KEYLOGGING VISUALIZATION

Overview

Visualization of a user's typing on a computer keyboard, comparing sequential key information with frequency data.

Keylogger: a C# application that runs on the background of the typist's machine. It collects key data in ASCII format into buffers of a given size (power of 2, default = 64). Each time the buffer becomes filled, it flushes the data to a port on the visualization machine, and then begins repopulating the buffer.
Visualizer: stores incoming key data in a long "x" array (size = number of pixels along the x-axis of the display window); performs a FFT operation on each incoming key data buffer, and stores resultant frequency data in "y" buffer (size = number of frequency bins in the FFT = (number of pixels in the input buffer)/2); scales "y" buffer size to size of y-axis of display window; performs vector multiplication of x and y data to produce visualization. The visualizer also shows all possible keys along the bottom of the window, changing their relative size based on aggregate keystroke count.

The FFT of input data produces a large DC value in the first bin, which must be scaled to the range of the other values to keep the visualization interesting. The other frequency bins show the amount of variation in the user's typing patterns. For example, artificial, repeated input patterns will produce harmonic frequency data, whereas normal typing produces more random-looking data.
The FFT is recomputed for each input buffer, and the entire screen redrawn according to the new data; the long buffer, however, retains constant information, as incoming data is added to data from previous buffers. Thus, over time, the vertical bands in the visualization display remain relatively fixed, and can be viewed as a linear keystroke history. The horizontal bands, on the other hand, change color and relative intensity depending only on recent frequency data (from the last buffer).