敲鍵行為統計學習模型應用於網路身份認證

Abstract

傳統網路身份認證機制單純依靠檢查帳號和密碼的正確性，已經不足以應付急速發展的網路應用和快速成長的電子商務，如果發生使用者的帳號和密碼被他人竊取使用的情況，傳統網路身份認證機制將無法正確辨識出登入者的真實身份。敲鍵行為特徵分析屬於生物身份辨識科技的一種，具備低成本和透明性，相當適合用來搭配或取代傳統網路身份認證機制。本篇論文提出結合統計學習理論中的隱藏式馬可夫模型和高斯機率模型，來建立敲鍵行為特徵的統計機率模型，利用此統計機率模型來分析使用者登入帳號和密碼的敲鍵時間資訊，藉此提高登入者真實身份認證的準確性。實驗結果顯示，帳號和密碼的長度如果限制大於或等於九的話，本篇論文所提出的方法可以將錯誤率降低到 2.54 %。

As the rapid evolution of E-commerce, traditional password authentication mechanism is insufficient to provide strong security and reliability for identity verification of web-based applications. Under the circumstance that the intruder could make use of the username and password stolen from the innocent individual, conventional password authentication mechanisms are incapable to distinguish the discrepancy between the intruder and the innocent individual. Keystroke typing characteristics is one of the most novel and creative biometric techniques. The low-cost and transparency of keystroke typing characteristics make it appropriate to complement, but not to replace traditional password authentication mechanism used by web-based applications. In this thesis, we proposed a statistical model for keystroke typing characteristics based on Hidden Markov Model and Gaussian Modeling from Statistical Learning Theory. The accuracy of the identity authentication can be substantially enhanced by analyzing keystroke timing information of the username and password using our proposed model. The results of the experiment showed that, with the condition on both the minimum length of the username and password restricted to be greater than or equal to 9, we achieved by far the best error rate of 2.54 %.