Behavioral Biometrics Research Articles

PURE: Passive Multi-Person Identification via Footstep for Mobile Service Networks

Recently, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">passive behavioral biometrics</i> (e.g., gesture or footstep) acquired from wireless networks or mobile services have become promising complements to conventional user identification methods (e.g., face or fingerprint) under special situations, yet existing sensing technologies require lengthy measurement traces and cannot identify multiple users at the same time. To this end, we propose PURE as a passive multi-person identification system leveraging deep learning enabled footstep separation and recognition. PURE passively identifies a user by identifying the unique “footprints” in its footstep. Different from existing gait-enabled recognition systems incurring a long sensing delay to acquire many footsteps, PURE can recognize a person by as few as only one step, substantially cutting the identification latency. To make PURE adaptive to walking pace variations, environmental dynamics, and even unseen targets, we apply an adversarial learning technique to improve its domain generalisability and identification accuracy. Finally, PURE is robust against replay attack, enabled by the richness of footstep and spatial awareness. We implement a PURE prototype using commodity hardware and evaluate it in typical indoor settings. Evaluation results demonstrate a cross-domain identification accuracy of over 90%.

Security Issues in Internet Architecture and Protocols Based on Behavioural Biometric Block Chain-Enhanced Authentication Layer

Internet security is of paramount importance due to the pervasive nature of the network in modern society. As the globe grows increasingly interconnected, issues like data breaches, unauthorized access, and service disruptions become more common. Safeguarding private data, ensuring uninterrupted communication, and protecting vital services are all essential to establishing confidence and stability in the online world. Internet security is a complex problem to solve due to the interconnected nature of the Internet's Architecture and Protocols (IAP). Due to the wide variety of devices and platforms that can access the Internet, cybercriminals can breach a complex ecosystem. Constant monitoring and flexibility are required due to the rapid development of new attack methods and vulnerabilities. The difficulty lies in balancing implementing new security measures and minimizing disruptions to the user experience, which calls for adaptive and novel approaches. In this paper, the Behavioural Biometric Block Chain-Enhanced Authentication layer (BBB-EAL) framework recommends a static authentication mechanism for end-users and edge servers. This authentication creates a secure and encrypted link between parties. Access tokens are produced via a smart contract, removing the requirement for a trusted third party. This work emphasizes the importance of architecture design and sequence diagrams in representing participant interactions and information sharing. Additionally, it examines the construction of the Machine Learning (ML) model used to recognize KMT dynamics. Simulations indicate that the recommended design improves user authentication in an IAP-enabled environment. The findings demonstrate the ability to evaluate confidence in real time, achieve minimal authentication time, and utilize resources efficiently.

Extraction of Hidden Authentication Factors from Possessive Information

Smartphones have emerged as a ubiquitous personal gadget that serve as a repository for individuals’ significant personal data. Consequently, both physiological and behavioral traits, which are classified as biometric technologies, are used in authentication systems in order to safeguard data saved on smartphones from unauthorized access. Numerous authentication techniques have been developed; however, several authentication variables exhibit instability in the face of external influences or physical impairments. The potential failure of the authentication system might be attributed to several unpredictable circumstances. This research suggests that the use of distinctive and consistent elements over an individual’s lifespan may be employed to develop an authentication classification model. This model would be based on prevalent personal behavioral biometrics and could be readily implemented in security authentication systems. The biological biometrics acquired from an individual’s typing abilities during data entry include their name, surname, email, and phone number. Therefore, it is possible to establish and use a biometrics-based security system that can be sustained and employed during an individual’s lifetime without the explicit dependance on the functionality of the smartphone devices. The experimental findings demonstrate that the use of a mobile touchscreen as the foundation for the proposed verification mechanism has promise as a high-precision authentication solution.

Siamese Neural Network for Keystroke Dynamics-Based Authentication on Partial Passwords.

The paper addresses issues concerning secure authentication in computer systems. We focus on multi-factor authentication methods using two or more independent mechanisms to identify a user. User-specific behavioral biometrics is widely used to increase login security. The usage of behavioral biometrics can support verification without bothering the user with a requirement of an additional interaction. Our research aimed to check whether using information about how partial passwords are typed is possible to strengthen user authentication security. The partial password is a query of a subset of characters from a full password. The use of partial passwords makes it difficult for attackers who can observe password entry to acquire sensitive information. In this paper, we use a Siamese neural network and n-shot classification using past recent logins to verify user identity based on keystroke dynamics obtained from the static text. The experimental results on real data demonstrate that keystroke dynamics authentication can be successfully used for partial password typing patterns. Our method can support the basic authentication process and increase users' confidence.

Privacy-preserving continuous authentication using behavioral biometrics

Continuous authentication modalities collect and utilize users’ sensitive data to authenticate them continuously. Such data contain information about user activities, behaviors, and other demographic information, which causes privacy concerns. In this paper, we propose two privacy-preserving protocols that enable continuous authentication while preventing the disclosure of user-sensitive information to an authentication server. We utilize homomorphic cryptographic primitives that protect the privacy of biometric features with an oblivious transfer protocol that enables privacy-preserving information retrieval. We performed the biometric evaluation of the proposed protocols on two datasets, a swipe gesture dataset and a keystroke dynamics dataset. The biometric evaluation shows that the protocols have very good performance. The execution time of the protocols is measured by considering continuous authentication using: only swipe gestures, keystroke dynamics, and hybrid modalities. The execution time proves the protocols are very efficient, even on high-security levels.

Exploring transformers for behavioural biometrics: A case study in gait recognition

Biometrics on mobile devices has attracted a lot of attention in recent years as it is considered a user-friendly authentication method. This interest has also been motivated by the success of Deep Learning (DL). Architectures based on Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) have established convenience for the task, improving the performance and robustness in comparison to traditional machine learning techniques. However, some aspects must still be revisited and improved. To the best of our knowledge, this is the first article that explores and proposes a novel gait biometric recognition systems based on Transformers, which currently obtain state-of-the-art performance in many applications. Several state-of-the-art architectures (Vanilla, Informer, Autoformer, Block-Recurrent Transformer, and THAT) are considered in the experimental framework. In addition, new Transformer configurations are proposed to further increase the performance. Experiments are carried out using the two popular public databases: whuGAIT and OU-ISIR. The results achieved prove the high ability of the proposed Transformer, outperforming state-of-the-art CNN and RNN architectures.

M-GaitFormer: Mobile biometric gait verification using Transformers

Mobile devices such as smartphones and smartwatches are part of our everyday life, acquiring large amount of personal information that needs to be properly secured. Among the different authentication techniques, behavioural biometrics has become a very popular method as it allows authentication in a non-intrusive and continuous way. This study proposes M-GaitFormer, a novel mobile biometric gait verification system based on Transformer architectures. This biometric system only considers the accelerometer and gyroscope data acquired by the mobile device. A complete analysis of the proposed M-GaitFormer is carried out using the popular available databases whuGAIT and OU-ISIR. M-GaitFormer achieves Equal Error Rate (EER) values of 3.42% and 2.90% on whuGAIT and OU-ISIR, respectively, outperforming other state-of-the-art approaches based on popular Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs).

Privacy-centered authentication: A new framework and analysis

The usage of authentication schemes is increasing in our daily life with the ubiquitous spreading Internet services. The verification of user's identity is still predominantly password-based, despite being susceptible to various attacks and openly disliked by users. Bonneau et al. presented a framework, based on Usability, Deployability, and Security criteria (UDS), to evaluate authentication schemes and find a replacement for passwords. Although the UDS framework is a mature and comprehensive evaluation framework and has been extended by other authors, it does not analyse privacy aspects in the usage of authentication schemes. In the present work, we extend the UDS framework with a privacy category to allow a more comprehensive evaluation, becoming the UDSP framework. We provide a thorough, rigorous assessment of sample authentication schemes, including the analysis of novel behavioural biometrics. Our work also discusses implementation aspects regarding the new privacy dimension and current gaps to be addressed in the future research.

Continuous authentication with feature-level fusion of touch gestures and keystroke dynamics to solve security and usability issues

Behavioral Biometrics (BB) Continuous Authentication (CA) systems monitor user behavior and continuously re-authenticate user identity alongside the initial login process. Most studies use single behavioral modality systems to authenticate users. However, the behaviors of genuine users may change, and systems fail when significant changes occur. This results in either usability or security issues. In the literature, the fusion of biometrics is used to solve this problem and achieves improved results. This paper presents our research on the design and evaluation of new approaches to CA using fusion of touch gestures and keystroke dynamics. To collect the biometric data from mobile device users we have developed the BioGames App which follows an innovative approach based on the gamification paradigm. We examine each modality separately and investigate if we can improve the performance results with a feature-level fusion. For this reason, a new appropriate feature set is developed that combines touch gestures and keystroke dynamics. We used the Multi-Layer Perceptron (MLP) and Long Short-Term Memory (LSTM) and compared their performance. We have shown that feature-level fusion of touch gestures and keystroke dynamics improves the performance of systems and solves security and usability issues. We found that the MLP is superior to LSTM in this context. The MLP achieved Accuracy 98.3% (increased 21.1%), EER 1% (error reduction by 23.7%), TAR 99.4% (increased 46%), TRR 97.4% (increased 10%), FAR 2.6% (reduced by 10.5%), and FRR 0.6% (reduced by 46%).

Continuous User Authentication on Multiple Smart Devices

Recent developments in the mobile and intelligence industry have led to an explosion in the use of multiple smart devices such as smartphones, tablets, smart bracelets, etc. To achieve lasting security after initial authentication, many studies have been conducted to apply user authentication through behavioral biometrics. However, few of them consider continuous user authentication on multiple smart devices. In this paper, we investigate user authentication from a new perspective—continuous authentication on multi-devices, that is, continuously authenticating users after both initial access to one device and transfer to other devices. In contrast to previous studies, we propose a continuous user authentication method that exploits behavioral biometric identification on multiple smart devices. In this study, we consider the sensor data captured by accelerometer and gyroscope sensors on both smartphones and tablets. Furthermore, multi-device behavioral biometric data are utilized as the input of our optimized neural network model, which combines a convolutional neural network (CNN) and a long short-term memory (LSTM) network. In particular, we construct two-dimensional domain images to characterize the underlying features of sensor signals between different devices and then input them into our network for classification. In order to strengthen the effectiveness and efficiency of authentication on multiple devices, we introduce an adaptive confidence-based strategy by taking historical user authentication results into account. This paper evaluates the performance of our multi-device continuous user authentication mechanism under different scenarios, and extensive empirical results demonstrate its feasibility and efficiency. Using the mechanism, we achieved mean accuracies of 99.8% and 99.2% for smartphones and tablets, respectively, in approximately 2.3 s, which shows that it authenticates users accurately and quickly.

RGB-D Video based Hand Authentication using Deep Neural Network

In recent years, behavioral biometrics authentication, which uses the habit of behavioral characteristics for personal authentication, has attracted attention as an authentication method with higher security since behavioral biometrics cannot mimic fingerprint and face authentications. In behavioral biometrics, extensive research has been done on voiceprints and gait. However, there are few authentication technologies that utilize the habits of hand and finger movements during hand gestures. Only color images or depth images are used for hand gesture authentication in conventional methods. In this research, therefore, we propose to find individual habits from RGB-D images of finger movements and create a personal authentication system. 3D CNN, which is deep learning-based network, is used to extract individual habits. F-measure of 0.97 is achieved when rock-paper-scissors are used as the authentication operation. F-measure of 0.97 is achieved when the disinfection operation is used. These results show the effectiveness of using RGB-D video for personal authentication.

Revisiting the Security of Biometric Authentication Systems Against Statistical Attacks

The uniqueness of behavioral biometrics (e.g., voice or keystroke patterns) has been challenged by recent works. Statistical attacks have been proposed that infer general population statistics and target behavioral biometrics against a particular victim. We show that despite their success, these approaches require several attempts for successful attacks against different biometrics due to the different nature of overlap in users’ behavior for these biometrics. Furthermore, no mechanism has been proposed to date that detects statistical attacks. In this work, we propose a new hypervolumes-based statistical attack and show that unlike existing methods, it (1) is successful against a variety of biometrics, (2) is successful against more users, and (3) requires fewest attempts for successful attacks. More specifically, across five diverse biometrics, for the first attempt, on average our attack is 18 percentage points more successful than the second best (37% vs. 19%). Similarly, for the fifth attack attempt, on average our attack is 18 percentage points more successful than the second best (67% vs. 49%). We propose and evaluate a mechanism that can detect the more devastating statistical attacks. False rejects in biometric systems are common, and by distinguishing statistical attacks from false rejects, our defense improves usability and security. The evaluation of the proposed detection mechanism shows its ability to detect on average 94% of the tested statistical attacks with an average probability of 3% to detect false rejects as a statistical attack. Given the serious threat posed by statistical attacks to biometrics that are used today (e.g., voice), our work highlights the need for defending against these attacks.

Recognizing shopper demographics from behavioral responses in a virtual reality store

The use of virtual reality (VR) technology in the context of retail is a significant trend in current consumer research, as it offers market researchers a unique opportunity to measure purchase behavior more realistically. Yet, effective methods for assessing the virtual shopping experience based on consumer’s demographic characteristics are still lacking. In this study, we examine the validity of behavioral biometrics for recognizing the gender and age of customers in an immersive VR environment. We used behavior measures collected from eye-tracking, body posture (head and hand), and spatial navigation sources. Participants (n = 57) performed three tasks involving two different purchase situations. Specifically, one task focused on free browsing through the virtual store, and two other tasks focused on product search. A set of behavioral features categorized as kinematic, temporal, and spatial domains was processed based on two strategies. First, the relevance of such features in recognizing age and gender with and without including the spatial segmentation of the virtual space was statistically analyzed. Second, a set of implicit behavioral features was processed and demographic characteristics were recognized using a statistical supervised machine learning classifier algorithm via a support vector machine. The results confirmed that both approaches were significantly insightful for determining the gender and age of buyers. Also, the accuracy achieved when applying the machine learning classifier (> 70%) indicated that the combination of all metrics and tasks was the best classification strategy. The contributions of this work include characterizing consumers in v-commerce spaces according to the shopper’s profile.

Stationary mobile behavioral biometrics: A survey

Current security mechanisms in mobile devices such as PINs, passwords, patterned passwords, and biometrics are one-time entry-point authentication and vulnerable to attacks. Furthermore, advanced mechanisms like Multi-Factor Authentication (MFA) introduce friction in the user experience. In contrast, behavioral biometrics rely on user interaction with computing devices to authenticate a user and thus, can be continuous, non-intrusive, and cost-effective, representing a promising direction that complements existing authentication techniques. This survey focuses on stationary/non-walking (sitting, standing) mobile behavioral biometrics through motion events like acceleration, gyroscope, magnetometer, and orientation (rotation) with the optional support of other non-motion, sporadic modalities such as swipes and keystrokes. The focus on stationary behaviors can be justified because such behaviors represent the major way a user interacts with mobile devices. To help readers understand the broad landscape of user activities/behaviors, we categorize the state of the art into natural and designed behaviors and describe the underpinning of behavioral biometrics in cognitive psychology. Furthermore, we categorize the surveyed studies into three groups based on the fusion of motion modalities and characterize each study along dimensions such as task, datasets, modality, algorithms, and performance. Based on our survey, we identify several future directions of research.

Multisensor-Based Continuous Authentication of Smartphone Users With Two-Stage Feature Extraction

The one-time authentication mechanism in traditional authentication methods cannot continuously authenticate smartphone users’ identities throughout the session. Continuous authentication based on the behavioral biometrics recorded by the built-in sensors can solve this issue. However, the existing methods based on multisensor have poor ability to extract valuable features that can represent smartphone users’ behavioral patterns. This article proposes a novel method combining the manual construction and the deep metric learning method to perform two-stage feature extraction, respectively. We transform the time-series raw data from three sensors (accelerometer, gyroscope, and magnetometer) into 69 statistical features in the first stage. Furthermore, unlike the existing serial feature fusion methods, we innovatively fuse the constructed statistical features from three sensors into a three-channel matrix. Then, the fused features matrix with a three-channel is fed to the deep metric learning model for the second stage of feature extraction. We use the elliptic envelope algorithm to classify the user as a legitimate user or an impostor. Finally, we evaluate the performance of the proposed method on two public data sets. Experimental results show that our method can achieve an average accuracy of 99.71% and an average equal error rate (EER) of 0.56% on the hand movement, movement, orientation, and grasp data set, and an average accuracy of 99.59% and an average EER of 0.61% on the BrainRun data set.

A Survey on Quantitative Risk Estimation Approaches for Secure and Usable User Authentication on Smartphones.

Mobile user authentication acts as the first line of defense, establishing confidence in the claimed identity of a mobile user, which it typically does as a precondition to allowing access to resources in a mobile device. NIST states that password schemes and/or biometrics comprise the most conventional user authentication mechanisms for mobile devices. Nevertheless, recent studies point out that nowadays password-based user authentication is imposing several limitations in terms of security and usability; thus, it is no longer considered secure and convenient for the mobile users. These limitations stress the need for the development and implementation of more secure and usable user authentication methods. Alternatively, biometric-based user authentication has gained attention as a promising solution for enhancing mobile security without sacrificing usability. This category encompasses methods that utilize human physical traits (physiological biometrics) or unconscious behaviors (behavioral biometrics). In particular, risk-based continuous user authentication, relying on behavioral biometrics, appears to have the potential to increase the reliability of authentication without sacrificing usability. In this context, we firstly present fundamentals on risk-based continuous user authentication, relying on behavioral biometrics on mobile devices. Additionally, we present an extensive overview of existing quantitative risk estimation approaches (QREA) found in the literature. We do so not only for risk-based user authentication on mobile devices, but also for other security applications such as user authentication in web/cloud services, intrusion detection systems, etc., that could be possibly adopted in risk-based continuous user authentication solutions for smartphones. The target of this study is to provide a foundation for organizing research efforts toward the design and development of proper quantitative risk estimation approaches for the development of risk-based continuous user authentication solutions for smartphones. The reviewed quantitative risk estimation approaches have been divided into the following five main categories: (i) probabilistic approaches, (ii) machine learning-based approaches, (iii) fuzzy logic models, (iv) non-graph-based models, and (v) Monte Carlo simulation models. Our main findings are summarized in the table in the end of the manuscript.

Swipe gestures for user authentication in smartphones

As more people rely on smartphones to store sensitive information, the need for robust security measures is all the more pressing. Because traditional one shot authentication methods like PINs and passwords are vulnerable to various attacks, we present a behavioral biometrics based smartphone authentication system using swipes. While previous research focused on a single kind of swipe, our data set features swipes using different fingers and directions collected from 36 users across three sessions. In our system, we experimented with support vector machine (SVM) and random forest (RF) classifiers. We investigated which finger, direction, and classifier provided the best individual swipe authentication results. Then, we analyzed whether fusion of different fingers and directions improved results. The best unimodal result came from a rightward swipe with right thumb using SVM, which resulted in an area under ROC curve (AUC) of 0.936 and an equal error rate (EER) of 0.135. We found that swipes using thumbs offered better performance. Fusion improves results for the most part, and our best result was the combination of a leftward swipe with right thumb and a leftward swipe with left thumb. This combination gave an AUC of 0.969 and EER of 0.081 with the SVM classifier.

KSDSLD — A tool for keystroke dynamics synthesis &amp; liveness detection

Keystroke dynamics is a behavioral biometrics modality that employs the characteristic typing patterns of users to verify their identity, generally as a part of a multifactor authentication scheme. Naïve implementations of keystroke dynamics verification are susceptible to presentation attacks with synthesized samples, leveraging partial or complete knowledge of the legitimate users’ typing patterns to forge accurate imitations of their behavior. The companion article has presented several novel methods for the synthesis of forged keystroke dynamics samples given one or more authentic samples of free text by the legitimate user, and a liveness detection method that employs the latter as adversaries to train a classification model, which can distinguish human-written samples from synthetic forgeries. Here, we provide the implementation and its source code.

A survey of human-computer interaction (HCI) & natural habits-based behavioural biometric modalities for user recognition schemes

The proliferation of Internet of Things (IoT) systems is having a profound impact across all aspects of life. Recognising and identifying particular users is central to delivering the personalised experience that citizens want to experience, and that organisations wish to deliver. This article presents a survey of human-computer interaction-based (HCI-based) and natural habits-based behavioural biometrics that can be acquired unobtrusively through smart devices or IoT sensors for user recognition purposes. Robust and usable user recognition is also a security requirement for emerging IoT ecosystems to protect them from adversaries. Typically, it can be specified as a fundamental building block for most types of human-to-things accountability principles and access-control methods. However, end-users are facing numerous security and usability challenges in using currently available knowledge- and token-based recognition (i.e., authentication and identification) schemes. To address the limitations of conventional recognition schemes, biometrics, naturally come as a first choice to supporting sophisticated user recognition solutions. We perform a comprehensive review of touch-stroke, swipe, touch signature, hand-movements, voice, gait and footstep behavioural biometrics modalities. This survey analyzes the recent state-of-the-art research of these behavioural biometrics with a goal to identify their attributes and features for generating unique identification signatures. Finally, we present security, privacy, and usability evaluations that can strengthen the designing of robust and usable user recognition schemes for IoT applications.

Can behavioral biometrics make everyone happy?

The market for behavioral biometrics—a technological evolution whereby patterns in human movement and activities can be identified, captured, and analyzed—is expected to exceed US $11 billion by 2031. We highlight the evolution from early physiological biometrics (e.g., fingerprints and iris scans used to verify the identity of individuals) to today’s behavioral biometrics. Technological advancements now turn our retail stores, offices, and warehouses into live data streams that let us closely and automatically monitor employees’ conduct at work. Although this development raises several legitimate surveillance and privacy concerns, behavioral biometrics can potentially benefit organizations and employees alike. Such mutual benefits compel managers to approach behavioral biometrics using our TRUST framework: transparency of intentions, respect for concerns, understanding the importance of choice, sharing the data benefits, and proactively timing the development. Managers who do so will gain a clear focus on organizational and employee well-being.