  This paper investigates how to effectively stop an attacker from using
compromised user credentials to gain authorized entry to systems that they are
otherwise not authorised to access. The proposed solution extends previous work
to move beyond a risk-based multi-factor authentication system. It adds a
behavioural analytics component that uses keystroke dynamics to grant or deny
users access. Given the increasing number of compromised user credential
stores, we make the assumption that criminals already know the user
credentials. Hence, to test our solution, users were given authentic user
credentials and asked to login to our proof-of-concept. Despite the fact that
all illegitimate users in our test cases were given the correct user
credentials for legitimate users, none of these were granted access by the
system. This demonstrates zero- tolerance to false positives. The results
demonstrate the uniqueness of keystroke dynamics and its use to prevent users
with stolen credentials from accessing systems they are not authorized to
access.
