Adversarial Activity Detection Using Keystroke Acoustics

Using keystroke acoustics to predict typed text has significant advantages, such as being recorded covertly from a distance and requiring no physical access to the computer system. Recently, some studies have been done on keystroke acoustics, however, to the best of our knowledge none have used them to predict adversarial activities, such as password dictionary attacks, data exfiltration, etc. We show that keystrokes in an adversarial environment have unique characteristics that distinguish it from benign environments and these differences can be used to predict adversarial activities and threat levels against a computer system. On a dataset of two million keystrokes consisting of seven adversarial and one benign activity, we use a signal processing approach to extract keystrokes from the audio and a clustering method to recover the typed letters followed by a text recovery module to regenerate the typed words. Furthermore, we use a neural network model to classify the benign and adversarial activities and achieve significant results: (1) we extract individual keystroke sounds from the raw audio with 91% accuracy and recover words from audio recordings in a noisy environment with 71% average top-10 accuracy. (2) We classify adversarial activities with 93.11% to 98.07% average accuracy under different operating scenarios.