Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?

Question

The typical set of multi-factor categories is as follows:

• Something you know (e.g. a password)
• Something you have (e.g. a hardware token, or key file)
• Something you are (e.g. a fingerprint or retina scan)

I'd argue that there is a fourth category - some behaviour you exhibit (or "something you do", to put it simply). This might be your gait (walking posture), your handwriting, or the way you type on a keyboard. It's often an extension of your physical form (e.g. musculature) that produces these behaviours, but they're also affected by psychology and often aren't as fixed as a physical attribute like a fingerprint.

I'm interested in how behavioural analysis can be used as a fourth authentication factor. I've worked on profiling keystroke dynamics before, using letter pair timings (e.g. average time between pressing 'q' and 'u') and various other metrics as a way to authenticate a person. My results were reasonably good; the profile I created authenticated me and denied access to several other people that attempted to gain access, though my testing wasn't particularly scientific or thorough.

However, I'm unsure as to how secure such metrics are on a larger scale. Are there any tried-and-tested mechanisms with known security margins and flaws? Are there any particular metrics that work better than others? Has there been any extensive research into this type of authentication factor? I'd certainly be interested to see any easily-digestable papers on the matter.

Answer 1

This has already been done by numerous vendors (click here), and patents have been on technologies similar to keystroke dynamics dating back as far as 1986 (click here or here).

Here is a paper which addresses using keystroke dynamics as biometric authentication, but I'm not sure how "digestible" it is for the lay person.

It would be hard to implement this across the board because, although a person's keystroke dynamics are often similar day-to-day you need to be able to account for significant variation. If a person is sick or tired they won't type the same as if they are angry.

Although I don't think this technology is ready for prime-time, I think it's great to discuss and investigate different types of biometric authentication and individual profiling to strengthen your security posture.

Answer 2

The second link that AviD posted in comments diagrams its concept thus:

Several things need to be considered in order to make this work:

1. Tablets, phones, and other mobile devices will have VERY different user dynamics compared to keyboard/mouse. Any such system intended for use alongside credential authentication would need to account for this. (The linked paper even remarks in the closing section that the variety of configurations in mice alone would present difficulties.)

2. The dynamics authentication channel would need to be protected in some way. It wouldn't necessarily be trivial to MITM this, but it's certainly not impossible.

3. As others have posted, any such form of "cognitive footprint" authentication can be used only as a support for other forms of authentication. It cannot have equal weight to something one has or something one knows. Otherwise you run the risk of locking out a sick/emotional/tired user. (Usually fine for military applications, but for general public use it's a bad business decision.)

Bruce Schneier posted about this early this year, actually. There's some good discussion in the comments there, although nothing definitive.

TL;DR: Behavioural analysis cannot currently be given equal weight with other factors in MFA. Usage as a support factor is possible to about the same degree as biometrics.

Answer 3

Behavioral dynamics is about on par with signature analysis/forgery for security. Which is to say, a casual attacker isn't likely going to successfully impersonate you, but as you said, it's not something you are, it's something you do. It's habits rather than features.

Of course, behavioral tendencies are pretty instinctual, and difficult to change at-will, but nonetheless just about any behavior can be acquired given enough practice. So much the same way that written signature security is based on the assumption that no one will sufficiently practice forging your signature, the security of any other behavioral fingerprinting is based on the assumption that no one will train themselves to impersonate your behaviors.

So it's probably OK for casual security, but anything high-value where an actual concerted attack is likely; that's a bit more iffy. Some behaviors are probably much harder to impersonate than others, but in the end you're never going to have proof of the security of such a system, and your confidence in such a system should be correspondingly reserved.

Answer 4

It could be, but personally I haven't seen any data to support it. My gut feel is that it could be a useful additional factor, but I would not use it as a primary factor for authentication. As with most biometrics you need to understand how you define, set and compute the crossover threshold (where false positives and false negatives converge). This is a

Answer 5

It's certainly am interesting thought, however there's no research that I can find to support it. My instinct tells me that it would not be reliable, that changes in conditions, different keyboards, the subject him/herself would all add up to lots of false negatives and positives. Just think what intoxication, illness, or simple fatigue would do to your typing patterns! My fingerprint doesn't change when I'm short of sleep.

Also, how much would you have to type to establish a pattern?

Answer 6

Yes, there are one more factor to consider as "Something you do" which includes your handwriting pattern, typing speed etc I found in the book Computer Security: Art & Science by Mat Bishop.