The Reverse Problem of Keystroke Dynamics: Guessing Typed Text with Keystroke Timings Only

Keystroke dynamics can be used to verify the user identity, but also as a means to recover what was typed, through an attack that gains access to the keystroke timings. We propose a method for the task of finding, given only the keystroke timings, whether a medium-sized candidate list of possible texts includes the one to which the timings belong. The timings sample does not need to be short and, with current error rates, the list size can be in the order of one hundred. Previous samples for the candidate texts are not required to train the models. Evaluated using three publicly available datasets, false acceptance and false rejection rates were found to remain below or very near to 1% when user samples were available for training. The FAR increases between two- to three-fold when the models are trained with samples from other users, while the FRR jumps to around 15%.