Online Binary Models are Promising for Distinguishing Temporally Consistent Computer Usage Profiles

TL;DR

This study demonstrates that online binary models using process, network, mouse, and keystroke data can reliably identify users over time, showing high accuracy and consistency in naturalistic computer usage profiles.

Contribution

The paper shows that online binary models effectively distinguish users based on naturalistic computer activity, highlighting the importance of network features and the potential for continuous authentication.

Findings

Profiles were mostly consistent over 8 weeks.

Binary models achieved up to 99.90% F-score in user recognition.

Network features were most relevant for distinguishing users.

Abstract

This paper investigates whether computer usage profiles comprised of process-, network-, mouse-, and keystroke-related events are unique and consistent over time in a naturalistic setting, discussing challenges and opportunities of using such profiles in applications of continuous authentication. We collected ecologically-valid computer usage profiles from 31 MS Windows 10 computer users over 8 weeks and submitted this data to comprehensive machine learning analysis involving a diverse set of online and offline classifiers. We found that: (i) profiles were mostly consistent over the 8-week data collection period, with most (83.9%) repeating computer usage habits on a daily basis; (ii) computer usage profiling has the potential to uniquely characterize computer users (with a maximum F-score of 99.90%); (iii) network-related events were the most relevant features to accurately recognize profiles (95.69% of the top features distinguishing users were network-related); and (iv) binary models were the most well-suited for profile recognition, with better results achieved in the online setting compared to the offline setting (maximum F-score of 99.90% vs. 95.50%).