Keystroke Dynamics Authentication using Machine Learning

Passwords can be stolen, but the rhythm of your typing is a behavioral biometric that is hard to imitate: how long you hold each key and the flight time between keys form a timing signature. Keystroke dynamics turns a typed password into a 31-dimensional timing vector and decides whether it matches the enrolled user. The CMU keystroke benchmark (Killourhy & Maxion, Carnegie Mellon) is the standard public dataset — 51 subjects typing the same password 400 times across 8 sessions. This project implements the full authentication pipeline on the benchmark, and makes the biometric tangible with a live demo — type the exact CMU password five times to enroll, then verify a new attempt while the app measures every dwell and flight time with millisecond precision and scores it with a real scaled-Manhattan distance. Because the demo measures genuine keystrokes and states exactly what the classical detector does, the student can defend the whole system in the viva.

1. Raw CMU keystroke records (keydown/keyup timestamps per repetition) are parsed into 31 timing features: dwell times and flight times across the password.
2. Features are normalized per user (mean/std scaling from enrollment data only), so the model compares rhythm shape, not absolute typing speed.
3. For each user, early repetitions form the enrollment template; later repetitions are genuine test attempts, and other users' repetitions are impostor attempts.
4. The scaled-Manhattan detector scores an attempt by its normalized Manhattan distance to the template; a threshold decides genuine vs impostor.
5. The evaluation harness sweeps the threshold to build FAR/FRR curves, reads off the equal error rate, and reports zero-miss FAR — repeated per classifier.
6. In the web demo, your own keystrokes are timed live, enrolled over five samples, and verified with the same scaled-Manhattan computation the notebook uses.

Tech stack:

• Python 3, NumPy, pandas, scikit-learn
• Jupyter Notebook (benchmark pipeline & evaluation)
• HTML5 + JavaScript (live timing measurement, performance.now)
• Matplotlib (FAR/FRR/ROC plots)
• CMU keystroke dynamics benchmark

Dataset & model details

• Dataset: CMU keystroke dynamics benchmark (Killourhy & Maxion, Carnegie Mellon) — 51 subjects, password ".tie5Roanl" (10 characters), 400 repetitions per subject across 8 sessions, 31 timing features per repetition (dwell + flight times).
• Task: Authentication (verification); input = one 31-D timing vector from a typed password, output = genuine/impostor decision with an anomaly score.
• Model: Classical: scaled-Manhattan detector (per-user mean/std scaling, Manhattan distance, threshold decision). Built-to-order: feed-forward neural network and one-class SVM verifiers compared against the baseline.
• Metrics: Equal error rate (EER) ≤ 8% (design target), zero-miss FAR reported (evaluated), FAR/FRR curves and ROC, enrollment 5–10 repetitions (expected), verification latency < 50 ms (expected). No error rate is claimed as measured until the evaluation harness runs for the order.

• [Live keystroke biometric demo] Enroll by typing the CMU password five times; every dwell and flight time is measured with performance.now() on your real keystrokes — no simulated data anywhere.
• [Scaled-Manhattan verifier] The classical detector from the keystroke literature: per-user mean/std normalization, Manhattan distance over the 31 timing features, adjustable decision threshold.
• [Timing inspector] Inspect any enrollment sample's dwell and flight times feature by feature, with the normalization statistics shown.
• [CMU benchmark pipeline] Full data loading, per-user enrollment/testing splits and feature extraction over all 51 subjects and 400 repetitions in a reproducible notebook.
• [FAR/FRR evaluation] False-accept and false-reject curves, ROC, equal error rate and zero-miss FAR — the standard biometric evaluation, all reproducible.
• [Stronger classifiers] Neural-net and one-class SVM verifiers compared against the scaled-Manhattan baseline, with the measured improvement documented.
• [Enrollment-size study] Verification error as a function of enrollment repetitions (5–10), answering the practical "how much typing is enough?" question.

• Complete benchmark pipeline & evaluation Jupyter notebook (FAR/FRR/ROC/EER)
• Trained verifier models (neural net + one-class SVM) with enrollment code
• Live enroll-and-verify + timing inspector + system report web demo
• FAR/FRR curves, ROC plots and enrollment-size study figures
• Project report PDF (biometric background, timing-feature theory, model comparison, methodology, results)
• PPT presentation for final review
• Viva Q&A preparation document (behavioral biometrics, dwell/flight features, FAR vs FRR, EER, impostor evaluation)

• Keystroke timing drifts with fatigue, injury, keyboard changes and mood — the report discusses template aging and re-enrollment honestly.
• ≤8% EER is a design target for the evaluation run, stated honestly — the report documents the actual measured figures after the harness runs.
• The CMU password is fixed (.tie5Roanl); free-text keystroke authentication is a harder problem, documented as future scope.
• The demo enrolls with 5 samples, the practical minimum; the benchmark study shows how error falls with more enrollment repetitions.
• Behavioral biometrics are weaker than physiological ones — the report positions keystroke dynamics as a second factor, not a sole authenticator.