Keystroke Dynamics for Authentication: A Systematic Comparative Analysis of Machine Learning, Deep Learning, Hybrid, and Quantum Approaches

Öz

We present a systematic review of keystroke-dynamics authentication across classical machine learning (ML), deep learning (DL), hybrid, and emerging quantum-ML approaches. The review synthesizes evidence from desktop, mobile, and web settings; compares common datasets (e.g., CMU, GREYC, Aalto, Clarkson); and evaluates models using EER, FAR, and FRR. Three findings stand out. First, dataset breadth, device context, and evaluation protocol explain much of the variance reported in the literature; on free-text inputs, modern DL (e.g., Transformers, Siamese networks) typically achieves EER ≈0.01–2% on large, diverse sets, outperforming classical ML. Second, hybrid designs, feature extraction with DL plus classical classifiers or multimodal fusion (keystroke + touch/mouse), improve robustness and user experience relative to single-modality systems. Third, claims of near-perfect accuracy from quantum-ML are confined to small or simulated studies and are not yet generalized. We map model risks to the OWASP Authentication Cheat Sheet (replay/spoofing, template security, adversarial examples, lockout usability) and outline mitigations (MFA, liveness, cancelable templates, throttling). Finally, we chart a practical pipeline and highlight near-term directions: federated learning and edge deployment for privacy/latency, explainable AI for auditability, and standardized benchmarks for fair comparison.

Anahtar Kelimeler

• Keystroke authentication
• Behavioral biometrics
• Machine learning
• Security
• User experience
• Spoofing attacks

Kaynakça

1. Anwar, F., Khan, B., Kiah, L., & Goh, K. (2022). A Comprehensive Insight into BlockchainTechnology: Past Development, Present Impact and Future Considerations İnternational Journal of Advanced Computer Science and Applications, https://doi.org/10.14569/IJACSA.2022.01311101
2. Barra, S., Castiglione, A., Narducci, F., De Marsico, M., & Nappi, M. (2019). Biometric data on the edge for secure, smart and user tailored access to cloud services. Future Generation Computer Systems, 101, https://doi.org/10.1016/j.future.2019.06.019
3. Bhasin, N.,(2025). Authentication using dynamics keystrokes and quantum machine learning. Journal of Information Systems Engineering and Management, 10(49s), 1273–1281. https://doi.org/10.52783/jisem.v10i49s.10134
4. Bhatia, A., & Hanmandlu, M. (2017). Keystroke dynamics based authentication using information sets. Journal of Modern Physics, 8(9), 1557–1583. https://doi.org/10.4236/jmp.2017.89094
5. Bonneau, J., Herley, C., van Oorschot, P. C., & Stajano, F. (2012). The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. IEEE Security & Privacy, 10(1), 44–52. https://doi.org/10.1109/SP.2012.44
6. Ceker, H., & Upadhyaya, S. (2016). Keystroke dynamics for user authentication and identification. International Journal of Information Security and Privacy, 10(2), 1–15. https://doi.org/10.1109/BTAS.2016.7791182
7. Doshi-Velez, F., & Kim, B. (2017). Towards a rigorous science of interpretable machine learning. arXiv. https://doi.org/10.48550/arXiv.1702.08608
8. Fatima, K. & Afaf, M. (2022). Keystroke-based biometric authentication in mobile applications. International Journal of Software Innovation. https://doi.org/10.4018/IJSI.303574

9. Giot, R., El-Abed, M., & Rosenberger, C. (2011). Keystroke dynamics authentication for collaborative systems. In Proceedings of ICCSII (pp. 1–6). IEEE. https://doi.org/10.1109/CTS.2009.5067478
10. Grassi, P. A., Garcia, M. E., & Fenton, J. L. (2017). Digital identity guidelines: Authentication and lifecycle management (NIST SP 800-63B). National Institute of Standards and Technology.
11. Guo J., Mu H., Liu, X., Ren, H. & Han, C. (2024). Federated learning for biometric authentication: A comprehensive survey. Artificial Intelligence Review https://doi.org/10.1007/s10462-024-10847-7
12. Hazan, I., Margalit, O., & Rokach, L. (2019). Securing keystroke dynamics from replay attacks. Applied Soft Computing, 85, Article 105798. https://doi.org/10.1016/j.asoc.2019.105798
13. Jain, A. K., & Li, S. Z. (Eds.). (2011). Handbook of face recognition. Springer.
14. Killourhy, K. S., & Maxion, R. A. (2009). Comparing anomaly-detection algorithms for keystroke dynamics. In Proceedings of IEEE/IFIP DSN (pp. 125–134).
15. Kim, D. I., Lee, S., & Shin, J. S. (2020). A new feature scoring method in keystroke dynamics-based user authentications. IEEE Access, 8, 27901–27913. https://doi.org/10.1109/Access.2020.2968918
16. Lien, C.-W., & Vhaduri, S. (2023). Challenges and opportunities of biometric user authentication in the age of IoT: A survey. ACM Computing Surveys, 56(1), Article 14. https://doi.org/10.1145/3603705
17. Liu, W., Chen, M., Jiang, X., Chen, W., Zeng, S., Ren, Z., Guo, H., & Yu, H. (2025). Dynamic keystroke-password recognition based on piezoelectric-triboelectric coupling sensor array with crosstalk-free for authentication system. Nano Energy, 136, Article 110667. https://doi.org/10.1016/j.nanoen.2025.110667
18. Mayda, A. S., & Demir, O. (2018). Tuş vuruş dinamikleri ile klavye kullanım stiline dayalı kullanıcı tanıma. Süleyman Demirel University Journal of Natural and Applied Sciences https://doi.org/10.19113/sdufenbed.501503
19. Momeni, S., & BabaAli, B. (2025). Free-text keystroke authentication using transformers: A comparative study of architectures and loss functions. Soft Computing, 29, 1259–1272. https://doi.org/10.1007/s00500-025-10524-z
20. OWASP. (2023). Authentication cheat sheet. OWASP Foundation.
21. Palin, K., Feit, A. M., Kim, Y., Kristensson, P. O., & Oulasvirta, A. (2019). Aalto desktop and mobile datasets for keystroke dynamics. In Proceedings of CHI 2019.
22. Pilsung, K., Sungzoon, C., (2015). Keystroke dynamics-based user authentication using long and free text strings from various input devices. Information Sciences.308:72-93 https://doi.org/10.1016/j.ins.2014.08.070
23. Ratha, N. K., Connell, J. H., & Bolle, R. M. (2001). Enhancing security and privacy in biometrics-based authentication systems. IBM Systems Journal, 40(3), 614–634. https://doi.org/10.1147/sj.403.0614
24. Revett, K. (2009). Behavioral biometrics: A remote access approach. Springer. https://doi.org/.1002/9780470997949
25. Roy, S., Pradhan, J., Kumar, A., Das Adhikary, D. R., Roy, U., Sinha, D., & Pal, R. K. (2022). A systematic literature review on latest keystroke dynamics based models. IEEE Access, 10, 92192–92235. https://doi.org/10.1109/ACCESS.2022.3197756
26. Saini, B. S., Kaur, N., & Bhatia, K. S. (2018). Authenticating mobile phone user using keystroke dynamics. International Journal of Computer Science and Engineering, 6(12). https://doi.org/10.26438/ijcse/v6i12.372377
27. Saini, B. S., Singh, P., Nayyar, A., Kaur, N., Bhatia, K. S., El-Sappagh, S., & Hu, J.-W. (2020). A three-step authentication model for mobile phone user using keystroke dynamics. IEEE Access, 8, 125909–125923. https://doi.org/10.1109/ACCESS.2020.3008019
28. Salim, U. T., Qaddoori, S. L., & Allayla, N. M. (2024). Building a keystroke dynamic recognition system using an improved accelerated method. Journal of Optimization and Decision Making, 3(1), 389–397.
29. Stragapede, G., Vera-Rodriguez, R., Tolosana, R., (2023) Keystroke Verification Challenge (KVC): Biometric and Fairness Benchmark Evaluation https://doi.org/10.1109/ACCESS.2023.3345452
30. Stylios, I., Chatzis, S., Thanou, O., & Kokolakis, S. (2023). Continuous authentication with feature-level fusion of touch gestures and keystroke dynamics to solve security and usability issues. Computers & Security, 132, Article 103363. https://doi.org/10.1016/j.cose.2023.103363
31. Teh, P. S., Teoh, A. B. J., & Yue, S. (2013). A survey of keystroke dynamics biometrics. The Scientific World Journal, 2013, Article 408280. https://doi.org/10.1155/2013/408280
32. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., & Polosukhin, I. (2017). Attention is all you need. In Advances in neural information processing systems (pp. 5998–6008). https://doi.org/10.48550/arXiv.1706.03762
33. Wahab, A. A., & Hou, D. (2023). When simple statistical algorithms outperform deep learning: A case of keystroke dynamics. In Proceedings of the International Conference. https://doi.org/10.5220/0011684100003411
34. Wang, Y., Wu, C., Zheng, K., & Wang, X. (2019). Improving reliability: User authentication on smartphones using keystroke biometrics. IEEE Access, 7, 26218–26232. https://doi.org/10.1109/ACCESS.2019.2891603
35. Yılmaz, E., & Can, Ö. (2023). Keystroke biometric data for identity verification: Performance analysis of machine learning algorithms. Journal of Computer Science, IDAP-2023, 143–150. https://doi.org/10.53070/bbd.1345519
36. Zhou, L., Wang, K., Lai, J., & Zhang, D. (2023). A comparison of a touch-gesture- and a keystroke-based password method: Toward shoulder-surfing resistant mobile user authentication. IEEE Transactions on Human-Machine Systems, 53(2), 303–315. https://doi.org/10.1109/thms.2023.3236328