Louisiana Tech University

The Penn State Research Foundation

Louisiana State University and Agricultural & Mechanical College

Louisiana Tech Research Corporation

The Board of Supervisors of Lsu

The Penn State Foundation

Vir V Phoha

Kiran S Balagani

Asok Ray

Shrijit Sudhakar Joshi

Sitharama S Iyengar

Rajgopal Kannan

Sunil Babu

Shrijit S Joshi

Sampath Kumar Vuyyuru

Shashi P Phoba

Shashi Phoha

A method of identifying a user as an authorized user from free test text typed by that user into an input device. From the received test text, features associated with the typed text are extracted, such as timing data associated with alphanumeric letter pairs. These extracted features are compared to previously stored series of authorized user profiles, where the authorized user profiles were generated from a trial typing sample of alphanumeric data from each associated authorized user. The comparison identifies one of the authorized users with the user, and a score is derived to measure the strength of the comparison. If the score exceeds a threshold level, the user is identified as that authorized user.

Method and system of identifying users based upon free text keystroke patterns

At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is a bounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Method and apparatus to relate biometric samples to target FAR and FRR with predetermined confidence levels

At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is abounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Hidden Markov Models ('HMMs') are used to analyze keystroke dynamics measurements collected as a user types a predetermined string on a keyboard. A user enrolls by typing the predetermined string several times; the enrollment samples are used to train a HMM to identify the user. A candidate who claims to be the user provides a typing sample, and the HMM produces a probability to estimate the likelihood that the candidate is the user he claims to be. A computationally-efficient method for preparing HMMs to analyze certain types of processes is also described.

Hidden markov model ('HMM')-based user authentication using keystroke dynamics

A method of predicting a SYN flooding attack on a server. The method tracks the number of SYN signals received (or SYN+ACK signals sent) over the communications port of the server in a specified time interval, the arrival estimation window. The invention then predicts the number of anticipated ACK, RST or ACK+RST signals to be received over the communication port within a predetermined time length prediction window. The prediction may be made at multiple points within the prediction window. The prediction window is offset in time from the arrival estimation window. The prediction of ACK signals to be received is based upon the number of SYN signals received or SYN+ACK signals sent in the arrival estimation window. In one embodiment, a polynomial is fit to the data in the Arrival estimation window and extrapolated to the prediction window. The predicted number of ACK, or RST or ACK+RST signals is compared to the actual number received in the prediction window, and if the difference is in excess of a threshold value, and attack is indicated.

Method to detect SYN flood attack

The invention is a method of predicting a SYN flooding attack on a server. The method tracks the number of SYN signals received (or SYN+ACK signals sent) over the communications port of the server in a specified time interval, the arrival estimation window. The invention then predicts the number of anticipated ACK signals to be received over the communication port within a predetermined time length prediction window. The prediction may be made at multiple points within the prediction window. The prediction window is offset in time from the arrival estimation window. The prediction of ACK signals to be received is based upon the number of SYN signals received or SYN+ACK signals sent in the arrival estimation window. In one embodiment, a polynomial is fit to the data in the Arrival estimation window and extrapolated to the prediction window. The predicted number of ACK signals is compared to the actual number received in the prediction window, and if the difference is in excess of a threshold value, and attack is indicated.

Method and apparatus for choosing and evaluating sample size for biometric training process

The invention is a computer implemented technique for id entifying anomalous data in a data set. The method uses cascaded k-Means clustering and the ID3 decision tree learning methods to characterize a training data set having data points with known characterization. The k-Means clustering method first partitions the training instances into k clusters using Euclidean distance similarity. On each training cluster, representing a density region of normal or anomaly instances, the invention builds an ID3 decision tree. The decision tree on each cluster refines the decision boundaries by learning the sub-groups within the cluster. A test data point is then subjected to the clustering and decision trees constructed form the training instances. To obtain a final decision on classification, the decisions of the k-Means and ID3 methods are combined using rules: (1) the Nearest-neighbor rule, and (2) the Nearest-consensus rule.

Method to indentify anomalous data using cascaded K-Means clustering and an ID3 decision tree

A method of allocation a computer to service a request for a data set in a system having a plurality of computers. The method is implemented on a neural network having only an input layer having input nodes and an output layer having output nodes, where each output node is associated with a specific computer. Connecting the input nodes to the output nodes are weights w(j,k). The method includes the steps of receiving a request for data set 'I' and inputting to the input layer a vector R(I)

Data set request allocations to computers

We develop a system consisting of a neural architecture resulting in classifying regions corresponding to users' keystroke patterns. We extend the adaptation properties to classification phase resulting in learning of changes over time. Classification results on login attempts of 43 users (216 valid, 657 impersonation samples) show considerable improvements over existing methods.

System and method for classifying regions of keystroke density with a neural network

The invention is a method of allocating a computer to service a request for a data set in a system having a plurality of computers. The method is implemented on a neural having at an input layer having input nodes and an output layer having output nodes, where each output node is associated with a specific computer. Connecting the input nodes to the output nodes are weights w(j,k). Each output node is associated with a computer in the system, and the inputs to the input nodes are dependent upon the number of requests for specific pages.

Growing community of inventors

Ruston, LA, United States of America

Vir V Phoha