feature_set.md

KeyWraith — Behavioral Feature Set

These are the timing/cadence signals the detector computes over a keystroke session — the signal an EDR agent could derive from a live keystroke stream. The feature set is a deliberate contribution: each feature is included because human and injected typing separate along it. All features are derived from timing and a coarse keycode class only; no raw text is used, so a feature row is safe to publish.

Notation: IKI = inter-key interval (key-down to key-down). dwell = key-down to key-up (hold time). flight = previous key-up to next key-down.

Feature	Definition	Why it discriminates
iki_mean_ms	Mean IKI	Injection is far faster; but a slowed attacker erases this alone.
iki_std_ms	Std. dev. of IKI	Machines are near-constant; humans are highly variable.
iki_cv	Coefficient of variation (std/mean)	Headline discriminator — scale-free regularity; stays low for machines even when they slow down.
iki_median_ms	Median IKI	Robust central tendency, resists pause outliers.
iki_min_ms	Minimum IKI	Machines routinely hit sub-millisecond gaps humans can't.
iki_iqr_ms	Interquartile range of IKI	Spread of the bulk distribution.
iki_entropy	Shannon entropy of the binned IKI histogram	Human timing is high-entropy; burst injection is a spike.
frac_iki_sub20ms	Fraction of IKIs under 20 ms	"Superhuman" keystrokes — near-zero for humans.
iki_autocorr_lag1	Lag-1 autocorrelation of the IKI series	Scripted cadence is periodic/regular; human cadence is not.
dwell_mean_ms	Mean hold time	Injection dwell is tiny and constant (~ms); humans ~90 ms.
dwell_std_ms	Std. dev. of dwell	Humans vary their hold time; machines barely do.
dwell_cv	Dwell coefficient of variation	Scale-free dwell regularity.
flight_mean_ms	Mean flight time	Key overlap / rollover structure differs.
flight_std_ms	Std. dev. of flight	Variability of release-to-press timing.
typing_speed_cps	Characters per second	The naive baseline's only signal; easily defeated.
correction_rate	Backspaces per key	Humans correct mistakes; scripted injection almost never does.
pause_count	# of IKIs above 500 ms	Human "thinking" pauses; absent in burst injection.
longest_pause_ms	Max IKI	Presence of any long deliberation gap.
digraph_var_ratio	Local (consecutive-triple) IKI variance ÷ global IKI variance	Humans have key-pair-dependent latencies; machines are uniform.

Design notes

• Why coefficient-of-variation features matter most. A speed threshold keys on iki_mean_ms alone, so an attacker beats it by slowing down. But slowing a constant-delay injector down keeps iki_cv, iki_autocorr_lag1, dwell_cv and digraph_var_ratio machine-like. These scale-free regularity features are what keep the behavioral detector alive across the arms-race sweep.
• Corrections and pauses are cheap human tells. Stock BadUSB never backspaces and never pauses to think; reproducing these costs the attacker keystrokes and exposure time (quantified in the evasion-cost curve).
• Extensibility. A sequence model over the raw keystroke stream (e.g. an LSTM/Transformer on the IKI series) is a natural Tier-3 add-on; the engineered features here are the strong, explainable baseline and the source of the operator-readable alert.