# Secure Learning Management System Based on User Behavior
## 2 Related Works  
There are two types of keystroke analysis, continuous (dynamic) keystroke and static keystroke [6; 7]. Static keystroke analysis involves extracting the characteristics of each user from the same predefined texts. Dynamic keystroke analysis means continuous monitoring of typing throughout the user's session, as soon as the authentication has been successfully completed. In this case, the system analyzes any type of text entered by the user. The two typing methods (static and dynamic) are detailed below, and the main research works in this area are presented [8; 9; 10]. Static authentication refers to login users using simple methods such as username and password. Static authentication behavior refers to how the user types the username and password. This method is used for further verification and to overcome some limitations of traditional methods of connection [11]. Keyboard dynamics and mouse dynamics are the main examples of static authentication based on user behavior [12; 13]. These methods measure two indicators: False Reject Rate (FRR), when the system incorrectly rejects an access attempt by an authorized user, and False Acceptance Rate (FAR), when the system incorrectly accepts an access attempt by an unauthorized user. Table 1 describes some techniques that have been developed over time for static keystroke dynamics [14]. In [15], keystroke dynamics were used for the first time as an authentication method. The authors did an experiment with six users, each user was asked to type two texts containing three paragraphs of varying length, and the time interval between collecting the two samples was four months. The five most common groups of letters were: in, io, no, on, and ul. They compared the time period between \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Research** & **Number of Users** & **FAR (\%)** & **FRR (\%)** & **Sample Content** & **Method** \\ \hline
[15] & 6 & 0.00 & 0.00 & 6000 characters & Manual \\ \hline
[16] & 17 & 12.00 & 6.00 & 1400 characters for training and 300 characters for testing & Statistical \\ \hline
[17] & 15 & 0.00 & 0.00 & Username 225 times & Neural network \\ \hline
[18] & 154 & 0.00 & 0.14 & 683 characters & Nearest neighbor \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Static methods for authentication. the two sessions to see if the average was the same. An impediment to this experiment was that the data collected were not sufficient to have reliable results. In [16], a sample of seventeen people was used to write two texts. The first text was approximately 1400 characters long and was used for preparation, and the second text was 300 characters long and was intended for testing. They calculated the time of the first digraphs for each word. The classifier was based on statistical methods by setting the condition that each digraph must fall within 0.5 standard deviations of its mean to be considered valid. In [17], the entire word typing duration and the duration between two consecutive characters were used to distinguish between a valid user and an unauthorized user. The experiment used fifteen users who had to type their username 225 times a day for eight weeks. Neural networks helped to classify user samples, and the results showed that both FRR and FAR were zero. In [18], a text of 683 characters was used for 154 participants, and it was considered that typing errors and the natural typing mode are a feature in which users can be differentiated. They used the degree of disturbance of the trigraph typing time as a measure for the dissimilarity matrix, and also used a statistical method to calculate the average differences between the units in the matrix. This method is suitable for authentication because it requires predefined data. All of the above techniques show that static authentication can be effectively used to distinguish users and to represent their typing behavior.