Biometric keystroke attribution

Inventors

Tenaglia, Scott D. • Morgan, Sean • Slater, David

Assignees

Two Six Labs LLC

Abstract

A biometric attribution approach identifies a keyboard actor based on timing between entered keystrokes. Patterns tend to emerge in a timing interval between keystrokes entered by an actor. The keystroke patterns of an actor are analyzed to compute a signature exhibited by the actor. Gathered or intercepted keystroke patterns of an unknown actor are compared to identify a likelihood that typing sessions emanated from a common actor. Keystroke activity of a purported suspect actor can be compared to a database or model of keystroke attributes for determining if the keystroke activity emanated from the same actor as other keystroke sequences. Keystroke patterns rely only on the timing between keystrokes, as key data and upstroke information need not be gathered since the comparisons reply only on keystroke timing deltas.

Core Innovation

The invention assesses an identity of a keyboard actor in a computing environment where keyboard input devices operated by actors generate packets indicative of respective keystrokes on a keyboard defining a console interface. It receives a sequence of packets from a keyboard interface and identifies attributes derived from a keystroke interval between a plurality of keystrokes based on capture of the sequence of packets containing the keystrokes. The approach compares the identified attributes to a second set of attributes based on a second sequence of keystrokes using a feature set comparison.

A key aspect of the invention is the use of timing information while removing non-timing keystroke information. In particular, the invention removes upstroke information to generate a sequence of intervals between each keystroke of a depressed key, and removes keystroke data information indicative of a value associated with the depressed key for the upstroke and downstroke. The invention generates a dataset based on timing information between keystrokes in each sequence of keystrokes and the origin of the sequence of keystrokes.

The invention computes a probability that the keystrokes corresponding to the received sequence of packets and keystrokes corresponding to the second sequence of packets emanated from the same keyboard actor. The disclosed approach further includes demarcating a comparison sequence of a predetermined number of keystrokes and generating a vector with a sequence of elements that each represent a time interval from a previously pressed key, followed by performing a comparison of the respective vectors based on the identified attributes and the second set of attributes.

Claims Coverage

The independent claims cover assessing an actor identity using keystroke-interval-derived attributes from sequences of packets, comparing those attributes to a second sequence’s attributes, and computing a probability that both sequences emanated from the same keyboard actor. Across the independent claims, the inventive features emphasize timing-based attribute derivation, removal of upstroke information and keystroke data information, and probability computation; some features specify vector/interval handling and comparison demarcation.

Across the independent claims, the coverage centers on deriving attributes from keystroke intervals captured from packet sequences, removing upstroke and keystroke value information to form timing-based datasets, comparing timing-derived attributes to a second set of attributes, and computing a probability that the two sequences emanated from the same keyboard actor.

Stated Advantages

Documented Applications