Spoofed Data Research Articles

An open GNSS spoofing data repository: characterization and impact analysis with FGI-GSRx open-source software-defined receiver

Spoofing is becoming a prevalent threat to the users of Global Navigation Satellite Systems (GNSS). It is important to deepen our understanding of spoofing attacks and develop resilient techniques to effectively combat this threat. Detecting and mitigating these attacks requires thorough testing, typically conducted in a laboratory environment through the establishment of a spoofing test-bed. The complexity, cost and resource demands of creating such a test-bed underscore the necessity of utilizing openly available datasets. To address this need, this paper introduces a new GNSS spoofing data repository from Finnish Geospatial Research Institute (FGI) named hereafter as ‘FGI-SpoofRepo’. This data repository consists of raw In-phase and Quadrature (I/Q) data of live recordings of GPS L1 C/A, Galileo E1, GPS L5, and Galileo E5a signals. These datasets encompass three distinct types of spoofing characteristics (synchronous, asynchronous, and meaconing), making them very useful example candidates of open data for testing the performance of any anti-spoofing techniques (be it detection or mitigation). The inclusion of live signals in multiple GNSS frequencies and the presence of cryptographic signatures in Galileo E1 signal make these datasets potential benchmarks for assessing the resilience performance of multi-frequency multi-constellation receivers. The analysis of the datasets is carried out with an open-source MATLAB-based software-defined receiver, FGI-GSRx. An updated version of FGI-GSRx, equipped with the necessary modifications for processing and analyzing the new datasets, is released alongside the datasets. Therefore, the GNSS research community can utilize the open-source FGI-GSRx or any third-party SDR to process the publicly available raw I/Q data for implementation, testing and validation of any new anti-spoofing technique. The results show that time-synchronous spoofing seamlessly takes over positioning solution, while time-asynchronous spoofing acts as noise or in some cases, completely prevent the receiver from providing a positioning solution. Signal re-acquisition during an ongoing spoofing attack (cold start), the receiver tends to lock onto the spoofing signal with the highest peak, posing a potential threat to GNSS receivers without assisted information. Overall, this research aims to advance the understanding of complex spoofing attacks on GNSS signals, providing insight into enhancing resilience in navigation systems.

Every step you take, I'll be tracking you: Forensic analysis of the tile tracker application

The rise in popularity of personal Bluetooth trackers has incited a need for forensic analysis tools that aid law enforcement in artifact recovery. With 40 million Tile devices reportedly sold at the time of writing, Tile trackers are one of the most popular personal Bluetooth trackers. This growth has not been without consequence, as reports of Bluetooth trackers being used for malicious activities have also escalated. Our work presents a forensic analysis of the Tile ecosystem and the Tile application on iOS, Android, and Windows. This analysis revealed valuable forensic artifacts that contained a diverse set of sensitive user data, including SQLite databases, XML files, cache files, and event logs. This data included information such as geolocation coordinates from the previous 30 days. As part of our analysis process, we developed an open-source tool capable of parsing these forensic artifacts from the Tile application: Tile Artifact Parser (TAP). TAP parses SQLite databases and virtual memory files, mapping geolocation coordinates and linking them according to timestamps. The ability to quickly and efficiently parse and map these location points provides valuable information in an investigation. TAP also aids investigators by detecting potentially spoofed data and flagging it. The robustness of TAP was tested to ensure its effectiveness and behavior in cases of incomplete or missing data.

A Deep-Learning-Based GPS Signal Spoofing Detection Method for Small UAVs

The navigation of small unmanned aerial vehicles (UAVs) mainly depends on global positioning systems (GPSs). However, GPSs are vulnerable to attack by spoofing, which causes the UAVs to lose their positioning ability. To address this issue, we propose a deep learning method to detect the spoofing of GPS signals received by small UAVs. Firstly, we describe the GPS signal dataset acquisition and preprocessing methods; these include the hardware system of the UAV and the jammer used in the experiment, the time and weather conditions of the data collection, the use of Spearman correlation coefficients for preprocessing, and the use of SVM-SMOTE to solve the spoofing data imbalance. Next, we introduce a PCA-CNN-LSTM model. We used principal component analysis (PCA) of the model to extract feature information related to spoofing from the GPS signal dataset. The convolutional neural network (CNN) in the model was used to extract local features in the GPS signal dataset, and long short-term memory (LSTM) was used as a posterior module of the CNN for further processing and modeling. To minimize randomness and chance in the simulation experiments, we used the 10-fold cross-validation method to train and evaluate the computational performance of our spoofing machine learning model. We conducted a series of experiments in a numerical simulation environment and evaluated the proposed model against the most advanced traditional machine learning and deep learning models. The results and analysis show that the PCA-CNN-LSTM neural network model achieved the highest accuracy (0.9949). This paper provides a theoretical basis and technical support for spoofing detection for small-UAV GPS signals.

Spoofing Traction Strategy Based on the Generation of Traction Code

Traction spoofing is an important component of Global Navigation Satellite System (GNSS) intermediate attacks, and the traction scheme directly determines the concealment of spoofing. However, spoofing via conventional traction strategies can be easily detected using Time of Arrival (TOA) and power detection. Based on a BPSK-modulated signal, a novel traction strategy using traction code is proposed to suppress part of the authentication signal and form an ideal correlation peak. This strategy was modeled and simulated to verify its theoretical feasibility. Effective spoofing data were generated based on the signal generation software to verify the spoofing effect with the reception of the software receiver. It can be inferred that no significant distortion occurred throughout the traction process, and the value range of the traction speed was expanded. The received results in different scenarios demonstrated that the observations’ Root-Mean-Square Error (RMSE) percentage change in the proposed strategy is significantly better than those of conventional strategies. A Ratio Test was also performed, verifying that the strategy can bypass Signal Quality Monitoring (SQM) detection. Meanwhile, the proposed strategy remained effective when the C/N0 increased to 60 dBHz. In summary, the proposed strategy exhibits destructiveness, concealment, and adaptability on the battlefield.

Physical Layer Authentication Using Ensemble Learning Technique in燱ireless Communications

Cyber-physical wireless systems have surfaced as an important data communication and networking research area. It is an emerging discipline that allows effective monitoring and efficient real-time communication between the cyber and physical worlds by embedding computer software and integrating communication and networking technologies. Due to their high reliability, sensitivity and connectivity, their security requirements are more comparable to the Internet as they are prone to various security threats such as eavesdropping, spoofing, botnets, man-in-the-middle attack, denial of service (DoS) and distributed denial of service (DDoS) and impersonation. Existing methods use physical layer authentication (PLA), the most promising solution to detect cyber-attacks. Still, the cyber-physical systems (CPS) have relatively large computational requirements and require more communication resources, thus making it impossible to achieve a low latency target. These methods perform well but only in stationary scenarios. We have extracted the relevant features from the channel matrices using discrete wavelet transformation to improve the computational time required for data processing by considering mobile scenarios. The features are fed to ensemble learning algorithms, such as AdaBoost, LogitBoost and Gentle Boost, to classify data. The authentication of the received signal is considered a binary classification problem. The transmitted data is labeled as legitimate information, and spoofing data is illegitimate information. Therefore, this paper proposes a threshold-free PLA approach that uses machine learning algorithms to protect critical data from spoofing attacks. It detects the malicious data packets in stationary scenarios and detects them with high accuracy when receivers are mobile. The proposed model achieves better performance than the existing approaches in terms of accuracy and computational time by decreasing the processing time.

Impact and Vulnerability Analysis of IEC61850 in Smartgrids Using Multiple HIL Real-Time Testbeds

Due to the increasing use of smart components in smart grids, interoperability among them is a crucial aspect to address. IEC61850 is a communication standard that has been already used in substations because of its instant data transfer and the ability to enable data exchange between a variety of smart energy-related digital technologies. This article studies the application of the communication protocols defined by the IEC61850 standard in Intelligent Electronic Devices (IEDs) by using a prototype testbed architecture running on a real-time digital device. The goal of this activity is to study the impact of smart simulations and the vulnerability in terms of cyber-security. This testbed includes the supervisor, the substation bus, and the process bus communication layer creating a local network exchanging data at distinct levels. Different fault protection scenarios are discussed using both physical and emulated IEDs, and the communication protocols implemented in each scenario are explained showing that additional delays are introduced. In the first two scenarios, the operation of the testbed using physical versus emulated IEDs is analyzed and compared, ensuring the robustness of this methodology in situations where the use of a physical IED would be unfeasible. In these scenarios, the functionality and robustness of the protection mechanisms and communication protocols are confirmed. In the third scenario vulnerability of smart grids that use IEC61850 as their primary communication protocol to data injection attacks is studied. Sniffing the local network, packets are captured and monitored. Spoofed data with the same structure are injected into the network to conduct false data injection attacks on the supervisory unit. Vulnerability to cyber attacks of the IEC61850 protocol in specific situations is shown.

Entropy-based network traffic anomaly classification method resilient to deception

Entropy-based network traffic anomaly detection techniques are attractive due to their simplicity and applicability in a real-time network environment. Even though flow data provide only a basic set of information about network communications, they are suitable for efficient entropy-based anomaly detection techniques. However, a recent work reported a serious weakness of the general entropy-based anomaly detection related to its susceptibility to deception by adding spoofed data that camouflage the anomaly. Moreover, techniques for further classification of the anomalies mostly rely on machine learning, which involves additional complexity. We address these issues by providing two novel approaches. Firstly, we propose an efficient protection mechanism against entropy deception, which is based on the analysis of changes in different entropy types, namely Shannon, R?nyi, and Tsallis entropies, and monitoring the number of distinct elements in a feature distribution as a new detection metric. The proposed approach makes the entropy techniques more reliable. Secondly, we have extended the existing entropy-based anomaly detection approach with the anomaly classification method. Based on a multivariate analysis of the entropy changes of multiple features as well as aggregation by complex feature combinations, entropy-based anomaly classification rules were proposed and successfully verified through experiments. Experimental results are provided to validate the feasibility of the proposed approach for practical implementation of efficient anomaly detection and classification method in the general real-life network environment.

GNSS induced spoofing simulation based on path planning

Global navigation satellite Systems (GNSS) are highly susceptible to various interferences because of their inherent vulnerability. In these interferences, induced spoofing is very difficult to be detected because it can gradually drag off the tracking points without unlocking the tracking loops of the attacked receiver and cause the victim to obtain a wrong position and/or time information. Furthermore, it is also very difficult to generate induced spoofing data, including simulation data and real data, to evaluate various induced spoofing detection and suppression algorithms. Existing generation algorithms need to precisely control and adjust many parameters of GNSS simulation software even for simulation data. To address this problem, this study proposes a GNSS-induced spoofing simulation algorithm based on path planning. First, through given planned paths, the proposed algorithm independently generates the authentic and spoofing signals without changing the parameters of GNSS simulation software. After that, the induced spoofing simulation data are synthesised by only adjusting the powers of authentic and spoofing signals. The effectiveness of the proposed algorithm is verified by the positioning solutions and the correlation function outputs of the code and carrier tracking loops.

Global Navigation Satellite Systems Spoofing Detection through measured Autocorrelation Function Shape Distortion

SummaryWith the expansion in Global Navigation Satellite System (GNSS) constellations and emerging applications utilizing GNSS systems, the issue of detection of interference is evolving as a growing concern in the satellite navigation user community. Threats for GNSS users can be classified as unintentional interference, jamming, and spoofing. Spoofing is more harmful among them because the target receiver might not be aware of the attack and, as a consequence, generate misleading position information. Spoofing attacks are classified as simplistic, intermediate, and sophisticated depending on their complexity of implementation. We focused primarily on the detection of intermediate spoofing attacks by measuring shape distortion (SD) through multiple correlators that cover multiple chips around the prompt tracking point. The SD metric compares the measured and typical values of the autocorrelation function and decides on the spoofing using a noise variance based threshold. The proposed SD metric is found to be very effective in detecting the spoofing attack during the pull‐off phase of the attack. The method is verified through simulations, synthetic spoofing data, and the TEXBAT data shared by the University of Texas, Austin. Different formulations of the proposed method are compared to provide an optimal number of correlator taps in each channel.

Speech frame selection for spoofing detection with an application to partially spoofed audio-data

In this paper, we introduce a frame selection strategy for improved detection of spoofed speech. A countermeasure (CM) system typically uses a Gaussian mixture model (GMM) based classifier for computing the log-likelihood scores. The average log-likelihood ratio for all speech frames of a test utterance is calculated as the score for the decision making. As opposed to this standard approach, we propose to use selected speech frames of the test utterance for scoring. We present two simple and computationally efficient frame selection strategies based on the log-likelihood ratios of the individual frames. The performance is evaluated with constant-Q cepstral coefficients as front-end feature extraction and two-class GMM as a back-end classifier. We conduct the experiments using the speech corpora from ASVspoof 2015, 2017, and 2019 challenges. The experimental results show that the proposed scoring techniques substantially outperform the conventional scoring technique for both the development and evaluation data set of ASVspoof 2015 corpus. We did not observe noticeable performance gain in ASVspoof 2017 and ASVspoof 2019 corpus. We further conducted experiments with partially spoofed data where spoofed data is created by augmenting natural and spoofed speech. In this scenario, the proposed methods demonstrate considerable performance improvement over baseline.

Progressive Transfer Learning for Face Anti-Spoofing.

Face anti-spoofing (FAS) techniques play an important role in defending face recognition systems against spoofing attacks. Existing FAS methods often require a large number of annotated spoofing face data to train effective anti-spoofing models. Considering the attacking nature of spoofing data and its diverse variants, obtaining all the spoofing types in advance is difficult. This would limit the performance of FAS networks in practice. Thus, an online learning FAS method is highly desirable. In this paper, we present a semi-supervised learning based framework to tackle face spoofing attacks with only a few labeled training data (e.g., ∼ 50 face images). Specifically, we progressively adopt the unlabeled data with reliable pseudo labels during training to enrich the variety of training data. We observed that face spoofing data are naturally presented in the format of video streams. Thus, we exploit the temporal consistency to consolidate the reliability of a pseudo label for a selected image. Furthermore, we propose an adaptive transfer mechanism to ameliorate the influence of unseen spoofing data. Benefiting from the progressively-labeling nature of our method, we are able to train our network on not only data of seen spoofing types (i.e., the source domain) but also unlabeled data of unseen attacking types (i.e., the target domain). In this way, our method can reduce the domain gap and is more practical in real-world anti-spoofing scenarios. Extensive experiments in both the intra-database and inter-database scenarios demonstrate that our method is on par with the state-of-the-art methods but employs remarkably less labeled data (less than 0.1% labeled spoofing data in a dataset). Moreover, our method significantly outperforms fully-supervised methods on cross-domain testing scenarios with the help of our progressive learning fashion.

ASVspoof 2019: A large-scale public database of synthesized, converted and replayed speech

Automatic speaker verification (ASV) is one of the most natural and convenient means of biometric person recognition. Unfortunately, just like all other biometric systems, ASV is vulnerable to spoofing, also referred to as “presentation attacks.” These vulnerabilities are generally unacceptable and call for spoofing countermeasures or “presentation attack detection” systems. In addition to impersonation, ASV systems are vulnerable to replay, speech synthesis, and voice conversion attacks.The ASVspoof challenge initiative was created to foster research on anti-spoofing and to provide common platforms for the assessment and comparison of spoofing countermeasures. The first edition, ASVspoof 2015, focused upon the study of countermeasures for detecting of text-to-speech synthesis (TTS) and voice conversion (VC) attacks. The second edition, ASVspoof 2017, focused instead upon replay spoofing attacks and countermeasures. The ASVspoof 2019 edition is the first to consider all three spoofing attack types within a single challenge. While they originate from the same source database and same underlying protocol, they are explored in two specific use case scenarios. Spoofing attacks within a logical access (LA) scenario are generated with the latest speech synthesis and voice conversion technologies, including state-of-the-art neural acoustic and waveform model techniques. Replay spoofing attacks within a physical access (PA) scenario are generated through carefully controlled simulations that support much more revealing analysis than possible previously. Also new to the 2019 edition is the use of the tandem detection cost function metric, which reflects the impact of spoofing and countermeasures on the reliability of a fixed ASV system. This paper describes the database design, protocol, spoofing attack implementations, and baseline ASV and countermeasure results. It also describes a human assessment on spoofed data in logical access. It was demonstrated that the spoofing data in the ASVspoof 2019 database have varied degrees of perceived quality and similarity to the target speakers, including spoofed data that cannot be differentiated from bona fide utterances even by human subjects. It is expected that the ASVspoof 2019 database, with its varied coverage of different types of spoofing data, could further foster research on anti-spoofing.

GNSS Spoofing Detection by Supervised Machine Learning with Validation on Real-World Meaconing and Spoofing Data-Part II.

Global Navigation Satellite System (GNSS) meaconing and spoofing are being considered as the key threats to the Safety-of-Life (SoL) applications that mostly rely upon the use of open service (OS) signals without signal or data-level protection. While a number of pre and post correlation techniques have been proposed so far, possible utilization of the supervised machine learning algorithms to detect GNSS meaconing and spoofing is currently being examined. One of the supervised machine learning algorithms, the Support Vector Machine classification (C-SVM), is proposed for utilization at the GNSS receiver level due to fact that at that stage of signal processing, a number of measurements and observables exists. It is possible to establish the correlation pattern among those GNSS measurements and observables and monitor it with use of the C-SVM classification, the results of which we present in this paper. By adding the real-world spoofing and meaconing datasets to the laboratory-generated spoofing datasets at the training stage of the C-SVM, we complement the experiments and results obtained in Part I of this paper, where the training was conducted solely with the use of laboratory-generated spoofing datasets. In two experiments presented in this paper, the C-SVM algorithm was cross-fed with the real-world meaconing and spoofing datasets, such that the meaconing addition to the training was validated by the spoofing dataset, and vice versa. The comparative analysis of all four experiments presented in this paper shows promising results in two aspects: (i) the added value of the training dataset enrichment seems to be relevant for real-world GNSS signal manipulation attempt detection and (ii) the C-SVM-based approach seems to be promising for GNSS signal manipulation attempt detection, as well as in the context of potential federated learning applications.

Use of Supervised Machine Learning for GNSS Signal Spoofing Detection with Validation on Real-World Meaconing and Spoofing Data-Part I.

The vulnerability of the Global Navigation Satellite System (GNSS) open service signals to spoofing and meaconing poses a risk to the users of safety-of-life applications. This risk consists of using manipulated GNSS data for generating a position-velocity-timing solution without the user’s system being aware, resulting in presented hazardous misleading information and signal integrity deterioration without an alarm being triggered. Among the number of proposed spoofing detection and mitigation techniques applied at different stages of the signal processing, we present a method for the cross-correlation monitoring of multiple and statistically significant GNSS observables and measurements that serve as an input for the supervised machine learning detection of potentially spoofed or meaconed GNSS signals. The results of two experiments are presented, in which laboratory-generated spoofing signals are used for training and verification within itself, while two different real-world spoofing and meaconing datasets were used for the validation of the supervised machine learning algorithms for the detection of the GNSS spoofing and meaconing.

An Assessment of GPS Spoofing Detection Via Radio Power and Signal Quality Monitoring for Aviation Safety Operations

Due to the ever-growing threat of GPS spoofing, it has become necessary for the aviation sector to develop an effective means of detection. This article focuses on two complementary spoofing-detection techniques that are available on commercial GPS receivers and thus require no additional hardware to operate. The primary methodology for detection is using a combination of radio power monitoring metrics, levering both automatic gain control and C/N <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</sub> measurements, along with multiple correlations for signal distortion to provide a best practices spoofing-detection algorithm, which is able to distinguish between interference and spoofing. The article first assesses nominal statistics for both metrics compiled from more than 250 h of nominal data collected from multiple wide area augmentation system stations. These data are compared to previous collections to validate the thresholds and false alarms rates and establish a complete testing methodology. These tests and thresholds are then assessed with the Texas spoofing test battery series of GPS spoofing data sets to confirm detection capabilities. Finally, these tests and thresholds are applied to assess the GPS signal of six extended flights over the United States to assess the performance on an aircraft.

The IEC 61850 Sampled Measured Values Protocol: Analysis, Threat Identification, and Feasibility of Using NN Forecasters to Detect Spoofed Packets

The operation of the smart grid is anticipated to rely profoundly on distributed microprocessor-based control. Therefore, interoperability standards are needed to address the heterogeneous nature of the smart grid data. Since the IEC 61850 emerged as a wide-spread interoperability standard widely accepted by the industry, the Sampled Measured Values method has been used to communicate digitized voltage and current measurements. Realizing that current and voltage measurements (i.e., feedback measurements) are necessary for reliable and secure noperation of the power grid, firstly, this manuscript provides a detailed analysis of the Sampled Measured Values protocol emphasizing its advantages, then, it identifies vulnerabilities in this protocol and explains the cyber threats associated to these vulnerabilities. Secondly, current efforts to mitigate these vulnerabilities are outlined and the feasibility of using neural network forecasters to detect spoofed sampled values is investigated. It was shown that although such forecasters have high spoofed data detection accuracy, they are prone to the accumulation of forecasting error. Accordingly, this paper also proposes an algorithm to detect the accumulation of the forecasting error based on lightweight statistical indicators. The effectiveness of the proposed methods is experimentally verified in a laboratory-scale smart grid testbed.

Development of a GPS spoofing apparatus to attack a DJI Matrice 100 Quadcopter

Global Positioning System (GPS) Spoofing attacks threaten technologies that our modern society depends on. To successfully develop defensive mechanisms against these attacks, methods to model the attacks and subsequently distinguish them from normal GPS operation must be developed. This paper primarily details the step-by-step implementation of a low-cost GPS spoofing and high-level spoofing data collection apparatus to model a simplistic spoofing attack that could be implemented with limited resources. The spoofing apparatus developed has been used to successfully attack a DJI Matrice 100 quadcopter and a portion of the collected spoofing data is presented.

Synthetic GNSS spoofing data generation using field recorded signals

With the increase in GNSS user base, the studies of threats and vulnerabilities of GNSS system are also increased. Among the threats, spoofing is of particular interest because of the risk associated with it. The studies on spoofing are generally limited to simulated scenarios as the real world spoofing attack is very difficult to create or spot and record for analysis. This paper presents a method of generating baseband spoofing data using real world signals by simultaneous recordings of GNSS signals using two separate receivers, where one of them simulates the receiver under attack and the other simulates the response the spoofer will be going to produce to fabricate the attack. After taking the records and merging them to create the spoofing baseband signals, it is checked against several spoofing detection methods to verify the valid spoofing attack being present in the signal. This method produces the signal recordings that have real world disturbances in it that may be difficult to simulate.The developed method has the following advantages:•It does not require very expensive hardware to produce an intermediate spoofing signal.•The user has control over the spoofing power advantage.•The same scenario can be reproduced with varying parameters.

Synthetic speech detection using fundamental frequency variation and spectral features

Recent works on the vulnerability of automatic speaker verification (ASV) systems confirm that malicious spoofing attacks using synthetic speech can provoke significant increase in false acceptance rate. A reliable detection of synthetic speech is key to develop countermeasure for synthetic speech based spoofing attacks. In this paper, we targeted that by focusing on three major types of artifacts related to magnitude, phase and pitch variation, which are introduced during the generation of synthetic speech. We proposed a new approach to detect synthetic speech using score-level fusion of front-end features namely, constant Q cepstral coefficients (CQCCs), all-pole group delay function (APGDF) and fundamental frequency variation (FFV). CQCC and APGDF were individually used earlier for spoofing detection task and yielded the best performance among magnitude and phase spectrum related features, respectively. The novel FFV feature introduced in this paper to extract pitch variation at frame-level, provides complementary information to CQCC and APGDF. Experimental results show that the proposed approach produces the best stand-alone spoofing detection performance using Gaussian mixture model (GMM) based classifier on ASVspoof 2015 evaluation dataset. An overall equal error rate of 0.05% with a relative performance improvement of 76.19% over the next best-reported results is obtained using the proposed method. In addition to outperforming all existing baseline features for both known and unknown attacks, the proposed feature combination yields superior performance for ASV system (GMM with universal background model/i-vector) integrated with countermeasure framework. Further, the proposed method is found to have relatively better generalization ability when either one or both of copy-synthesized data and limited spoofing data are available a priori in the training pool.

Liveness Detection from Real user, Printed Pictures and Pictures on Mobile Devices from Low Resolution Webcam

Biometrics data have emerged as one of the most widely used technologies for validation of identity in various sectors. Nevertheless, spoof biometric data are used by attackers to get access to their targets. Hence, a number of approaches have been initiated to detect these spoofed biometric data. As such, this article proposed a complete methodology for liveness detection using low camera resolution, primarily because vast studies do rely on image quality, eyelid motion and facial expression to investigate spoof images. Nevertheless, spoof attacks cannot be diagnosed from low quality images or recorded video on mobile devices. Therefore, this paper initiates a cutting-edge technique to identify spoof attack from printed pictures, as well as videos recorded on mobile devices and built-in low resolution webcam. Moreover, by detecting the movements at the eye region and weighing these movements from a number of opted frames from recorded video, the standard deviation of these weighted movements were determined and finally, the results of these standard deviation values were compared with the priory estimated threshold values retrieved from this study. Furthermore, due to the nature of the data employed in this study, the researchers generated some data for real users by using low resolution building webcam device by recording the face images of the users on mobile device. With that, 100 various videos were used to predict the threshold value for liveness detection. As a result, this method had been successful in analysing user liveness with an accuracy of 97.6%. On top of that, further experiment is required to look into this method with bigger data set.