Revisiting clustering methods to their application on keystroke dynamics for intruder classification

Keystroke dynamics is a set of computer techniques that has been used successfully for many years for authentication mechanisms and masqueraders detection. Classification algorithms have reportedly performed well, but there is room for improvement. As obtaining real intruders keystrokes is a very difficult task, it has been a common practice to use normal users to capture keystroke data in previous work. Our research presents a novel approach to intruder classification using real intrusion datasets and focusing on intruders behavior. We compute six distance measures between sessions to cluster them using both modified K-means and Subtractive Clustering algorithms. Our distance measures use features that came from the relation between intruders sessions, instead of using features from each user only. The performance evaluation of our experiments showed that results are promising and intruders can be successfully classified with acceptable error rates.