Identifying or authenticating people based on how they type is not a new idea, but thanks to advances in artificial intelligence it can now be done with a very high level of accuracy, making it a viable replacement for other forms of biometrics.
Research in the field of keystroke dynamics, also known as keyboard or typing biometrics, spans back over 20 years. The technique has already been used for various applications that need to differentiate among computer users, but its widespread adoption as a method of authentication has been held back by insufficient levels of accuracy.
Keystroke dynamics relies on unique patterns derived from the timing between key presses and releases during a person’s normal keyboard use. The accuracy for matching such typing-based « fingerprints » to individual persons by using traditional statistical analysis and mathematical equations varies around 60 percent to 70 percent, according to Raul Popa, CEO and data scientist at Romanian startup firm TypingDNA.
Some vendors have invested a lot of money over the past 10 years to improve the precision of typing biometrics, but true success has only been achieved over the past two or three years due to advances in machine learning, Popa said.
Popa’s company has used these advances to develop A. I.-powered typing pattern-recognition technology that it claims has an accuracy of more than 99 percent — and can even reach 99.9 percent when there is a sufficiently large typing profile built for the user over time.
The technique involves recording small pieces of information about how users type, like the time it takes them to move from one key to another or the length of time they keep each key pressed. This is used to create unique typing patterns that are represented as feature vectors made up of 320 values.
TypingDNA’s technology only records statistics about the 44 most-used keys on a keyboard, and doesn’t record sequences between two or more keys because such information could potentially be used to reconstruct text.
Keystroke recognition is not meant to replace passwords or to be used alone as a method of authentication. Instead, it can be used in a multifactor authentication system and is easier to implement than other forms of biometric verification.
To use fingerprint, face or voice recognition, websites have to ask users for access to their microphones, webcams or fingerprint readers. Gathering the data needed to build typing patterns, however, can be done from JavaScript with no additional permissions other than what websites already have by default inside browsers.
In order to build typing profiles, TypingDNA’s technology needs users to type a minimum of 60 to 70 characters, but this can vary depending on what the service is being used for, according to Popa.
