r--y s--l--o--w--l--y using one hand (right), due to the fact that my monitor & keyboard are at 90 degrees to each other, and I usually have a cigarette in the other hand. I shall make myself a tin (aluminium be OK?) foil hat and consider your request.
P.S.
Not CIA then?

PS: If you are trying to record the timing of how people type, it will get distorted when going thru an internet link---ie, there will be differences in the "signatures" which are tied only to the part of the world, time of day, etc. PLUS, the fact that packets sent over the internet can go thru different routes.

Even if we all wear Aluminum hats, this experiment is not going to work....

I'd participate, but my typing is illegible..........

When you open a checking's account at your local bank, they ask you for a sample of your signature. This is exactly the same except that I'm harvesting the typing pattern to devise a technique which enables a machine to tell if your "typing signature" is legitimate or not.

You raised a valid point though. In an ideal world, I should be performing controlled experiments. But the data I gather is useful nonetheless. After having an algorithm which I deem sufficiently efficient, I'll run controlled experiments to see how it does. At this point though, I'm just looking for patterns that distinguish every individual's typing.

Yeah well, obviously I discard hunt-and-peckers. There's little one can do about that. Luckily, most people are touch typists these days.

As for your post scriptum, I wouldn't be caught dead even collaborating with them.

I record local machine timestamps. It goes without saying that I will use relative timings when analyzing the data. I don't see why the network would be an issue, as the processing is done locally. The Internet is only used to send the whole chunk once you've hit the finish button.

Of course, the experiment maybe biased if someone's using close to 100% CPU or other critical resources on his/her machine. In an ideal world, it should take place on dedicated hardware. Just because that isn't the case here, doesn't mean the data is invalid.