Performance evaluation of anomaly-detection algorithm for keystroke-typing based insider detection

Abstract

Keystroke dynamics is the process to identify or authenticate individuals based on the typing rhythm behaviors. There are many classifications proposed to check the user's legitimacy, and therefore we should make it clear how they perform in order to confirm promising research direction. Nevertheless, these researches provide experiments in different situations such as datasets, conditions and methodologies as well. This paper aims to benchmark the algorithms in the same dataset and feature in order to measure the performance on an equal level. Using dataset containing 51 subjects' typing rhythm, we implemented and evaluated 13 classifiers measured by F1-measure. We also develop a way to process the typing data, and test it on these algorithms. Considering the case that the model should reject outlander, we test the algorithms on open set. The top-performing classifier achieves F1-measure rates 0.92 when using 50 subjects' typing normalized data to train and the remaining one to test. The results, along with the normalization methodology, constitute a benchmark for comparing classifiers and measuring performance of keystroke dynamics for insider detection.