This research asks, "What is the cyber-equivalent of a fingerprint -- that staple of forensic investigation in the physical world?" If one is able to identify users forensically by their "fingerprints" in cyberspace, what would correspond to the familiar loops, whorls and minutiae of physical evidence? It is hypothesized that just as a person may be identified by his handwriting, or by his manner of expression in prose, so may a person be identified by his typing style -- the particular rhythm of a user's keystrokes. The approach being investigated is keystroke dynamics, the use of precise keystroke timings as a mechanism for building unique user profiles for differentiating among users. Goals of the work are to determine whether keystrokes can be used to identify/authenticate users in two-factor authentication protocols, whether user keystroke patterns can be used to thwart insider attacks, and whether keystroke habits are sufficiently distinct to show who issued a command or typed a document. The work will develop the science, methodologies and techniques to answer such questions. The results of the project are expected to provide a basis for substantial increases in on-line security in applications such as web-based financial transactions, two-factor authentication in various domains, and questioned-document forensics. The involvement of students, minorities, jurists and lay people in the scientific process will raise community awareness regarding computer forensic techniques, and will provide a foundation for rigorous experimental science.
CT-T: Keystroke Forensics - Fingerprints in the CyberWorld