Behavioral Biometrics Research Articles

Understanding user perceptions of transparent authentication on a mobile device

Due to the frequency with which smartphone owners use their devices, effortful authentication methods such as passwords and PINs are not an effective choice for smartphone authentication. Past research has offered solutions such as graphical passwords, biometrics and password hardening techniques. However, these solutions still require the user to authenticate frequently, which may become increasingly frustrating over time. Transparent authentication has been suggested as an alternative to such effortful solutions. It utilizes readily available behavioral biometrics to provide a method that runs in the background without requiring explicit user interaction. In this manner, transparent authentication delivers a less effortful solution with which the owner does not need to engage as frequently. We expand the current research into transparent authentication by surveying the user, an important stakeholder, regarding their opinions towards transparent authentication on a smartphone. We asked 30 participants to complete a series of tasks on a smartphone that was ostensibly protected with varying degrees of transparent authentication. We then surveyed participants regarding their opinions of transparent authentication, their opinions of the sensitivity of tasks and data on smartphones, and their perception of the level of protection provided to the data and apps on the device. We found that 90% of those surveyed would consider using transparent authentication on their mobile device should it become available. Furthermore, participants had widely varying opinions of the sensitivity of the experiment’s tasks, showing that a more granular method of smartphone security is justified. Interestingly, we found that the complete removal of security barriers, which is commonly cited as a goal in authentication research, does not align with the opinions of our participants. Instead, we found that having a few barriers to device and data access aided the user in building a mental model of the on-device security provided by transparent authentication. These results provide a valuable understanding to inform development of transparent authentication on smartphones since they provide a glimpse into the needs and wants of the end user.

Proposing a Biometric Verification Method for Students Attendance using Mouse Movements

DOI: 10.6007/IJARBSS/v3-i11/368 URL: http://dx.doi.org/10.6007/IJARBSS/v3-i11/368 Abstract - The biometric authentication checks a user based on its unique characteristics - who you are. Behavioral biometrics has proven very useful in authentication a user. The mouse dynamics has a unique pattern for movements. The paper present the benefits of the user verification system based on mouse dynamics, a method very accurate and efficient enough for future usage. The idea proposed in this article represents a method which has been developed for POSDRU 61434: Modern Education and Quality for Future, a project founded by European Union. Keyword: User Verification, Angle-Based Metrics, User Verification, Biometric.

Periocular Recognition Using Reduced Features

Biometrics is science of measuring and statistically analyzing biological data. Biometric system establishes identity of a person based on unique physical or behavioural characteristic possessed by an individual. Behavioural biometrics measures characteristics which are acquired naturally over time. Physical biometrics measures inherent physical characteristics on a n individual. Over the last few decades enormous attention is drawn towards ocular biometrics. Cues provided by ocular region have led to exploration of newer traits. Feasibility of periocular region as a useful biometric trait has been explored recently. With the promising results of preliminary examination, research towards periocular region is currently gaining lot of prominence. Researchers have analyzed various techniques of feature extraction and classification in the periocular region. The current paper investigates the effect of using Lower Central Periocular Region (LCPR) for identification. The results obtained are comparable with those acquired for the entire periocular region with an advantage of reduced periocular area.

Continuous Authentication Using Behavioral Biometrics

A continuous behaviometric authentication system is tested on 99 users over 10 weeks, focusing on keystroke dynamics, mouse movements, application usage, and the system footprint. In the process, a new trust model was created to enable continuous evaluation of the behaviometric data. Tests targeted keystroke dynamics, mouse movements, application usage, and the system footprint. Keystroke dynamics was found most appropriate for continuous behaviometric authentication, with no false rejects. This article is part of a special issue on security.

Scan-Based Evaluation of Continuous Keystroke Authentication Systems

For biometric modalities in which error rates are typically high--including behavioral biometrics, such as keystroke dynamics--temporal information associated with the occurrence of errors might help answer questions regarding performance evaluation.

Online risk-based authentication using behavioral biometrics

In digital home networks, it is expected that independent smart devices communicate and cooperate with each other, without the knowledge of the fundamental communication technology, on the basis of a distributed operating system paradigm. In such context, securing the access rights to some objects such as data, apparatus, and contents, is still a challenge. This paper introduces a risk-based authentication technique based on behavioral biometrics as solution approach to tackle this challenge. Risk-based authentication is an increasingly popular component in the security architecture deployed by many organizations to mitigate online identity fraud. Risk-based authentication uses contextual and historical information extracted from online communications to build a risk profile for the user that can be used accordingly to make authentication and authorization decisions. Existing risk-based authentication systems rely on basic web communication information such as the source IP address or the velocity of transactions performed by a specific account, or originating from a certain IP address. Such information can easily be spoofed, and as such, put in question the robustness and reliability of the proposed systems. In this paper, we propose a new online risk-based authentication system that provides more robust user identity information by combining mouse dynamics and keystroke dynamics biometrics in a multimodal framework. We propose a Bayesian network model for analyzing free keystrokes and free mouse movements involved in web sessions. Experimental evaluation of our proposed model with 24 participants yields an Equal Error Rate of 8.21 %. This is very encouraging considering that we are dealing with free text and free mouse movements, and the fact that many web sessions tend to be very short.

A framework for continuous, transparent mobile device authentication

We address two distinct problems with de facto mobile device authentication, as provided by a password or sketch. Firstly, device activity is permitted on an all-or-nothing basis, depending on whether the user successfully authenticates at the beginning of a session. This ignores the fact that tasks performed on a mobile device have a range of sensitivities, depending on the nature of the data and services accessed. Secondly, users are forced to re-authenticate frequently due to the bursty nature that characterizes mobile device use. Owners react to this by disabling the mechanism, or by choosing a weak “secret”. To address both issues, we propose an extensible Transparent Authentication Framework that integrates multiple behavioral biometrics with conventional authentication to implement an effortless and continuous authentication mechanism. Our security and usability evaluation of the proposed framework showed that a legitimate device owner can perform all device tasks, while being asked to authenticate explicitly 67% less often than without a transparent authentication method. Furthermore, our evaluation showed that attackers are soon denied access to on-device tasks as their behavioral biometrics are collected. Our results support the creation of a working prototype of our framework, and provide support for further research into transparent authentication on mobile devices.

A Preliminary Study on Non-Intrusive User Authentication Method Using Smartphone Sensors

This paper proposes a non-intrusive authentication method based on two sensitive apparatus of smartphones, namely, the orientation sensor and the touchscreen. We have found that these two sensors are capable of capturing behavioral biometrics of a user while the user is engaged in relatively stationary activities. The experimental results with respect to two types of flick operating have an equal error rate of about 3.5% and 5%, respectively. To the best of our knowledge, this work is the first publicly reported study that simultaneously adopts the orientation sensor and the touchscreen to build an authentication model for smartphone users. Finally, we show that the proposed approach can be used together with existing intrusive mechanisms, such as password and/or fingerprints, to build a more robust authentication framework for smartphone users.

Trajectory Mining for Keystroke Dynamics Authentication

This paper focuses on enhancing a username and password authentication scheme, which has some weaknesses because a username is publicly known and a password can be guessed. When an attacker knows or guesses a password correctly, the system is compromised. Therefore, this research focuses on this weakness and proposes an additional security token to this scheme by combining keystroke dynamics into the system. A username is typically not changed but a password is required to change frequently for a better security level. A username is typed frequently such that the familiar typing can be used as a behavioral biometrics of a user. Therefore, a keystroke dynamics profile is proposed using a trajectory dissimilarity technique to verify user's typing behavior on a username as an additional authentication token. Several features are mined for keystroke dynamics to create a trajectory profile, which gives the best results of 4% equal error rate (EER) or 96% authentication accuracy.

Blog or block: Detecting blog bots through behavioral biometrics

Blog bots are automated scripts or programs that post comments to blog sites, often including spam or other malicious links. An effective defense against the automatic form filling and posting from blog bots is to detect and validate the human presence. Conventional detection methods usually require direct participation of human users, such as recognizing a CAPTCHA image, which can be burdensome for users. In this paper, we present a new detection approach by using behavioral biometrics, primarily mouse and keystroke dynamics, to distinguish between human and bot. Based on passive monitoring, the proposed approach does not require any direct user participation. We collect real user input data from a very active online community and blog site, and use this data to characterize behavioral differences between human and bot. The most useful features for classification provide the basis for a detection system consisting of two main components: a webpage-embedded logger and a server-side classifier. The webpage-embedded logger records mouse movement and keystroke data while a user is filling out a form, and provides this data in batches to a server-side detector, which classifies the poster as human or bot. Our experimental results demonstrate an overall detection accuracy greater than 99%, with negligible overhead.

Touchalytics: On the Applicability of Touchscreen Input as a Behavioral Biometric for Continuous Authentication

We investigate whether a classifier can continuously authenticate users based on the way they interact with the touchscreen of a smart phone. We propose a set of 30 behavioral touch features that can be extracted from raw touchscreen logs and demonstrate that different users populate distinct subspaces of this feature space. In a systematic experiment designed to test how this behavioral pattern exhibits consistency over time, we collected touch data from users interacting with a smart phone using basic navigation maneuvers, i.e., up-down and left-right scrolling. We propose a classification framework that learns the touch behavior of a user during an enrollment phase and is able to accept or reject the current user by monitoring interaction with the touch screen. The classifier achieves a median equal error rate of 0% for intra-session authentication, 2%-3% for inter-session authentication and below 4% when the authentication test was carried out one week after the enrollment phase. While our experimental findings disqualify this method as a standalone authentication mechanism for long-term authentication, it could be implemented as a means to extend screen-lock time or as a part of a multi-modal biometric authentication system.

Behavioural Biometrics for Multi-Factor Authentication in Biomedicine

Objectives: The goal of this work is to suggest an improved authentication method for biomedicine based on analysis of currently used behavioural biometric methods. Methods: A brief definition of identification, authentication and biometric characteristics is provided. The main part of the work focuses on keystroke dynamics, its advantages, disadvantages and applications in biomedicine. Keystroke dynamics is then proposed as an interesting behavioural biometric characteristic for use in computer security not being widely used so far. Results: The result of the work will be a new set of methods, which allows optimal multi-factor authentication method regarding its comfort, cost and reliability. Conclusions: The purpose of this paper is to focus on the available information about keystroke dynamics.

Cognitive biometrics: a novel approach to person authentication

Biographical notes: Kenneth Revett is currently actively engaged in research focused in the development of the field of cognitive biometrics, which relies on the deployment of biosignals (EEG, ECG, EDR) for person authentication. He published the first textbook dedicated to Behavioral Biometrics (Wiley & Sons) and is currently finishing up texts in the areas of cognitive robotics, bioinformatics for computer scientists, and cognitive biometrics. He is the editor of two Inderscience journals: Int. J. of Cognitive Biometrics and the Int. J. of Cognitive Performance Support. He has authored over 130 papers (journal and conference), and served on 30+ international programme committees.

Correlation Keystroke Verification Scheme for User Access Control in Cloud Computing Environment

Cloud security is a major concern that may delay its widespread adoption. User access control (UAC) is the core component of security in cloud computing environment, aiming to ensure that stored data are allowed to be accessed only by authenticated/authorized users. As a typical behavioural biometrics, keystroke dynamics provides a promising UAC solution. The most challenging issue that hinders the wide deployment of keystroke is the high verification error rate. Gunetti et al. proposed a classical n-graph-based keystroke verification method (GP method), which can achieve a low False Acceptance Rate (FAR). However, the GP method suffers from a high False Rejection Rate (FRR) and a severe scalability issue. Thus, GP is not a feasible solution for computing cloud application where scalability is a big issue. In this paper, two keystroke verification approaches (nGdv-V and nGdv-C) are proposed to overcome GP's shortcomings. To reduce high FRR, we designed a new correlation measure using n-graph equivalent feature (nGdv) that enables more accurate recognition for genuine users. Moreover, correlation-based hierarchical clustering is proposed to address the scalability issue. The experimental results show that the nGdv-C can produce much lower FRR while achieving almost the same level of FAR as that of the GP method. Furthermore, 1250 times (when using nGdv-V) and three times (when using nGdv-C(17,4)) authentication speed gains have been achieved.

Typing Biometrics

The use of stolen personal-identifying information, like Social Security numbers, to commit identity fraud continues to be a major problem. The fact that an impostor can pass as the genuine user by possession of stolen identification information is a weakness in current authentication systems. Adding a biometric layer to the traditional knowledge and token-based authentication systems is one way to counter this problem. Physical biometrics, such as fingerprint systems, are highly accurate; hence, they would be the first choice for such applications but are often inappropriate. Behavioral biometrics, like biometric typing patterns, have the potential to fill this gap as another level of security but this research identified some deficiencies in performance quality. Two research streams for improvements have emerged. The first approach attempts to improve performance by building better classifiers, while the second attempts to attain the same goal by using richer identifying inputs. Both streams assume that the typing biometric patterns are stable over time. This study investigates the validity of this assumption by analyzing how students’ typing patterns behave over time. The results demonstrate that typing patterns change over time due to learning resulting in several performance quality challenges. First, the changing patterns lead to deteriorating authentication accuracy. Second, the relevancy of the reference biometric template created during training becomes questionable. Third, the deterioration in accuracy compromises the security of the whole system and fourth, the net effect brings to question whether the biometric keypad is no longer “fit for use” as an authentication system. These are critical data quality issues that need to be addressed if behavioral biometrics are to play a significant role in minimizing authentication fraud. Possible solutions to the problem, including biometric template updating and choice of uncorrelated PIN combinations, are suggested as potential topics for future research.

Unobtrusive Behavioral and Activity-Related Multimodal Biometrics: The ACTIBIO Authentication Concept

Unobtrusive Authentication Using ACTIvity-Related and Soft BIOmetrics (ACTIBIO) is an EU Specific Targeted Research Project (STREP) where new types of biometrics are combined with state-of-the-art unobtrusive technologies in order to enhance security in a wide spectrum of applications. The project aims to develop a modular, robust, multimodal biometrics security authentication and monitoring system, which uses a biodynamic physiological profile, unique for each individual, and advancements of the state of the art in unobtrusive behavioral and other biometrics, such as face, gait recognition, and seat-based anthropometrics. Several shortcomings of existing biometric recognition systems are addressed within this project, which have helped in improving existing sensors, in developing new algorithms, and in designing applications, towards creating new, unobtrusive, biometric authentication procedures in security-sensitive, Ambient Intelligence environments. This paper presents the concept of the ACTIBIO project and describes its unobtrusive authentication demonstrator in a real scenario by focusing on the vision-based biometric recognition modalities.

Human Identity Verification by Using Physiological and Behavioural Biometric Traits

Human Identity Verification by Using Physiological and Behavioural Biometric Traits

Case-based approach using behavioural biometrics aimed at Assisted Living

Behavioural biometrics aims at providing means of automating the recognition of a person’s behavioral traits in every-day life, derived from specific actions, attitude, expressions and general conduct. Behavioural biometrics recognition and profiling systems should incorporate reliable schemes to determine and ascertain the psychological and physical status of a person. Behavioural biometrics find a special field of application in the case of Assisted Living, in which individuals suffering from various diseases in different stages need supervision in their daily activities as they cannot function on their own or are in need of help—minor or not. By using biometrics, unobtrusive support for daily life activities can be provided to elderly people through smart interfaces incorporating emotion classification, movement detection, person identification, pattern and activity recognition techniques integrated in their personal environment. Thus, an elderly individual’s mood and activities could be determined and appropriate solutions suggested by the system, such as calls for help in case of a fall and alarms to relatives or doctors, and all this inside the framework of “what are the patient’s actions and status”.

Biometric keypads: Improving accuracy through optimal PIN selection

While online applications can provide convenience to individuals and organizations, they can pose significant remote user authentication challenges. One possible solution to these challenges is to utilize behavioral typing patterns to provide an additional layer of authentication. Such behavioral biometrics have the advantage of being revocable if compromised, unlike physical biometrics such as fingerprints. This study investigates the viability of biometric keypads. Results indicate that biometric keypads can differentiate authentic users from impostors even when a secure PIN has been compromised. Furthermore, it is shown that authentication accuracy can be improved through optimal PIN selection by avoiding correlated key combinations.

DTW Based Classification of Diverse Pre-Processed Time Series Obtained from Handwritten PIN Words and Signatures

Personal identity verification by means of signature handwriting dynamics is a widely researched aspect of behavioral biometrics. The Dynamic Time Warping (DTW) technique has been successfully used for accessing the similarity of time series of handwritten objects by minimizing non-linear time distortions. Generally, in DTW based classifiers, the sequences are normalized in time and amplitude domains. In the paper, different length and amplitude normalization techniques are applied on signatures and handwritten PIN word sequences and their influence on accuracy of recognition are examined. A special approach to amplitude normalization based on reference level assigned Dynamic Time Warping (DTW) technique is presented. The standard deviation values calculated from the time series are used as so called bio-reference levels to improve the performance of classification. For this, they are added to the time series of query and sample datasets prior to DTW matching. The acquisition of online data is carried out by a digital pen equipped with pressure and inclination sensors. The time series obtained from the pen during handwriting provide valuable insight into the unique characteristics of the writers. Experimental results show that with the help of proposed length and amplitude normalizations of sequences including the bio-reference levels, the computational time is reduced and false acceptance rates are decreased.