This paper proposes a methodology to verify the identity of students based on their KD. The proposed approach is tested on two different modalities: intrusive and non-intrusive. The first mode considers the case when the subject is aware of being tested, and the second mode considers the case where the subject is not aware of the verification process, and then a different writing task is required to verify the identity of the subject.

The features extracted from the writing tasks are used to create Gaussian Mixture Models (GMM). Those models are compared using probabilistic distances to make the decision whether a user is valid or not. The main difference of the proposed method with respect to others reported in the literature is that our approach is based on probabilistic models instead of the direct comparison of feature sets. The results indicate that it is possible to detect intruders with accuracies of up to 89 %, measured in the EER.

A total of 170 subjects (116 male) participated in this study. The average age was 24 years old. The subjects were asked to perform 5 different tasks which were

designed to capture the KD over different regions of the keyboard. Most users were undergraduate students from the University of Antioquia. Users with higher education attainment were also considered.

In addition, 20 of the 170 users performed different tasks in two different sessions. (Table 1) details participants’ information.

Table 1 Table 1 Demographic information of the participants in this study

	Male	Female
Subjects	116	54
Age (µ ± σ)	23 ± 5.8	24 ± 7.1
Students	102	44
Graduate	6	7
MSc	4	-
PhD	4	3

Source: Created by the authors.

Each user of the database performed 5 different tasks the first 4 tasks were designed to capture specific movements on the keyboard. For instance, task 1 captures long horizontal displacements. In this task, the user typed the sentence “El sapo de mi casa come queso, zapallo y xoubas”. Here, the characters of each word follow other characters on the opposite side of the keyboard; thus, it is possible to define the user’s dynamics while moving from one side to the other. (Fig. 1a) shows the keyboard regions involved in this task.

Fig. 1. Fig. 1. (a) Task 1, long displacement on the horizontal axis; (b) Task 2, short displacement on the horizontal axis; (c) Task, 3 top displacement on the vertical axis; and (d) Task 4, lower displacement on the vertical axis. Source: Created by the authors.

The arrow indicates displacements between the two regions. Similarly, task 2, “En un pueblo un niño juega afuera y tu vejez es notable”, aims to capture short displacements along the horizontal axis. These displacements are shown in (Fig. 1b). Task 3, “La leña esta partida, la tijera se ha roto, yo quiero jugar y reír, dale a la gata sus gatitos y las fresas y las patatas del huerto”, connects characters in the middle row of the keyboard with some in the top row, defining top vertical displacements. This task is shown in (Fig. 1c).

Finally, task 4, “La vaca flaca, las lañas malvas, las jacas blancas, a la sal acabas la salsa, zancada flaca”, requires the user to connect characters in the middle row with characters in the bottom row, defining the lower vertical displacements, as shown in (Fig. 1d). To define users’ KD in normal conditions, we considered the task 5, which has a total of 500 characters. This task was extracted from the novel Frankenstein or the modern Prometheus by Mary Shelly ^[10]. (Table 2) details the size of each task.

Table 2 Table 2 Length of each task

Tasks	Character count	Word count
1	54	11
2	56	12
3	133	28
4	92	17
5	518	90

Source: Created by the authors.

A user registers in the platform by typing the first 4 tasks previously described in the (Fig 1). When the user types, the system returns data from the KD. The user-model is created with the KD data. When the user logs into the platform, s/he should type one of the 5 tasks following a procedure similar to the one completed during registration stage. A login model is created per user and compared to the model created during registration stage. Finally, if the distance between these two models is short, the user is classified as valid; otherwise, the user is classified as an intruder. The general methodology is summarized in (Fig. 2). The next subsections detail the methods applied at each stage of the methodology.

Fig. 2. Fig. 2. General methodology implemented in this study. The upper part of the methodology shows the registration stage; and the lower part, the log-in stage. Source: Created by the authors.

Computers can provide the ASCII code of the characters that are typed when a text is written. They can also store the time the keys were pressed (P) and released (R). (Table 3) shows an example with the raw information that can be extracted when the word “Hola” is typed.

Table 3 Table 3 Example of data captured by the platform Word hola p press r release

Key	Code	Operation	Time(ms)
H	72	P	3301
O	111	P	3524
H	72	R	3556
O	111	R	3612
L	108	P	3644
L	108	R	3692
A	97	P	3716
A	97	R	3820

Source: Created by the authors.

Table 3. Example of data captured by the platform. Word= “hola”, p: press, r: release.

The objective of this stage is to find a feature matrix 𝑋 ∈ ℝ ^𝑛,𝑘 associated to each user. 𝑛 refers to the number of segments, and 𝑘 is the number of extracted features. (Fig. 3). Describes the feature matrix 𝑋. Note that each task might have a different number of segments (rows), but the number of features is fixed. The characterization process is divided into two parts: segmentation and feature extraction.

Fig. 3. Fig. 3. Feature matrix 𝑋 of each user. Source: Created by the authors.

A GMM is a probabilistic model created to represent a population from a linear combination of Gaussian distributions.

Each Gaussian of the GMM models a specific group of samples in a population ^{[12], [13].} Equation (1) shows the mathematical expression for a GMM of a multivariate random variable 𝒙, which corresponds to the sum of 𝑀 Gaussian distributions, weighted by a parameter 𝐶_𝑚.

(1)

A compact way to represent GMM models is indicated in (2).

(2)

Three parameters should be estimated in the GMM modeling approach: weight 𝐶_𝑚, mean vector 𝝁_𝑚, and covariance matrix 𝜮 _𝑚 . 𝑚 is the index for the Gaussians. These parameters are estimated using the Expectation–Maximization (EM) algorithm. The total number of Gaussians 𝑀 must be defined before starting the estimation procedure, and it can be done according to the Bayesian Information Criterion (BIC) ^[14], which measures the quantity of information lost when the model is used.

However, in case of problems where there is no prior knowledge of the data, the number of Gaussian distributions is found experimentally ^[11].

Each user is represented by a GMM.

Thus, to calculate the similarity between two models (registration: 𝑓_𝑖(𝑥) and log-in: 𝑔_𝑖(𝑥)), we can use the Bhattacharyya distance ( 𝐷_𝑏ℎ𝑎), where 𝝁_𝑚 and the 𝜮 _𝑚 of each GMM are taken into account ^[15].

𝐷_𝐵ℎ𝑎 can be expressed as in (3):

(3)

where the first term considers the mean vectors of the GMMs, and the second term is the covariance matrix. As indicated in Equation (3), the similarity measurement between the two models, 𝑓_𝑖(𝑥) and 𝑔_𝑖(𝑥), considers the mean vectors and the covariance matrix separately. Mean vectors are compared in (4), while the covariance matrix is considered in (5).

(4)

(5)

Finally, depending on the similarity of both models, it is possible to classify the user’s identity. If the user is valid, the distance between the two models is expected to be less than the distance resulting from an impostor. However, it is necessary to define a threshold 𝑈 to decide whether a user is valid or an impostor.

This distance measurement has been considered in previous studies where GMM models resulting from speech recordings are compared ^[16].

(Fig. 6) and (Fig.7) show the flowchart of the registration and login stages, respectively. The number of components 𝑀 and the decision threshold 𝑈 are found in the training and development stage explained below.

Fig. 6. Fig. 6. Flowchart of the registration stage Source: Created by the authors.

Fig. 7. Fig. 7. Flowchart of the login stage Source: Created by the authors.

In the intrusive mode, two sessions are required because the registration and log-in writing tasks are the same, then we use the first session to register and the second to log-in the user. In this case only 20 of the 170 users have two sessions; therefore, this experiment was conducted with 20 users.

For this experiment a cross validation strategy was carried out with 5 folds (Subject independent in each fold).

Therefore 4 subjects were considered for the test and 16 were considered for the training. The (Fig.8) shows the test and train sets for each fold.

Fig. 8. Fig. 8. EER when varying the decision threshold. Source: Created by the authors.

The strategy for the training of the GMM-based model in this experiment is the same as the previous experiment. For this experiment the optimal hyper-parameters are: 𝑀 = 36 ± 6.074 and 𝑈 = 0.013 ± 0.021

Table 5 shows the performance and usability of the system by varying the number of chunks used to decide whether the user is valid or not. In this case the CUE is the same as the previous experiment, because the same tasks are used to create the registration model.

Table 5 Table 5 Performance and usability metrics generating login models with unknown tasks by the register model using an average distance

Used Chunks	FPR (µ±σ)	FNR (µ±σ)	EER (µ±σ)	CUA
1	13.5 ± 0.9	13.6± 0.5	13.6 ± 0.7	104
2	18.8 ± 0.7	9.6 ± 0.4	14.2 ± 0.6	208
3	12.9 ± 1.0	10.4 ± 0.5	11.7 ± 0.8	312
4	14.1 ± 1.0	10.0 ± 0.5	12.1 ± 0.8	416
5	14.7 ± 1.0	9.8 ± 0.4	12.3 ± 0.7	520

Source: Created by the authors.

In the literature there are several works of biometric verification based on keystroke dynamic, but few verify identity of the user in a non-intrusive way. The methodology proposed in ^[6] is a work of identity verification in non-intrusive mode.

We implemented this methodology with the 170 users of our database. In ^[6], the authors propose to create a student profile based on the average Hold time when pressing different keys. The similarity between registered and log-in samples is calculated by the Euclidean distance and a training set was taken to optimize the decision threshold.

This methodology was adapted to the problem of non-intrusive verification, using tasks 1 to 4 as register tasks and the task 5 for log-in.

(Fig. 9) shows the EER when varying the decision threshold from 0 to 7000 with steps of 10. Fig. 9 shows an EER of 36 % when the threshold is 390. This is the minimum EER obtained using the methodology proposed in ^[6] for a non-intrusive verification approach. As it can be observed, the approach proposed here, based on GMM models, is more accurate and reliable than other approaches reported in the literature.

Fig. 9. Fig. 9. EER when varying the decision threshold. Source: Created by the authors.