Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines
Abstract A feature of search engines is prediction and suggestion to complete or extend input query phrases, i.e. search suggestion functions (SSF). Given the immediate temporal nature of this functionality, alongside the character submitted to trigger each suggestion, adequate data is provided to d...
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
SpringerOpen
2020-02-01
|
| Series: | EURASIP Journal on Information Security |
| Subjects: | |
| Online Access: | http://link.springer.com/article/10.1186/s13635-020-0100-8 |
| _version_ | 1819173228330876928 |
|---|---|
| author | Nicholas Whiskerd Nicklas Körtge Kris Jürgens Kevin Lamshöft Salatiel Ezennaya-Gomez Claus Vielhauer Jana Dittmann Mario Hildebrandt |
| author_facet | Nicholas Whiskerd Nicklas Körtge Kris Jürgens Kevin Lamshöft Salatiel Ezennaya-Gomez Claus Vielhauer Jana Dittmann Mario Hildebrandt |
| author_sort | Nicholas Whiskerd |
| collection | DOAJ |
| description | Abstract A feature of search engines is prediction and suggestion to complete or extend input query phrases, i.e. search suggestion functions (SSF). Given the immediate temporal nature of this functionality, alongside the character submitted to trigger each suggestion, adequate data is provided to derive keystroke features. The potential of such biometric features to be used in identification and tracking poses risks to user privacy.For our initial experiment, we evaluate SSF traffic with different browsers and search engines on a Linux PC and an Android mobile phone. The keystroke network traffic is captured and decrypted using mitmproxy to verify if expected keystroke information is contained, which we call quality assurance (QA). In our second experiment, we present first results for identification of five subjects searching for up to three different phrases on both PC and phone using naive Bayesian and nearest neighbour classifiers. The third experiment investigates potential for identification and verification by an external observer based purely on the encrypted traffic, thus without QA, using the Euclidean distance. Here, ten subjects search for two phrases across several sessions on a Linux virtual machine, and statistical features are derived for classification. All three test cases show positive tendencies towards the feasibility of distinguishing users within a small group. The results yield lowest equal error rates of 5.11% for the single PC and 11.37% for the mobile device with QA and 23.61% for various PCs without QA. These first tendencies motivate further research in feature analysis of encrypted network traffic and prevention approaches to ensure protection and privacy. |
| first_indexed | 2024-12-22T20:19:44Z |
| format | Article |
| id | doaj.art-b212673ce8d54fb9a6caf9ebbc152e37 |
| institution | Directory Open Access Journal |
| issn | 2510-523X |
| language | English |
| last_indexed | 2024-12-22T20:19:44Z |
| publishDate | 2020-02-01 |
| publisher | SpringerOpen |
| record_format | Article |
| series | EURASIP Journal on Information Security |
| spelling | doaj.art-b212673ce8d54fb9a6caf9ebbc152e372022-12-21T18:13:53ZengSpringerOpenEURASIP Journal on Information Security2510-523X2020-02-012020111610.1186/s13635-020-0100-8Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search enginesNicholas Whiskerd0Nicklas Körtge1Kris Jürgens2Kevin Lamshöft3Salatiel Ezennaya-Gomez4Claus Vielhauer5Jana Dittmann6Mario Hildebrandt7Multimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityMultimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityMultimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityMultimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityMultimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityMultimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityMultimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityMultimedia and Security Lab (AMSL), Otto-von-Guericke-UniversityAbstract A feature of search engines is prediction and suggestion to complete or extend input query phrases, i.e. search suggestion functions (SSF). Given the immediate temporal nature of this functionality, alongside the character submitted to trigger each suggestion, adequate data is provided to derive keystroke features. The potential of such biometric features to be used in identification and tracking poses risks to user privacy.For our initial experiment, we evaluate SSF traffic with different browsers and search engines on a Linux PC and an Android mobile phone. The keystroke network traffic is captured and decrypted using mitmproxy to verify if expected keystroke information is contained, which we call quality assurance (QA). In our second experiment, we present first results for identification of five subjects searching for up to three different phrases on both PC and phone using naive Bayesian and nearest neighbour classifiers. The third experiment investigates potential for identification and verification by an external observer based purely on the encrypted traffic, thus without QA, using the Euclidean distance. Here, ten subjects search for two phrases across several sessions on a Linux virtual machine, and statistical features are derived for classification. All three test cases show positive tendencies towards the feasibility of distinguishing users within a small group. The results yield lowest equal error rates of 5.11% for the single PC and 11.37% for the mobile device with QA and 23.61% for various PCs without QA. These first tendencies motivate further research in feature analysis of encrypted network traffic and prevention approaches to ensure protection and privacy.http://link.springer.com/article/10.1186/s13635-020-0100-8Keystroke dynamicsBiometricsSearch enginesEncrypted domain |
| spellingShingle | Nicholas Whiskerd Nicklas Körtge Kris Jürgens Kevin Lamshöft Salatiel Ezennaya-Gomez Claus Vielhauer Jana Dittmann Mario Hildebrandt Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines EURASIP Journal on Information Security Keystroke dynamics Biometrics Search engines Encrypted domain |
| title | Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines |
| title_full | Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines |
| title_fullStr | Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines |
| title_full_unstemmed | Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines |
| title_short | Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines |
| title_sort | keystroke biometrics in the encrypted domain a first study on search suggestion functions of web search engines |
| topic | Keystroke dynamics Biometrics Search engines Encrypted domain |
| url | http://link.springer.com/article/10.1186/s13635-020-0100-8 |
| work_keys_str_mv | AT nicholaswhiskerd keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines AT nicklaskortge keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines AT krisjurgens keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines AT kevinlamshoft keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines AT salatielezennayagomez keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines AT clausvielhauer keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines AT janadittmann keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines AT mariohildebrandt keystrokebiometricsintheencrypteddomainafirststudyonsearchsuggestionfunctionsofwebsearchengines |