4 ms·

The interesting aspect of this research is intrusion detection, not authentication. After a user has authenticated with a system (either legitimately or otherw

by dhx 15y ago

The interesting aspect of this research is intrusion detection, not authentication. After a user has authenticated with a system (either legitimately or otherwise), analysis of keystroke or mouse movement timing patterns could raise an alarm when the patterns don't match those learnt from the real account holder. Intruder use of unlocked terminals, stolen smart cards, latex-coated gummy bear fingers, wax models or other movie favourites could be detected minutes later when usage patterns of the terminal don't match the learnt patterns. With appropriate physical security measures in place, it'd be as simple as sending around a security guard or remotely viewing security camera footage and real-time desktop usage/network traffic.

harshreality 15y ago
I don't think it's good for either authentication or intrusion detection. There's some critical deadline with a lot of stress attached. I have a few moments to log in and do something important. Will the stress and different behavior prevent me from being authenticated? Will I be authenticated but kicked out when my behavior does not match the norm? If the timing detection or other behavior checking is made flexible enough to reliably cope with those situations, how much security is it really providing?
- dhx 15y ago
  I thoroughly agree with these points. Some further reasons why I still believe this research could prove very useful even with the problems you mentioned: 1. Perhaps multiple usage profiles can be generated based on the emotional state of the user? So perhaps there is a distinct difference between stressed Alice, angry Alice, bored Alice, "just started work and half sleeping" Alice and the usage patterns of other users in other emotional states (including Mallory the attacker). This would have the added benefit of being able to provide information about the emotional state of yourself/employees over time. This is not to say that ethical/privacy issues don't exist in this scenario. 2. Plenty of other metrics exist other than just keyboard or mouse timing. At what frequency (and timing) does a user click buttons in a user interface? How often does the user switch between applications? Did they use keyboard shortcuts to switch? How fast does the user read and navigate through a directory list? Do they use keyboard shortcuts to open or delete a file? Mallory the expert attacker is unlikely to stumble around menus at all or in the same way Alice the novice computer user does. 3. With other measures in place, dependent on the size of the user base, it may be OK to have a high false positive ratio (<99.9%). Perhaps the organisation doesn't mind receiving 2 or 3 false alerts a day amongst 1,000 users. For point of sale systems (another potential application for this technology), a very high FP ratio may be adequate as a filter to narrow down thousands of hours of security camera footage looking for fraud (use of an unlocked terminal).
  - harshreality 15y ago
    I agree that it works for security-sensitive institutions with their own IT/security staff who can re-enable accounts if there's been a mistake. In contrast, what do I do if I get locked out of my personal computer? Either it's time-based and I have to wait 15 minutes to log in again, which is unacceptable, or I have to call my OS vendor, which is impossible. Even for ordinary employees at ordinary companies, the IT burden from false positives would be prohibitive. In an organization with sensitive or classified data, false positives when someone is unusually stressed or acting abnormally could be a benefit. The government would want to know about someone exhibiting unusual behavior when accessing classified information, even if they're not an impersonator. The problem with multiple factors (other than real biometrics) is that they're not independent. If I'm stressed or mad or tired, my behavior is likely to fall outside of the parameters for most of the checks -- keyboard timing, mouse behavior, window switching or menu navigation -- not just one of them. Even something as simple as the article's suggested creditcard.txt honeytrap won't work reliably. If I access it, maybe I'm Mallory, or maybe it's been 3 years since I set it up and I forgot it was a honeytrap. It wouldn't work inside a VM, either. You can't lock someone out when they have the ability to snapshot the entire OS below the level of the authentication system. Finally, there would be no way to help someone else with a computer problem, because they'd almost certainly get locked out.

by dhx 15y ago

harshreality 15y ago

I don't think it's good for either authentication or intrusion detection. There's some critical deadline with a lot of stress attached. I have a few moments to log in and do something important. Will the stress and different behavior prevent me from being authenticated? Will I be authenticated but kicked out when my behavior does not match the norm? If the timing detection or other behavior checking is made flexible enough to reliably cope with those situations, how much security is it really providing?

dhx 15y ago
I thoroughly agree with these points. Some further reasons why I still believe this research could prove very useful even with the problems you mentioned: 1. Perhaps multiple usage profiles can be generated based on the emotional state of the user? So perhaps there is a distinct difference between stressed Alice, angry Alice, bored Alice, "just started work and half sleeping" Alice and the usage patterns of other users in other emotional states (including Mallory the attacker). This would have the added benefit of being able to provide information about the emotional state of yourself/employees over time. This is not to say that ethical/privacy issues don't exist in this scenario. 2. Plenty of other metrics exist other than just keyboard or mouse timing. At what frequency (and timing) does a user click buttons in a user interface? How often does the user switch between applications? Did they use keyboard shortcuts to switch? How fast does the user read and navigate through a directory list? Do they use keyboard shortcuts to open or delete a file? Mallory the expert attacker is unlikely to stumble around menus at all or in the same way Alice the novice computer user does. 3. With other measures in place, dependent on the size of the user base, it may be OK to have a high false positive ratio (<99.9%). Perhaps the organisation doesn't mind receiving 2 or 3 false alerts a day amongst 1,000 users. For point of sale systems (another potential application for this technology), a very high FP ratio may be adequate as a filter to narrow down thousands of hours of security camera footage looking for fraud (use of an unlocked terminal).
- harshreality 15y ago
  I agree that it works for security-sensitive institutions with their own IT/security staff who can re-enable accounts if there's been a mistake. In contrast, what do I do if I get locked out of my personal computer? Either it's time-based and I have to wait 15 minutes to log in again, which is unacceptable, or I have to call my OS vendor, which is impossible. Even for ordinary employees at ordinary companies, the IT burden from false positives would be prohibitive. In an organization with sensitive or classified data, false positives when someone is unusually stressed or acting abnormally could be a benefit. The government would want to know about someone exhibiting unusual behavior when accessing classified information, even if they're not an impersonator. The problem with multiple factors (other than real biometrics) is that they're not independent. If I'm stressed or mad or tired, my behavior is likely to fall outside of the parameters for most of the checks -- keyboard timing, mouse behavior, window switching or menu navigation -- not just one of them. Even something as simple as the article's suggested creditcard.txt honeytrap won't work reliably. If I access it, maybe I'm Mallory, or maybe it's been 3 years since I set it up and I forgot it was a honeytrap. It wouldn't work inside a VM, either. You can't lock someone out when they have the ability to snapshot the entire OS below the level of the authentication system. Finally, there would be no way to help someone else with a computer problem, because they'd almost certainly get locked out.