Keystroke dynamics based continuous authentication

Authentication is a fundamental security mechanism, and most modern systems perform user authentication only once during the start of a session. If a device is subsequently left unattended, the session can be hijacked by an attacker. Continuous authentication aims to mitigate these risks by monitoring the user throughout the session. Among the various approaches for this concept, keystroke dynamics—evaluating genuineness based on typing behavior—is particularly promising as it is non-intrusive and requires no additional hardware. However, existing methods vary widely in terms of evaluation metrics, keystroke lengths, and privacy implications. In this thesis, we survey the state-of-the-art in keystroke dynamics and investigate a novel transformer-based approach, TempCharBERT. We analyze and evaluate TempCharBERT in terms of multiple criteria to determine its usefulness for real-world applications. To this end, we investigate the model's capabilities on unseen impostors and its sensitivity to the length of keystroke samples. Furthermore, we propose a privacy preserving architecture based on client side personalization. We also explore TempCharBERT's ability to train on synthetic data to reduce the required data for training. Lastly, we investigate its ability to generalize to unseen languages and textual contexts. Our results show that the model performs well on unseen users and still produces satisfying results even when the keystroke sample lengths are lowered for training and evaluation. It also remains effective in the proposed architecture with client side personalization and server side encoder training, and we demonstrate that synthetically generated samples can be used to boost performance compared to a lower sample size baseline. However, research on multilingual and cross-context data reveal a substantial drop in performance not only with language shifts but also with shifts in context of what is typed. This limitation significantly impacts the model's applicability in real-world settings with multilingual users and changes in typing context.