Abstract

Keylogging malware poses a significant threat by covertly recording user keystrokes to steal sensitive information, often evading traditional signature-based detection methods through polymorphic techniques. This study explores a behavioral approach using keystroke dynamics, analyzing typing speed, keypress durations, and intervals to detect anomalies indicative of keylogger activity. Behavioral biometrics, grounded in the uniqueness of human-computer interaction, form the basis of this detection strategy. The proposed system uses machine learning models, including XGBoost, Random Forest, and LSTM, to differentiate normal and malicious typing patterns. The experimental results show that XGBoost achieved the highest accuracy (94.14%) and exhibited strong generalization, while Random Forest and LSTM delivered balanced performance in precision and recall. Despite challenges such as user variability and mimicry by advanced malware, keystroke dynamics presents a promising adaptive layer for proactive keylogger detection within modern cybersecurity frameworks.