Learning from Authoritative Security Experiment Results
Clusters and Markers for Keystroke Typing Rhythms
Shing-hon Lau, Carnegie Mellon University
Roy Maxion, Carnegie Mellon University
Background. People’s blood comes in four types: A, B, AB and O. The markers for these blood types are the presence or absence of specific antigens. If people’s typing rhythms – the unique pattern of someone’s typing – can be similarly grouped into a small number of types, it could have forensic importance, allowing insider investigators to rule out a substantial fraction of suspects, just as Type-A blood rules out 60% of the population.
Aim. We aim to determine whether typing rhythms can be grouped into a small number (e.g., 3-10) of characteristic groups, and to find a marker that places a typist squarely into one group, as antigens do in blood typing.
Method. Data were 50 repetitions of a password (.tie5Roanl) from 51 typists. Agglomerative clustering elicited groupings in the data. Sparse logistic regression discovered the distinguishing characteristics of groups. A support vector machine identified specific markers.
Results. Three major groupings, or rhythm types, were identified, along with one singleton outlier. Preliminary work focused mainly on just one of these groups, whose members turned out to comprise all women. A Chi-Square test of independence determined that this was unlikely to have been a chance event (χ 2(d f =2,N =50)= 13.1714, p< 0.005). The singleton subject, an egregious outlier, suffered from a neurological disorder.
Conclusion. Typists can be grouped into a small number of types, as is done in blood typing. Markers can identify an individual as a member of a distinct type.