8 (IJCNS) International Journal of Computer and Network Security,

Vol. 1, No. 2, November 2009

Personal Authentication based on Keystroke

Dynamics using Ant Colony Optimization and Back
Propagation Neural Network
Marcus Karnan1 and M. Akila2
1
Department of Computer Science and Engineering,
Tamilnadu College of Engineering, Coimbatore, India
karnanme@yahoo.com
2
Department of Information Technology,
Vivekanandha College of Engeneering for Women, Tiruchengode, India
akila@ nvgroup.in

Dynamic keystroke analysis implies a continuous or periodic

Abstract: The need to secure sensitive data and computer
systems from intruders, while allowing ease of access for
authenticate user is one of the main problems in computer
security. Traditionally, passwords have been the usual method
for controlling access to computer systems but this approach has
many inherent flaws. Keystroke dynamics is a relatively new
method of biometric identification and provides a comparatively
inexpensive and low profile method of hardening the normal
login and password process. Here, the Ant Colony Optimization
is used to reduce the redundant feature values and minimize the
search space. It reports the results of experimenting Ant Colony
Optimization technique on keystroke duration, latency and
digraph for feature subset selection. Back Propagation Neural
Network is used for classification and the performance is tested.
Optimum feature subset is obtained using keystroke digraph
values when compared with the other two feature values.
Keywords: Ant Colony Optimization Algorithm (ACO),
Backpropagation Algorithm, False Acceptance Rate, Feature
Extraction, Feature Subset Selection, False Rejection Rate.
1. Introduction
Access to computer systems is usually controlled by user
accounts with usernames and passwords. Such scheme has
little security [1][2] if the information falls to wrong hands.
Key cards or biometric systems [3][4][5][6], for example
fingerprints [7] is being used nowadays to improve the
security. Biometric methods measure biological and
physiological characteristics to uniquely identify
individuals. The main drawback of most biometric methods
is that they are expensive to implement, because most of
them require specialized hardware to strengthen security.
But they require quite expensive additional hardware. On
the other hand keystroke dynamics [8] consist of many
advantages like (i) It can be used without any additional
hardware. (ii) Inexpensive (iii) Hardening the security.
Keystroke dynamics include several different
measurements[9][10][11] such as (i) Duration of a keystroke
or key hold time (ii) Latency of keystrokes or inter-keystroke
times (iii) Typing error (iv) Force keystrokes etc. Keystroke
analysis [12] is of two kinds static and dynamic. Static
keystroke analysis essentially means that the analysis is
performed on typing samples produced using the same
predetermined text for all the individuals under observation.
monitoring of issued keystrokes and is intended to be
performed after the log-in session also.
There are two phases namely extraction phase and
verification phase. During the feature extraction phase
[4][12][13][14] user keystroke features from one’s password
is captured, processed and stored in a reference file as
prototypes for future use by system in subsequent
authentication operations.
During the verification phase[15][16] user keystroke
features are captured, processed in order to render an
authentication decision based on the outcome of a
classification process of the newly presented feature to the
pre-stored prototypes (reference templates) [17][18]. It would
be necessary for the user to type his/her name or password a
number of times in order for the system to be able to extract
the relevant features that uniquely represent the user.
However, the task of typing one’s name or password over
and over is both tiring and tedious in the feature extraction
phase, which could lead users to alter their normal typing
pattern. Thus, most systems based on biometrics are required
to work with a summarized set of information from which to
extract knowledge. In order to reduce this problem, we could
eliminate some features of the original dataset, selecting only
the best ones in terms of class cohesion.
Feature subset selection [9][19][20] is applied to high
dimensional data prior to classification. Feature subset
selection is essentially an optimization problem, which
involves searching the space of possible features to identify
one that is optimum or near-optimal with respect to certain
performance measures, since the aim is to obtain any subset
that minimizes a particular measure (classification error
[21], for instance). In order to reduce the complexity and to
increase the performance of the classifier the redundant and
irrelevant features are reduced from the original feature set.
Many feature subset selection [22] [23] approaches are
proposed in the previous studies.
Relevant research results of past decades are detailed in
this section. Yu and Cho [24] propose a GA-SVM based
wrapper approach for feature subset selection in which GA is
employed to implement a randomized search and SVM, an
excellent novelty detector with fast learning speed, is
employed as a base learner. The degree of diversity and
 (IJCNS) International Journal of Computer and Network Security, 9
quality are guaranteed, and thus they gave result in an
improved model performance and stability. Ki-seok Sung and
Sungzoon Cho [25] propose one step approach similar to that
of Genetic Ensemble Feature Selection (GEFS), yet with a
more direct diversity term in the fitness function and SVM
as base classifier and similar to that of Yu and Cho [24]. In
particular, so called "uniqueness" term is used in a fitness
function, measuring how unique each classifier is from others
in terms of the features used. To adapt SVM authors use
Gaussian kernel. GA was used to filter the data and to carry
out a selection of characteristics. It reports an average FAR of
15.78% with minimum FAR of 5.3% and maximum FAR of
20.38% for raw data with noise. Gabriel et al [26] designed a
hybrid system based on Support Vector Machines (SVM) and
Stochastic Optimization Techniques. Standard Genetic
Algorithm (GA) and Particle Swarm Optimization (PSO)
variation was used and produced a good result for the tasks of
feature selection. Standard GA and PSO variation was used
and produced a good result for the tasks of feature selection
and personal identification with an FAR of 0.81% and IPR of
0.76%. Glaucya et al [4] used weighted probability measure
by selecting N features of the features vector with the minors
of standard deviation, eliminating the features less
significant. They obtained optimum result using 90% of the
features with 3.83% FRR and 0% FAR.
In Section II, the feature extraction phase is discussed.
Section III explains the feature subset selection method.
Section IV discusses the classification techniques and in
Section V conclusion is presented.
2. Feature Extraction
To capture a keystroke, it is necessary for users to type their
password 100 number of times. The 100 samples were got in
a week period. The system capture these features using three
methods regarding the time (in milliseconds) that a
particular user maintains the key pressed (Duration time)
and the time elapsed between releasing one key and
pressing the next (latency time) and the combination of the
above, Digraph. The data was collected from 27 participants
with different passwords. The mean and standard deviation
values were measured.
Figure 1. Measurement of duration, latency and
digraph
Keystroke recording application software was developed in
C# for the measurement of duration, latency and digraph of
each user sample in the raw data file. Upon pressing submit,
a raw-data text file is generated. During the creation of the
raw data file, the mean (µ) and standard deviation (
)
[27][28][29] of each feature (i) of the pattern set (x) is
calculated for N samples in agreement with the following
equations:
Mean (µ i) = (1/N)Σx[i] i=1..N (1)
Vol. 1, No. 2, November 2009
Standard deviation (σi) = (1/N-1)Σ|x[i]-µ[i]| i=1..N (2)
For instance, for the password “ANT” the timing
information of duration for user x is [205, 250, 235] ms. Fig
1 shows the measurement of duration, latency and digraph
of keystrokes of the password “ANT” of user x.
3. Feature Subset Selection
100 samples are typed by user for 100 number of times
during feature extraction. During the verification phase, it
takes more time to verify all the 100 number of features. To
reduce this time complexity we are using feature subset
selection methods. In feature subset selection, we extract the
optimized features from the 100 number of features. It is
essentially an optimization problem, which involves
searching the space of possible features to identify one that
is optimum. Various ways to perform feature subset
selection has been studied earlier [4][24][25][26] for various
applications. Here, we propose Ant Colony Optimization to
select the feature subset.
3.1 Ant Colony Optimization
Ant algorithms [30][31][32] was first proposed by Dorigo
and colleagues as a multi-agent approach to difficult
combinatorial optimization problems such as the Traveling
Salesman Problem (TSP) and the Quadratic Assignment
Problem (QAP). There are currently various activities in the
scientific community to extend and apply ant-based
algorithms to many different discrete optimization
problems. The ACO heuristic [31][33][34] has been inspired
by the observation on real ant colony’s foraging behavior,
and on that ants can often find the shortest path between
food source and their nest. Ant individuals transmit
information through the volatile chemical substances which
ants leave in his passing path and also known as the
“pheromone” and then reach the purpose of finding the best
way to search food sources. An ant encountering a
previously laid trail can detect the dense of pheromone trail.
It decides with high probability to follow a shortest path and
reinforce that trail with its own pheromone. The large
amount of pheromone is on the particular path, the large
probability is that an ant selects that path and the paths
pheromone trail will become denser. The Ant Colony
Optimization algorithm is explained as follows:
Step 1. Get the feature values a[x] from duration / latency
/ digraph of keystrokes.
Step 2. Calculate the fitness function f[x] by the following
equation for every a[x].
f[x] = 1 / (1+a[x]) (3)
Initialize the following
a. NI = 100 (Number of iterations)
b. NA = 20 (Number of Ants)
c. T0 = 0.001 (Initial pheromone value for
every a[x])
d. ρ = 0.9 (rate of pheromone evaporation
parameter for every a[x])
Step 3. Store the fitness function values in S, where
S = {F[x], T0, flag}
where flag column mentions whether the feature
is selected by the ant or not.
Step 4. The following is repeated for NI times
10
i. A random feature value g[x] in a[x]is
selected for each ant with the criteria that the
particular feature value should not have been
selected previously.
ii. Selected feature value’s, pheromone value is
updated by the following:
Tnew = (1-r) x Told + r x T0, for g[x]
Where Tnew and Told are the new and
old pheromone value of the feature value.
iii. Find Obtain Lmin = min(g[x]) where Lmin is
the Local minimum
iv. Check if Lmin < = Gmin
then assign Gmin = Lmin
else no change in Gmin value where Gmin
is the Global minimum.
v. Select the best feature g[y], whose solution is
equal to the Global minimum value at the end
of the last iteration.
vi. The selected g[y]’s pheromone value is
globally updated by the following equation
Tnew = (1-a) x Told + a x ∆Told, for g[y]
where α is a rate of pheromone
evaporation parameter,
∆= 1 / (Gmin)
The remaining ants their pheromone is
updated as:
Tnew = (1-a) x Told
vii. Finally, the Gmin value is stored as optimum
value.
At last, the ant colony collectively marks the shortest
path, which has the largest pheromone amount. Such simple
indirect communication way among ants embodies actually
a kind of collective learning mechanism which is used in
our experiment.
4. Classification using Back Propagation
Neural Network
Neural Networks are simplified models of the biological
nervous system, which is a computing, performed like a
human brain. A Neural network [35] has a parallel
distributed architecture with a large number of nodes and
connections. Each connection points from one node to
another are associated with weights. The backpropagation
neural network is a network of simple processing elements
working together to produce a complex output. [The back
propagation paradigm[36] has been tested in various
applications such as bond rating, mortgage application
evaluation, protein structure determination, signal
processing and handwritten digit recognition
[37][38][39][40]. It can learn difficult patterns such as those
found in typing style, and can recognize these patterns even
if they are variations of the ones it initially learned. The
backpropagation neural network uses a training set
composed of input vectors and a desired output (here the
desired output is usually a vector instead of a single value.
These elements or nodes are arranged into layers: input,
hidden, and output.
The output from a backpropagation neural network is
computed using a procedure known as the forward pass
[41]:
(IJCNS) International Journal of Computer and Network Security,
Vol. 1, No. 2, November 2009
1) The input layers propagate a particular input value
component to each node in the Hidden layer.
2) Hidden layers compute output values which become
inputs to the output layer.
3) The output layers compute the network output for
the particular input values.
The forward pass produces an output vector for a given
input vector based on the current state of the network
weights.
Since the network weights are initialized to random
values, it is unlikely that reasonable outputs will result
before training.
The weights are adjusted to reduce the error by
propagating the output error backwards through the
network.
This process is where the backpropagation neural
network gets its name and is known as the backward pass:
1) Compute error values from the output layer. This
can be computed because the desired output is
known.
2) Compute the error for the hidden layer nodes. This
is done by attributing a portion of the error at each
output layer node to the middle layer nodes which
feed that output node. The amount of error due to
each middle layer node depends on the size of the
weight assigned to the connection between the two
nodes.
3) Adjust the weight values to improve network
performance.
4) Compute overall error to test network performance.
The training set is repeatedly presented to the network
and the weight values are adjusted until the overall error is
below a predetermined tolerance.
The Back Propagation algorithm [42][43] can be
implemented in two different modes: online mode and batch
mode. In the online mode the error function is calculated
after the presentation of each input timing vector and the
error signal is propagated back through the network,
modifying the weights before the presentation of the next
timing vector. This error function is usually the Mean
Square Error (MSE) of the difference between the desired
and the actual responses of the network over all the output
units.
Then the new weights remain fixed and a new timing
vector is presented to the network and this process continues
until all the timing vectors have been presented to the
network. The presentation of all the timing vectors is
usually called one epoch or a single iteration. In practice
many epochs are needed before the error becomes acceptably
small. In the batch mode the error signal is calculated for
each input timing vector and the weights are modified every
time the input timing vector is been presented. Then the
error function is calculated as the sum of the individual
MSE for each timing vector and the weights are
accordingly modified (all in a single step for all the timing
vectors) before the next iteration.
In the forward pass, outputs are computed and in the
backward pass weights are updated or corrected based on the
errors. The development of the Back Propagation algorithm
is a landmark in neural networks in that it provides a
computationally efficient method for the training of multi-
 (IJCNS) International Journal of Computer and Network Security, 11
Vol. 1, No. 2, November 2009

layer perceptron. The general procedure of back propagation
algorithm is as follows:
Initially, the inputs and outputs of the feature subset
selection algorithms are normalized with respect to their
maximum values.
Step 1: ACO feature subset selection algorithm values
are considered as input.
Step 2: These feature values are normalized between 0
and 1 and assigned to input neurons.
Step 3: Wih and Who Represents the weights to the link of
input nodes to hidden nodes connection, hidden
nodes to output nodes respectively. Initial
weights are assigned randomly between -0.5 to
0.5.
Step 4: Input to hidden neuron (Ii) is multiplied with
weight wih.
Step 5: The output from each hidden neuron (Oh) is
calculated using sigmoid function
S1 = 1 / (1 + e-λx)
where λ =1 & x = ΣwihIi, wih is the
assigned between input and hidden layer
and Ii is the input value to the input neurons.
Step 6: The input to the output layer (Io) is multiplied by
weight who with output of hidden Oh.
Step 7: The output from the output layer (Oo) is
calculated using the sigmoid function,
S2 = 1 / (1 + e-λx)
where λ =1 & x = ΣwhoOh where who is the
weight assigned i between hidden and output
layer and
Oh is the output value from hidden neurons.
Step 8: Error (e) is found using subtracting S2 from the
desired output. Using the error (e) value, the weight
change is calculated as:
Delta = e x S2 x (1 – S2)
Step 9: Weights are updated using the delta value.
Who = Who + (n x delta x S1)
Wih = Wih + (n x delta x Ii)
where n is the learning rate and I is the input
value.
Step 10: Perform steps (5) to (9) with the updated weights,
till the target output is equal to the desired output.
Then check the error (e) value and update the
weights. After several iterations, when the
difference between the calculated output and the
desired output is less then the threshold value, the
iteration is stopped in the above algorithm.
5.1 Results of ACO
From 100 samples, fifty best fitted values were selected to
reproduce best new fit population. Partial experimental
results of ACO are shown in Table 1.
For instance the mean and standard deviation timing of
the password “COMPUTER" is computed initially in the
feature extraction phase. The feature subset from the feature
subset selection phase using ACO is computed as follows:
Step 1: Calculation of Fitness value for Duration:
Mean (µ i) = (1/N) Σ i =1N x (i) = 1.349375= x (i)
Fitness value f (i) =1 / 1 + x (i) = 1/1+1.349375 = 0.425645
Step 2: Calculation of Local Minimum for Duration:
Initially the fitness value f(x) is directly assigned as Local
Minimum (Lmin) for the first value (say f [1]). Then the
next fitness value f (x) (say f [2]) is compared with f (1).
(4)
The minimum is found and is replaced with the Local
weight
minimum value.
For mean let f [1] = 0.425645
Assign f [1] = Lmin = 0.425645
The next value let f [2] = 0.416898
Check whether f [1] less then or equal to the value a [2].
If the condition is true, assign Lmin =f [1].
Otherwise, Lmin= f [2]
(5)
Here, in this sample, as (0.425645<=0.416898)
Lmin = 0.416898
Step 3: Calculation of Local Pheromone Update for
Duration:
Tnew = (1–ρ) x Told + ρ x T0, where Tnew = new pheromone
rate, where Told = old pheromone rate, T0 = Initial
pheromone value. Initially, Told = 0.001 and T0 = 0.001.
(6) For mean, first Local pheromone is updated as
Tnew = (1- 0.9) x 0.001 + 0.9 x 0.001 = 0.1 x 0.001 + 0.0009
= 0.00100
(7) Note: Told value change due to the previous Tnew value i.e.
Told = 0.00100.
Step 4: Calculation of Global minimum for Duration:
Global minimum (Gmin) is assigned as Lmin value initially
(i.e. Lmin = Gmin). Next the value in the Gmin is compared
with Lmin, to find the minimum amongst them.
For mean, Lmin = 0.416898
Initially, Gmin = Lmin. Therefore Gmin = 0.416898
For next feature value, condition should be satisfied for
Gmin i.e. (Gmin <= Lmin). So, Gmin = 0.416898

5. Results and Discussion Step 5: Calculation of Global pheromone Update for

Mean and standard deviation of duration, latency and
digraph for each sample is measured. Ant Colony algorithm
is used for selecting the optimum feature for each participant
and the selected features are considered for classification.
Duration:
The selected Gmin pheromone value is updated as follows:
Tnew = (1 – ρ) x Told + ρ x ∆Told,
ρ=rate of pheromone evaporation parameter, ∆=1/ (Gmin)
For mean, Global pheromone is updated as
Tnew = (1–0.9) x 0.001+0.9 x (1/0.74167690) x 0.001
= (0.0001) + (0.9 x 2.39866 x 0.001) = 0.002259
12 (IJCNS) International Journal of Computer and Network Security,
Vol. 1, No. 2, November 2009

Table 1: Feature subset selection using ACO

Mean (Gmin) Standard Deviation (Gmin)
Duration Latency Digraph Duration Latency Digraph
x(µ) F(µ) x(µ) F(µ) x(µ) F(µ) x(σ) F(σ) x(σ) F(σ) x(σ) F(σ)
1.570 0.389 1.618 0.381 2.925 0.254 0.348 0.741 0.383 0.722 0.723 0.580
0 1 7 9 0 8 2 7 2 9 8 1
1.398 0.416 1.597 0.385 2.773 0.265 0.344 0.743 0.360 0.735 0.709 0.585
7 9 0 0 0 0 5 7 3 1 4 0
1.356 0.424 1.583 0.387 2.562 0.280 0.336 0.748 0.322 0.756 0.675 0.596
6 3 2 1 3 7 3 3 7 0 4 8
1.349 0.425 1.382 0.419 2.531 0.283 0.329 0.752 0.295 0.772 0.654 0.604
3 7 8 7 9 1 7 0 0 2 4 4
1.347 0.426 1.273 0.439 2.526 0.283 0.348 0.741 0.292 0.773 0.568 0.637
6 0 6 8 0 6 2 7 7 6 3 6
1.322 0.430 1.266 0.441 2.502 0.285 0.316 0.759 0.284 0.778 0.590 0.628
0 7 2 2 6 5 2 8 6 5 9 6

Step 6: The remaining Ants Pheromone update for
Duration:
Tnew = (1 – ) x Told
For mean, Global pheromone is updated as
Tnew = (1-0.9) x 0.001 = 0.1 x 0.001 = 0.0001
Similarly the values for the latency and digraph are
calculated as above.
(a) Results of Back Propagation Neural Network (BPNN)
Back Propagation Neural Network seems much more
suitable for pattern classifier because it can solve a non-
linear problem and for its ability to classify pattern and it is
better in generalization
Let Ii be Input of Input, Oi be Output of Input, Ih be Input
of Hidden, Oh be Output of Hidden, Io be Input of Output, Oi
be Output of Output. After applying the BPNN Learning the
following calculations are done. The partial results are
displayed in Table 2. It displays the initial input and random
weight between input to hidden, output of hidden using
sigmoid function, random weight between hidden to output,
and the output of output layer using sigmoid function value.
This value is compared with target output .01 and error
value is displayed. The adjusted weights between input to
hidden and hidden to output is also displayed. After
completing the 30th iteration using the duration, latency and
digraph the threshold value is obtained from maximum to
minimum output within the 30 iterations.
Step 4: Output of Hidden
Compute sigmoid function as
S1 = 1 / (1 + e-λx), where λ = 1 & x = Σi wih Oi
S1 = 1/(1+e-(-0.3418387+-0.1953364))
S1 = 0.3688
Step 5: Weight Between Hidden to Output
Assign the weights randomly between Hidden to Output
Layer as Who = (0.6, -0.5)
Step 6: Input of Output Layer
Multiply the weight between Hidden and Output Layer
(Who) and the Output of Hidden Layer
Io =S1 *Who = *(0.6) = 0.22128
Step 7: Output of Output Layer
Sigmoid Function of Output Layer is calculated as follows:
Oo= 1 / (1 + e-λx), where λ = 1 & x = Σi who Oh
Oo= 1/ (1+ e-(0.350259+-0.32626)) = 0.718669
Step 8: Error Signal
Compute the Error Signal using Error = (To- Oo)2 where To
is Target Output and is assigned -0.1 and Oo is Output of
Output and is assigned as 0.459700.
Error = (To- Oo) 2 = (0.1-0.5060)2 =0.382751

Computation of error values in Forward Pass Computation of updated weights in Backward Pass
Step 1: Input of Input Weights are adjusted to achieve the Target Output and
Mean and Standard Deviation is the Input of input and Reduce the Error Value.
output of input layers and is f (i). D=( To- Oo1)( Oo1)(1- Oo1) = (0.1-0.5060) (0.5060) (1-
For instance let the Input f (i) = (0.488341, 0.969959) 0.5060)
D = -0.10148
Step 2: Weight between Input to Hidden
Assign weights randomly between Input to Hidden layers Step 9: Output to Hidden Weight:
say, Y = S1*D
Wih = (-0.7, 0.4, -0.7, 0.6,) Y = [-0.3418387
Assume two weights for each single node. Multiply each 0.1953364] x (-0.10148)
output of input into weight that is assigned randomly. Y = [0.03468
-0.0198]
Step 3: Input of hidden [∆w] 1= [∆w]0 +η[y][Assume η=0.6]
Ih = Oi * Wih [∆w] 0= 0
Iih 1 = 0.488341*-0.7= -0.3418387 [∆w] 1= 0.6 x [0.03468
 (IJCNS) International Journal of Computer and Network Security, 13
Vol. 1, No. 2, November 2009

-0.0198]
[∆w] 1 = [0.436924 [-0.3418387
0.918542] 0.1953364] x 0.01653
[∆v]1 = α [∆v]0+ η[x]
Step 10: Hidden to Input Weight:
The Adjusted weight between Hidden to Input [∆v]1 = [-0.704411
[e]=(w)(D)=(-0.7) (-0.10148) = 0.071036 0.392331
Similarly the remaining four weights are multiplied by the 0.591240
error Difference Value (D). 0.584767]
[D*]= [e][ OH][1- OH]= [0.071036][ 0.3688][1-0.3688]
= 0.01653
[x] = [S1][D*]
Table 2: Intermediate result of BPNN

Output of Adjusted Adjusted

Sigmoid Difference
nput Ii Wih Ih hidden Who Io Target Weight Weight
(Output) oo (Error rate)
(Hidden) (Woh) (Whi)
Duration
-0.7 -0.2723 -0.703482
Mean 0.3891 0.46877 0.6 0.281262 0.56118
0.4 0.15564 0.402675
0.50073 0.1 0.160586
0.6 0.44502 0.593362
SD 0.7417 0.70889 -0.5 -0.354445 -0.5388
0.6 0.44502 0.605099
Latency
-0.7 -0.29183 0.703727
Mean 0.4169 0.468773 0.6 0.2812638 0.561112
0.4 0.16676 0.402848
0.499701 0.1 0.159761
0.6 0.44622 0.593351
SD 0.7437 0.709393 -0.5 -0.3546965 -0.538888
0.6 0.44622 0.605081
Digraph
-0.7 -0.2970 -0.703791
Mean 0.4243 0.468222 0.6 0.2809332 0.561059
0.4 0.16972 0.402892
0.499448 0.1 0.159558
0.6 0.44898 0.593313
SD 0.7483 0.710530 -0.5 -0.355265 -0.538941
0.6 0.44898 0.605101

Similarly twenty five weights are calculated and old weights
of Input to Hidden Layer are replaced. After training the
user typing pattern, the threshold values for each trained
user is fixed. Again the users are asked to verify by giving
the user name and password. After the verification of user
name and password, the typing pattern is verified through
the comparison of desired output with fixed threshold value.
If the error value is less then 0.001 then the user is
considered as valid user otherwise invalid user.
The success of this approach to identify computer users
can be defined mainly in terms of False Rejection Rate(FRR)
and False Acceptance Rate(FAR). False Rejection Rate of a
verification system gives an indication of how often an
authorized individual will not be properly recognized. False
Acceptance Rate of a verification system gives an indication
of how often an authorized individual will be mistakenly
recognized and accepted by the system. False Rejection Rate
is generally more indicative of the level of a mechanism.
FAR and FRR rate is calculated using the following
equations:
samples. These results suggest that digraph may in general
provide a better characterization of the typing skills than
latency and duration.
(a) Receiver Operating Characteristics (ROC)
ROC analysis provides tools to select possibly optimal
models and to discard suboptimal ones independently from
(and prior to specifying) the cost context or the class
distribution. ROC analysis is related in a direct and natural
way to cost/benefit analysis of diagnostic decision making.
Fig 2 shows the ROC curves for comparison of mean and
standard deviation (Duration, Latency and Digraph) of
classification performance. The error rate is reduced when
the sample size is increased.

FAR = FA / N * No of user’s

where FAR – False Acceptance Rate, FR – Number of

incidence for False Acceptance and N – Total number of Figure 2. Classification Error Rate using Mean
samples

FRR = FR / N * No of user’s
6. Conclusion
To conclude, we have shown that keystroke dynamics are
where FRR – False Rejection Rate, FR – Number of
rich with individual mannerisms and traits and they can be
incidence for False Rejection and N – Total number of
14
used to extract features that can be used to identify computer
user. We have demonstrated that using duration, latency and
digraph timings as classification features is a very successful
approach. Features are extracted from 27 users with 100
samples of each. Using the samples, the mean and standard
deviation is calculated for duration, latency and digraph.
Subsets of features are selected using Ant Colony
Optimization (ACO) algorithm. ACO using digraph mean
provide the best performance comparing with duration and
latency. The features are classified and tested using
Backpropagation Algorithm Finally, it was found that using
the values of digraph and back-propagation neural network
algorithms has shown excellent verification accuracy. The
classification error is reduced when the number of sample is
increased. The classification error of 0.059% and accuracy
of 92.8% is reported.
References
[1] Hu. J, Gingrich. D and Sentosa. A, “A k-Nearest
neighbor approach for user authentication through
biometric keystroke dynamics”, In Proceedings of the
IEEE International Conference on Communications,
pp. 1556 – 1560, 2008.
[2] Pavaday N and Soyjaudah. K.M.S, “Investigating
performance of neural networks in authentication
using keystroke dynamics”, In Proceedings of the
IEEE AFRICON Conference, pp. 1 – 8, 2007.
[3] Adrian Kapczynski, Pawel Kasprowki and Piotr
Kuzniacki, “Modern access control based on eye
movement analysis and keystroke dynamics”, In
Proceedings of the International Multiconference on
Computer Science and Information Technology, pp.
477-483, 2006.
[4] Gláucya C. Boechat, Jeneffer C. Ferreira and Edson
C. B. Carvalho Filho, “Authentication Personal”, In
Proceedings of the International Conference on
Intelligent and Advanced Systems pp. 254-256, 2007.
[5] Anil Jain, Ling Hong, and Sharath Pankanti,
“Biometrics Identification”, Signal Processing,
Communications of the ACM, Vol. 83, Issue 12, pp.
2539-2557, 2003.
[6] Duane Blackburn, Chris Miles, Brad wing, Kim
Shepard, ”Biometrics Overview”, National Science
and Technology Council Sub-Committee on
Biometrics, 2007.
[7] Lin Hong and Anil Jain, “Integrating Faces and
Fingerprints for Personal Identification”, IEEE
Transactions on Pattern Analysis and Machine
Intelligence, Vol. 20, No. 12, pp.1295 – 1307, 1998.
[8] Fabian Monrose, Aviel D. Rubin, “Keystroke
dynamics as a biometric for authentication”, Future
Generation Computer Systems, Vol. 16, Issue 4, pp.
351-359, 2000.
[9] Gabriel. L. F. B. G. Azevedo, George D. C.
Cavalcanti and E. C. B. Carvalho Filho, “Hybrid
Solution for the Feature Selection in Personal
Identification Problems through Keystroke
Dynamics”, In Proceedings of the International Joint
Conference on. Neural Networks, pp.1947-1952,
2007.
[10] Pin Shen Teh, Andrew Beng Jin Teoh, Thian Song
(IJCNS) International Journal of Computer and Network Security,
Vol. 1, No. 2, November 2009
Ong, Han Foon Neo, “Statistical Fusion Approach on
Keystroke Dynamics”, In Proceedings of the Third
International IEEE Conference on Signal-Image
Technologies and Internet-Based System, Shanghai,
pp. 918-923, 2007.
[11] Shepherd S J, “Continuous Authentication by
Analysis of keystroke typing characteristics”,
European Convention on Security and Detection’,
pp.111-114, 1995.
[12] Christopher S. Leberknight, George R. Widmeyer,
and Michael L. Recce, ”An Investigation into the
efficacy of Keystroke Analysis for Perimeter Defense
and Facility Access”, In Proceedings of the IEEE
Conference on Technologies for Homeland Security,
pp. 345-350, 2008.
[13] Gaines .R, Lisowski .W, Press .S, and Shpiro.N,
“Authentication by keystroke timing: Some
preliminary results”, Rand Report R-256-NSF. Rand
Corporation, 1980.
[14] Young .J.R and Hammon .R.W, “Method and
apparatus for verifying an individual’s identity”, US
Patent 6862610, U.S. Patent and Trade- mark Office,
1989.
[15] Bleha .S.A and Obaidat .M.S, “Dimensionality
reduction and feature-Extraction Applications in
Identifying Computer users”, IEEE Transactions on
Systems Man and Cybernetics, Vol. 21, No. 2, pp.
452-456, 1991.
[16] Daw-Tung Lin, “Computer-Access Authentication
with Neural Network Based Keystroke Identity
Verification”, In Proceedings of the International
Conference on Neural Networks, Vol. 1, Issue
9-12, pp.174 – 178, 1997.
[17] Sylvain Hocquet, Jean-Y Ves Ramel and Hubert
Cardot, “Fusion of methods for keystroke Dynamics
Authentication”, Fourth IEEE Workshop on
Automatic Identification Advanced Technologies, pp.
224 – 229, 2005.
[18] Enzhe Yu and Sungzoon Cho, “Keystroke dynamics
identity verification–its problems and practical
solutions”, Computers & Security, Vol. 23, pp. 428–
440, 2004.
[19] Yang .J and Honavar .V, “Feature subset selection
using a Genetic algorithm”, IEEE Intelligent Systems
and their Applications, Vol 13, Issue 2, pp.44-49,
1998.
[20] John G. H., Kohavi .R and Pfleger .K, “Irrelevant
features and the subset selection problem”, In
Proceedings of the Eleventh International Conference
on Machine Learning, pp. 121-129, 1994.
[21] Shiv Subramaniam .K.N, S. Raj Bharath and S.
Ravinder, “Improved Authentication Mechanism
using Keystroke Analysis”, In Proceedings of the
International Conference on Information and
Communication Technology, Vol. 7-.9, pp. 258-261,
2007.
[22] Surendra K. Singhi and Huan Liu, “Feature Subset
Selection Bias for Classification Learning”, In
Proceedings of the 23rd International Conference on
Machine Learning, pp. 849-856, 2006.
[23] Karnan M, Thangavel K, Sivakumar R and Geetha
 (IJCNS) International Journal of Computer and Network Security, 15
K, “Ant Colony Optimization for Feature selection
and Classification of Microcalcifications in Digital
Mammograms”, In Proceedings of the International
Conference on Advanced Computing and
Communications, pp.298-303, 2006.
[24] Enzhe Yu and Sungzoon Cho, “GA-SVM Wrapper
Approach for Feature Subset Selection in Keystroke
Dynamics Identity Verification”, In Proceedings of
the International Joint Conference on Neural
Networks, Vol. 3, pp. 2253-2257, 2003.
[25] Ki-seok Sung and Sungzoon Cho, “GA SVM
Wrapper Ensemble for Keystroke Dynamics
Authentication”, In Proceedings of the International
Conference on Biometrics, Hong Kong,
China, Vol. 3832, pp. 654-660, 2006.
[26] Gabriel L. F. B. G. Azevedo, George D. C.
Cavalcanti and E.C.B. Carvalho Filho, “An
Approach to Feature Extraction for Keystroke
Dynamics Systems based on PSO and Feature
Weighting”, In Proceedings of the IEEE Congress on
Evolutionary Computation, pp. 3577–3584, 2007.
[27] Fabian Monrose, Michael K. Reiter and Susanne
Wetzel, “Password Hardening Based on Keystroke
Dynamics”, In Proceedings of the 6th ACM
conference on Computer and communications
security, pp. 73-82, 1999.
[28] Francesco Bergadana, Daniele Gunetti and Claudia
Picardi, “User authentication through Keystroke
Dynamics”, ACM Transaction of Information and
System Security, Vol. 5, pp. 367-397, 2002.
[29] Magalhaes, Paulo Sergio and Henrique Dinis dos,
“An improved Statistical Keystroke Dynamics
Algorithm”, In Proceedings of the IADIS Virtual
Multi Conference on Computer Science and
Information Systems, pp. 256-262, 2005.
[30] David Martens, Manu De Backer, Raf Haesen, Jan
Vanthienen, Monique Snoeck, and Bart Baesens,
“Classification with Ant Colony Optimization”, In
Proceedings of the IEEE Transactions on
Evolutionary Computation, Vol. 11, pp. 651-665,
2007.
[31] Haibin Duan and Xiufen Yu, “Hybrid Ant Colony
Optimization Using Memetic Algorithm for
Traveling Salesman Problem”, In Proceedings of the
IEEE International Symposium Approximate
Dynamic Programming and Reinforcement Learning
(ADPRL) pp. 92-95, 2007.
[32] Dorigo .M and Gambardella .L.M., “Ant colonies for
the traveling salesman problem”, Bio Systems, 1997.
[33] Dorigo .M, Maniezzo .V and Colorni .A, ”Positive
feed back as a search strategy”, Technical Report
Politecnico di Milano, Italy, 1991.
[34] Youmei Li and Zongben Xu, “An Ant Colony
Optimization Heuristic for solving Maximum
Independent Set Problems”, In Proceedings of the
Fifth International Conference on Computational
Intelligence and Multimedia Applications, pp.206–
211, 2003.
[35] Obaidat M. S., and Macchairolo D. T., “A Multilayer
Neural Network System for Computer Access
Security”, IEEE Transactions on Systems, Man and
Vol. 1, No. 2, November 2009
Cybernetics, Vol.24, pp. 806-813, 1994.
[36] Rumelhart .D, Hinton .G and Williams .R, “Learning
Internal Representations by Error Propagation”,
Parallel distributed processing: explorations in
the Microstructure of Cognition, MIT Press,
Vol.1, pp. 318–362, 1986.
[37] Hecht Nielsen .R, “Neuro Computing,”, Springer-
Verlag New York, Inc. pp. 445-453, 1989.
[38] Kohonen .T, “The Neural Phonetic Typewriter”,
IEEE Computer, Vol. 21, pp. 11-22, 1988.
[39] Obaidat .M.S and Walk .J.V, “An Evaluation Study
of Traditional and Neural Network Techniques for
Image Processing Applications”, In Proceedings of
the IEEE 34th Midwest Symposium on Circuits and
Systems, Vol.14, pp. 72-75, 1991.
[40] Marcus Brown and Samuel J. Rogers, “A Practical
Approach to User Authentication”, In Proceedings of
the 10th Annual Computer Security Applications
Conference, pp. 108-116, 1994.
[41] Sajjad Haider Ahmed Abbas K. Zaidi, “A Multi-
Technique Approach for User Identification through
Keystroke Dynamics”, IEEE Transactions on Systems
Man, and Cybernetics, Vol.2, pp.1336–1341, 2000.
[42] Brown M, Rogers S.J., “User identification via
keystroke characteristics of typed names using neural
networks”, International Journal of Man-Machine
Studies, Vol. 39, pp. 999-1014, 1993.
[43] Nadler M and Smith E P, “Pattern Recognition
Engineering”, New York: Wiley-Inter Science, 1993.
Authors Profile
Marcus Karnan received the BE Degree
in Electrical and Electronics Engineering
from Government College of Technology,
Bharathiar University, India. Received the
ME Degree in Computer Science and
Engineering from Government College of
Engineering, Manonmaniam Sundaranar
University in 2000. Received the PhD degree in Computer
Science and Engineering Degree from Gandhigram Rural
University, India in 2007, Currently he is working as Professor,
Department of Computer Science & Engineering Department,
Tamilnadu College of Engineering, India. He has been in
teaching since 1998 and has more than eleven years in industrial
and research experience. His area of interests includes medical
image processing, artificial intelligence, neural network, genetic
algorithm, pattern recognition and fuzzy logic.
M. Akila received the Bachelor of
Computer Science and Engineering from
Thiagaraja College of Engineeering,
Madurai Kamaraj University in 1991. She
Received the Master of Computer Science
and Engineering from National
Engineering College, Manonmaniam
Sundaranar University in 2003. She is
now a Research scholar in Anna University, Coimbatore and
working as Assistant Professor in Vivekanandha College of
Engineering for Women, Tiruchengode, Tamilnadu, India. Her
area of interests includes image processing, pattern recognition
and artificial intelligence.