A metric for the evaluation and comparison of keylogger performance
Tobias Fiebig, Janis Danisevskis, Marta Piekarska · 2014
In the field of IT security the development of Proof of Concept (PoC) implementations is a commonly accepted method to determine the exploitability of an identified weakness. Most security issues provide a rather straight-forwad method of asserting the PoCs efficiency. That is, either works or does not. Hence, data gathering and exfiltration techniques usually remain in a position where the viability has to be empirically verified. One of these cases are mobile device keyloggers, which only recently have been starting to exploit side-channels to infer heuristic information on a user's input. With this introduction of side channels exploiting heuristic information the performance of a keylogger may no longer be described with it works and gathered what was typed. Instead, the viability of the keylogger has to be assessed based on various typing speeds, user input styles and many metrics more as documented in this paper. The authors of this document provide a survey of the required metrics and features. Furthermore, they have developed a framework to assess the performance of a keylogger. This paper provides the documentation on how such a study can be conducted, while the required source code is shared online.