[Paper Review] Robust Keystroke Biometric Anomaly Detection

John V. Monaco|arXiv (Cornell University)|Jun 29, 2016

User Authentication and Security Systems17 references21 citations

TL;DR

This paper presents a robust keystroke biometric anomaly detection system that uses keystroke alignment and subject-specific score normalization to handle variable-length, mismatched typing sequences from real-world data. Despite using simple features, Manhattan distance achieved the lowest equal error rate (5.32%) among 15 systems, with performance gains primarily due to preprocessing and normalization rather than complex models.

ABSTRACT

The Keystroke Biometrics Ongoing Competition (KBOC) presented an anomaly detection challenge with a public keystroke dataset containing a large number of subjects and real-world aspects. Over 300 subjects typed case-insensitive repetitions of their first and last name, and as a result, keystroke sequences could vary in length and order depending on the usage of modifier keys. To deal with this, a keystroke alignment preprocessing algorithm was developed to establish a semantic correspondence between keystrokes in mismatched sequences. The method is robust in the sense that query keystroke sequences need only approximately match a target sequence, and alignment is agnostic to the particular anomaly detector used. This paper describes the fifteen best-performing anomaly detection systems submitted to the KBOC, which ranged from auto-encoding neural networks to ensemble methods. Manhattan distance achieved the lowest equal error rate of 5.32%, while all fifteen systems performed better than any other submission. Performance gains are shown to be due in large part not to the particular anomaly detector, but to preprocessing and score normalization techniques.

Motivation & Objective

• To address the challenge of variable-length, mismatched keystroke sequences in real-world biometric data where subjects type their unique first and last names.
• To develop a preprocessing pipeline that enables standard fixed-text techniques on approximate matches between template and query sequences.
• To improve anomaly detection performance using subject-specific feature and score normalization that are robust to outliers and few training samples.
• To evaluate a range of anomaly detectors, from autoencoders to Manhattan distance, in a one-class learning setting due to the lack of practical negative training data.
• To demonstrate that performance gains stem primarily from alignment and normalization, not from the choice of anomaly detector.

Proposed method

• A keystroke alignment algorithm establishes semantic correspondence between query and template sequences despite insertions, deletions, substitutions, and transpositions caused by modifier keys.
• Feature extraction uses timing features (e.g., inter-keystroke intervals) from aligned sequences, normalized using subject-specific min/max or standard deviation bounds.
• Anomaly detection is performed using a variety of models, including Manhattan distance, autoencoders, and ensemble methods, all trained on limited template samples.
• Score normalization is applied using subject-specific min/max or standard deviation-based scaling to stabilize score distributions and improve generalization.
• The system pipeline integrates alignment, feature normalization, anomaly scoring, and score normalization, with all components being agnostic to the choice of anomaly detector.
• The method maximizes usable data by preserving mismatched sequences rather than discarding or truncating them, reducing the failure-to-capture rate.

Experimental results

Research questions

• RQ1 How can keystroke sequences with variable length and order due to modifier key usage be aligned for effective anomaly detection?
• RQ2 To what extent do feature and score normalization techniques improve anomaly detection performance in low-data, one-class settings?
• RQ3 Can simple anomaly detectors like Manhattan distance outperform complex models when robust preprocessing is applied?
• RQ4 How does the performance of anomaly detection systems vary across long intervals between template and query data collection?
• RQ5 What is the relative contribution of alignment and normalization versus the choice of anomaly detector to overall system performance?

Key findings

• Manhattan distance achieved the lowest equal error rate (5.32%) among all 15 systems, outperforming more complex models like autoencoders and ensemble methods.
• The best-performing system (system 6) showed minimal performance degradation over time, with only a 0.01% increase in EER when testing 2 vs. 4 months after template collection.
• Performance gains were primarily attributed to keystroke alignment and score normalization, not to the choice of anomaly detector, as evidenced by consistent improvements across all models.
• Score normalization using standard deviation bounds was more robust to outliers than min/max normalization, which is sensitive to extreme values.
• All 15 top systems achieved lower EER than any other submission, indicating strong generalization across diverse models and preprocessing strategies.
• The system remained robust over long intervals, suggesting that keystroke profiles stabilize quickly and are resilient to temporal variability.