On user interaction behavior as evidence for computer forensic analysis

Demographic information has a rich context from which to make decisions about how to filter or individualize computer users in forensic analysis. Although current explorations into technologies such as face and fingerprint analysis have seen varying rates of success, two main problems limit their applicability in the context of computer crimes: they can be intrusive, and they can require costly equipment. Our solution is to determine users' demographic traits by analyzing the interactions between users and computers. We conducted a field study that gathered users' keystroke and mouse data during interaction with a computer. From user interaction data, we extracted keystroke timing and mouse movement features, and developed weighted random forest classifiers for five demographic traits: gender, age, ethnicity, handedness, and language. Experiments showed that these demographics can be accurately inferred from user interaction behavior, with recognition rates expressed by the area under the ROC curve (AUC) ranging from 82.11 % to 87.32 %.