Using global knowledge of users' typing traits to attack keystroke biometrics templates

Research in the field of keystroke dynamics (KD) has traditionally assumed impostor attacks to be originated by humans. However, recent studies have revealed that bots and various categories of malware have the capacity to implement intelligently crafted synthetic attacks against KD systems. In this paper we make a large-scale study of human typing traits, and then use the general observed statistical trends to train a tool that breaks password-KD templates. Our aim is to investigate how a synthetic attack designed with general knowledge about users' typing habits would perform against a password-KD co-authentication system in practice. Our initial results indicate that in the wake of synthetic impostor attacks, the incorporation of KD into regular password-based systems may not necessarily lessen the burden of users having to maintain strong passwords for guaranteed security.