2010, March 2
Typing cadence catches network intruders
We’ve all experienced that feeling of being completely anonymous on the web – not because we’re visiting sites we shouldn’t, but simply because whilst working from home or surfing the net in your lounge at home you sometimes remember that there are millions of other nameless, faceless people doing the very same thing at the very same moment. They don’t know who or where you are – whether you’re in a suit or slippers, and vice versa. Although the Internet can make the world feel a small place by making information and products hugely accessible, remembering the number of people, devices and transactions active every second can put things quickly back into perspective.
As the number of users has grown since the birth of the Internet, so has e-crime. Because of this trend, prevention and detection has had to become more and more sophisticated to keep up with the cyber criminals out there. Cookies, browser signatures, and IP addresses can all help identify particular machines and particular browsers—but how can you tell which human actually sits behind the terminal at a given moment? One way is by measuring the “cadence” of their typing.
Scout Analytics have done a huge amount of research into the way people type – and how this distinguishes us from each other. The rhythms we’re subconsciously tapping out include individual patterns such as how long we hold down various keys, and how long it takes us to move between keys. To do this, Scout used Javascript timing features to watch how users type when they enter their login credentials for various services. By watching repeated logins, Scout could soon categorise these cadences into a digital pattern, then assign each pattern a serial number. Applying the technology to its data set of 20 million logins, Scout pulled out 175,000 unique patterns – thereby identifying 175,000 distinct users, even when they used the same login credentials on the same machine.
It’s incredible technology, and shows just how quickly the net is closing in on cyber crime. The days of using the old “someone else must have been using my PC” excuse are now well and truly limited!
