Intrusion Detection Using Mouse Dynamics

TL;DR

This paper evaluates the effectiveness of mouse dynamics as a behavioral biometric for impostor detection using the Balabit dataset, highlighting the potential of specific mouse actions for accurate identification.

Contribution

It presents a performance evaluation of mouse dynamics for impostor detection, utilizing a publicly available dataset and analyzing different mouse actions for improved accuracy.

Findings

Set of actions-based evaluation achieved 0.92 AUC.

Drag and drop actions were most effective for detection.

Short test sessions pose challenges for analysis.

Abstract

Compared to other behavioural biometrics, mouse dynamics is a less explored area. General purpose data sets containing unrestricted mouse usage data are usually not available. The Balabit data set was released in 2016 for a data science competition, which against the few subjects, can be considered the first adequate publicly available one. This paper presents a performance evaluation study on this data set for impostor detection. The existence of very short test sessions makes this data set challenging. Raw data were segmented into mouse move, point and click and drag and drop types of mouse actions, then several features were extracted. In contrast to keystroke dynamics, mouse data is not sensitive, therefore it is possible to collect negative mouse dynamics data and to use two-class classifiers for impostor detection. Both action- and set of actions-based evaluations were performed. Set of actions-based evaluation achieves 0.92 AUC on the test part of the data set. However, the same type of evaluation conducted on the training part of the data set resulted in maximal AUC (1) using only 13 actions. Drag and drop mouse actions proved to be the best actions for impostor detection.