{"id":"https://openalex.org/W1508843061","doi":"https://doi.org/10.1109/iwbf.2015.7110238","title":"Data forensic techniques using Benford's law and Zipf's law for keystroke dynamics","display_name":"Data forensic techniques using Benford's law and Zipf's law for keystroke dynamics","publication_year":2015,"publication_date":"2015-03-01","ids":{"openalex":"https://openalex.org/W1508843061","doi":"https://doi.org/10.1109/iwbf.2015.7110238","mag":"1508843061"},"language":"en","primary_location":{"id":"doi:10.1109/iwbf.2015.7110238","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iwbf.2015.7110238","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"3rd International Workshop on Biometrics and Forensics (IWBF 2015)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5004603491","display_name":"Aamo Iorliam","orcid":"https://orcid.org/0000-0001-8238-9686"},"institutions":[{"id":"https://openalex.org/I28290843","display_name":"University of Surrey","ror":"https://ror.org/00ks66431","country_code":"GB","type":"education","lineage":["https://openalex.org/I28290843"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Aamo Iorliam","raw_affiliation_strings":["Department of Computing, University of Surrey, UK","[Department of Computing, University of Surrey, UK]"],"affiliations":[{"raw_affiliation_string":"Department of Computing, University of Surrey, UK","institution_ids":["https://openalex.org/I28290843"]},{"raw_affiliation_string":"[Department of Computing, University of Surrey, UK]","institution_ids":["https://openalex.org/I28290843"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053949309","display_name":"Anthony T. S. Ho","orcid":"https://orcid.org/0000-0001-9208-1255"},"institutions":[{"id":"https://openalex.org/I28290843","display_name":"University of Surrey","ror":"https://ror.org/00ks66431","country_code":"GB","type":"education","lineage":["https://openalex.org/I28290843"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Anthony T.S. Ho","raw_affiliation_strings":["Department of Computing, University of Surrey, UK","[Department of Computing, University of Surrey, UK]"],"affiliations":[{"raw_affiliation_string":"Department of Computing, University of Surrey, UK","institution_ids":["https://openalex.org/I28290843"]},{"raw_affiliation_string":"[Department of Computing, University of Surrey, UK]","institution_ids":["https://openalex.org/I28290843"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029657515","display_name":"Norman Poh","orcid":"https://orcid.org/0000-0001-6076-0309"},"institutions":[{"id":"https://openalex.org/I28290843","display_name":"University of Surrey","ror":"https://ror.org/00ks66431","country_code":"GB","type":"education","lineage":["https://openalex.org/I28290843"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Norman Poh","raw_affiliation_strings":["Department of Computing, University of Surrey, UK","[Department of Computing, University of Surrey, UK]"],"affiliations":[{"raw_affiliation_string":"Department of Computing, University of Surrey, UK","institution_ids":["https://openalex.org/I28290843"]},{"raw_affiliation_string":"[Department of Computing, University of Surrey, UK]","institution_ids":["https://openalex.org/I28290843"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013246415","display_name":"Santosh Tirunagari","orcid":"https://orcid.org/0000-0002-9064-1965"},"institutions":[{"id":"https://openalex.org/I28290843","display_name":"University of Surrey","ror":"https://ror.org/00ks66431","country_code":"GB","type":"education","lineage":["https://openalex.org/I28290843"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Santosh Tirunagari","raw_affiliation_strings":["Department of Computing, University of Surrey, UK","[Department of Computing, University of Surrey, UK]"],"affiliations":[{"raw_affiliation_string":"Department of Computing, University of Surrey, UK","institution_ids":["https://openalex.org/I28290843"]},{"raw_affiliation_string":"[Department of Computing, University of Surrey, UK]","institution_ids":["https://openalex.org/I28290843"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5080080797","display_name":"Patrick Bours","orcid":"https://orcid.org/0000-0001-5562-6957"},"institutions":[{"id":"https://openalex.org/I4210127026","display_name":"Ko-Aks (Norway)","ror":"https://ror.org/036jhyh48","country_code":"NO","type":"company","lineage":["https://openalex.org/I4210127026"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Patrick Bours","raw_affiliation_strings":["Norwegian Information Security Laboratory (NISlab), Gj\u00f8vik University College, Gj\u00f8vik, Norway"],"affiliations":[{"raw_affiliation_string":"Norwegian Information Security Laboratory (NISlab), Gj\u00f8vik University College, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I4210127026"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5004603491"],"corresponding_institution_ids":["https://openalex.org/I28290843"],"apc_list":null,"apc_paid":null,"fwci":4.1101,"has_fulltext":false,"cited_by_count":14,"citation_normalized_percentile":{"value":0.93911049,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/benfords-law","display_name":"Benford's law","score":0.9071739912033081},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6910874843597412},{"id":"https://openalex.org/keywords/zipfs-law","display_name":"Zipf's law","score":0.6760127544403076},{"id":"https://openalex.org/keywords/biometrics","display_name":"Biometrics","score":0.6496708393096924},{"id":"https://openalex.org/keywords/keystroke-dynamics","display_name":"Keystroke dynamics","score":0.6428844928741455},{"id":"https://openalex.org/keywords/keystroke-logging","display_name":"Keystroke logging","score":0.5697196125984192},{"id":"https://openalex.org/keywords/law","display_name":"Law","score":0.38554567098617554},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.33651840686798096},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.23823437094688416},{"id":"https://openalex.org/keywords/statistics","display_name":"Statistics","score":0.18959596753120422},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.13520914316177368},{"id":"https://openalex.org/keywords/password","display_name":"Password","score":0.11201593279838562}],"concepts":[{"id":"https://openalex.org/C152636012","wikidata":"https://www.wikidata.org/wiki/Q817168","display_name":"Benford's law","level":2,"score":0.9071739912033081},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6910874843597412},{"id":"https://openalex.org/C125932096","wikidata":"https://www.wikidata.org/wiki/Q205472","display_name":"Zipf's law","level":2,"score":0.6760127544403076},{"id":"https://openalex.org/C184297639","wikidata":"https://www.wikidata.org/wiki/Q177765","display_name":"Biometrics","level":2,"score":0.6496708393096924},{"id":"https://openalex.org/C79540074","wikidata":"https://www.wikidata.org/wiki/Q3269465","display_name":"Keystroke dynamics","level":4,"score":0.6428844928741455},{"id":"https://openalex.org/C161615301","wikidata":"https://www.wikidata.org/wiki/Q309396","display_name":"Keystroke logging","level":2,"score":0.5697196125984192},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.38554567098617554},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33651840686798096},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.23823437094688416},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.18959596753120422},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.13520914316177368},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.11201593279838562},{"id":"https://openalex.org/C4957475","wikidata":"https://www.wikidata.org/wiki/Q242186","display_name":"S/KEY","level":3,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/iwbf.2015.7110238","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iwbf.2015.7110238","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"3rd International Workshop on Biometrics and Forensics (IWBF 2015)","raw_type":"proceedings-article"},{"id":"pmh:oai:alma.44SUR_INST:11139251530002346","is_oa":false,"landing_page_url":"http://gateway.webofknowledge.com/gateway/Gateway.cgi?GWVersion=2&SrcApp=PARTNER_APP&SrcAuth=LinksAMR&KeyUT=WOS:000380429100019&DestLinkType=FullRecord&DestApp=ALL_WOS&UsrCustomerID=11d2a86992e85fb529977dad66a846d5","pdf_url":null,"source":{"id":"https://openalex.org/S4210197018","display_name":"View","issn_l":"2688-268X","issn":["2688-268X","2688-3988"],"is_oa":false,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"event"},{"id":"pmh:oai:epubs.surrey.ac.uk:840040","is_oa":false,"landing_page_url":"http://epubs.surrey.ac.uk/840040/","pdf_url":null,"source":{"id":"https://openalex.org/S4306400680","display_name":"Surrey Research Insight Open Access (The University of Surrey)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I28290843","host_organization_name":"University of Surrey","host_organization_lineage":["https://openalex.org/I28290843"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference or Workshop Item"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.550000011920929},{"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities","score":0.4000000059604645}],"awards":[{"id":"https://openalex.org/G6953541449","display_name":null,"funder_award_id":"EP/N002717/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":26,"referenced_works":["https://openalex.org/W1481984145","https://openalex.org/W1564328648","https://openalex.org/W1574901103","https://openalex.org/W1585383348","https://openalex.org/W1964521519","https://openalex.org/W1966864883","https://openalex.org/W2000042664","https://openalex.org/W2004446368","https://openalex.org/W2004691586","https://openalex.org/W2070040249","https://openalex.org/W2107589078","https://openalex.org/W2136928336","https://openalex.org/W2144853134","https://openalex.org/W2157245832","https://openalex.org/W2158877422","https://openalex.org/W2168536291","https://openalex.org/W2432517183","https://openalex.org/W2511438658","https://openalex.org/W2626788661","https://openalex.org/W2937824701","https://openalex.org/W2950627632","https://openalex.org/W2981264952","https://openalex.org/W3103362336","https://openalex.org/W4205472781","https://openalex.org/W6634847347","https://openalex.org/W6668164699"],"related_works":["https://openalex.org/W2791618341","https://openalex.org/W4297807166","https://openalex.org/W3185561589","https://openalex.org/W1917645424","https://openalex.org/W2155670618","https://openalex.org/W2052279280","https://openalex.org/W4211208539","https://openalex.org/W3106877556","https://openalex.org/W1966864883","https://openalex.org/W1563893514"],"abstract_inverted_index":{"The":[0],"selection":[1],"and":[2,9,38,46,64,69,82,88,96,126,158,200,204,210,217,229,238,261],"application":[3],"of":[4,17,27,115,207,219,226,240,257,264,270],"biometrics":[5],"traits":[6],"for":[7,40,185,212,233,278],"authentication":[8],"identification":[10],"have":[11,57],"recently":[12],"attracted":[13],"a":[14,176],"significant":[15],"amount":[16],"research":[18],"interest.":[19],"In":[20],"this":[21],"paper":[22],"we":[23,109,179],"investigate":[24],"the":[25,79,107,112,116,123,131,143,147,155,163,170,186,193,213,220,234,241,248,252,258,265,271],"use":[26],"keystroke":[28,35,86,101,117,221,242],"data":[29,68,87,118,195],"to":[30,61,77,89,281],"distinguish":[31],"between":[32,66,98,255],"humans":[33,99,120,140,167],"using":[34,100,192],"biometric":[36,102],"systems":[37,103],"non-humans":[39,151],"auditing":[41,279],"application.":[42],"Recently,":[43],"Benford's":[44,80,124,156,171],"Law":[45,81,84],"Zipf's":[47,83,127,159],"Law,":[48],"which":[49],"are":[50,231],"both":[51],"discrete":[52],"Power":[53],"law":[54,125,157],"probability":[55],"distributions,":[56],"been":[58],"effectively":[59],"used":[60,275],"detect":[62,282],"fraud":[63],"discriminate":[65,97],"genuine":[67],"fake/tampered":[70],"data.":[71],"As":[72],"such,":[73],"our":[74],"motivation":[75],"is":[76,251,268],"apply":[78],"on":[85],"determine":[90],"whether":[91],"they":[92,173],"follow":[93,122,142,175],"these":[94],"laws":[95],"from":[104,119,139,150,154,166,169],"non-humans.":[105],"From":[106],"results,":[108],"observe":[110,246],"that,":[111,136],"latency":[113,137,148,249],"values":[114,138,149,165],"actually":[121],"law,":[128,172],"but":[129],"not":[130],"duration":[132,164,187,218,239],"values.":[133,188],"This":[134],"implies":[135],"would":[141,152],"two":[144],"laws,":[145],"whereas":[146],"deviate":[153],"law.":[160],"Even":[161],"though,":[162],"deviates":[168],"do":[174],"pattern":[177],"that":[178,247],"can":[180],"develop":[181],"an":[182],"accurate":[183],"model":[184],"We":[189,245],"perform":[190],"experiments":[191],"benchmark":[194],"set":[196],"developed":[197],"by":[198,276],"Killourhy":[199],"Maxion,":[201],"CMU":[202],"[1]":[203],"obtain":[205],"divergences":[206],"0.0008,":[208],"0.029":[209],"0.05":[211],"keyup-keydown":[214,235],"(latency),":[215,236],"keydown-keydown,":[216,237],"data,":[222,243],"respectively.":[223,244],"Moreover,":[224],"P-value's":[225],"0.7770,":[227],"0.6230":[228],"0.0160":[230],"obtained":[232],"(which":[250],"time":[253],"elapsed":[254],"release":[256],"first":[259],"key":[260],"pressing":[262],"down":[263],"next":[266],"key)":[267],"one":[269],"most":[272],"important":[273],"features":[274],"administrators":[277],"purposes":[280],"anomalies":[283],"during":[284],"their":[285,289],"employees":[286],"logging":[287],"into":[288],"company":[290],"system.":[291]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":2},{"year":2015,"cited_by_count":1}],"updated_date":"2026-04-04T16:13:02.066488","created_date":"2025-10-10T00:00:00"}