We investigate whether a classifier can continuously authenticate users based on the way they interact with the touchscreen of a smart phone. We propose a set of 30 behavioral touch features that can be extracted from raw touchscreen logs and demonstrate that different users populate distinct subspaces of this feature space. In a systematic experiment designed to test how this behavioral pattern exhibits consistency over time, we collected touch data from users interacting with a smart phone using basic navigation maneuvers, i.e., up-down and left-right scrolling. We propose a classification framework that learns the touch behavior of a user during an enrollment phase and is able to accept or reject the current user by monitoring interaction with the touch screen. The classifier achieves a median equal error rate of 0 for intrasession authentication, 2 -3 for intersession authentication, and below 4 when the authentication test was carried out one week after the enrollment phase. While our experimental findings disqualify this method as a standalone authentication mechanism for long-term authentication, it could be implemented as a means to extend screen-lock time or as a part of a multimodal biometric authentication system.
The two papers that are probably most related to our contribution are @cite_24 and @cite_22 . Both methods try to match recorded touch data with historical touch data of the user. In @cite_22 , the authors augment a gesture-based authentication method with a behavioral classifier that supports the authentication. Users that know the secret gesture cannot authenticate unless they carry it out in the very same way as the true user does it. In @cite_24 a set of 22 multi-touch gestures are used to authenticate 34 users on an iPad. The authors achieve EERs of 7 are significant differences in the problem setting of these two papers and our contribution. While in @cite_22 @cite_24 , a defined entry-point is required for the user to authenticate, we aim at an implicit and continuous scenario. Second, in our authentication scheme, the users can interact with the screen as they like, while in @cite_22 @cite_24 touch trajectories are compared with a particular (secret) gesture.
@cite_24 @cite_22
2151854612 1964160137 2064376060 2013045163
We investigate whether a classifier can continuously authenticate users based on the way they interact with the touchscreen of a smart phone. We propose a set of 30 behavioral touch features that can be extracted from raw touchscreen logs and demonstrate that different users populate distinct subspaces of this feature space. In a systematic experiment designed to test how this behavioral pattern exhibits consistency over time, we collected touch data from users interacting with a smart phone using basic navigation maneuvers, i.e., up-down and left-right scrolling. We propose a classification framework that learns the touch behavior of a user during an enrollment phase and is able to accept or reject the current user by monitoring interaction with the touch screen. The classifier achieves a median equal error rate of 0 for intrasession authentication, 2 -3 for intersession authentication, and below 4 when the authentication test was carried out one week after the enrollment phase. While our experimental findings disqualify this method as a standalone authentication mechanism for long-term authentication, it could be implemented as a means to extend screen-lock time or as a part of a multimodal biometric authentication system. Touch-based verification --- the use of touch gestures (e.g., swiping, zooming, etc.) to authenticate users of touch screen devices --- has recently been widely evaluated for its potential to serve as a second layer of defense to the PIN lock mechanism. In all performance evaluations of touch-based authentication systems however, researchers have assumed naive (zero-effort) forgeries in which the attacker makes no effort to mimic a given gesture pattern. In this paper we demonstrate that a simple "Lego" robot driven by input gleaned from general population swiping statistics can generate forgeries that achieve alarmingly high penetration rates against touch-based authentication systems. Using the best classification algorithms in touch-based authentication, we rigorously explore the effect of the attack, finding that it increases the Equal Error Rates of the classifiers by between 339 and 1004 depending on parameters such as the failure-to-enroll threshold and the type of touch stroke generated by the robot. The paper calls into question the zero-effort impostor testing approach used to benchmark the performance of touch-based authentication systems. Authentication methods can be improved by considering implicit, individual behavioural cues. In particular, verifying users based on typing behaviour has been widely studied with physical keyboards. On mobile touchscreens, the same concepts have been applied with little adaptations so far. This paper presents the first reported study on mobile keystroke biometrics which compares touch-specific features between three different hand postures and evaluation schemes. Based on 20.160 password entries from a study with 28 participants over two weeks, we show that including spatial touch features reduces implicit authentication equal error rates (EER) by 26.4 - 36.8 relative to the previously used temporal features. We also show that authentication works better for some hand postures than others. To improve applicability and usability, we further quantify the influence of common evaluation assumptions: known attacker data, training and testing on data from a single typing session, and fixed hand postures. We show that these practices can lead to overly optimistic evaluations. In consequence, we describe evaluation recommendations, a probabilistic framework to handle unknown hand postures, and ideas for further improvements. We propose a new behavioral biometric modality based on multi-touch gestures. We define a canonical set of multi-touch gestures based on the movement characteristics of the palm and fingertips being used to perform the gesture. We developed an algorithm to generate and verify multi-touch gesture templates. We tested our techniques on a set of 22 different gestures. Employing a matching algorithm for a multi-touch verification system with a k-NN classifier we achieved 1.28 Equal Error Rate (EER). With score-based classifiers where only the first five samples of a genuine subject were considered as templates, we achieved 4.46 EER. Further, with the combination of three commonly used gestures: pinch, zoom, and rotate, using all five fingers, 1.58 EER was achieved using a score-based classifier. These results are encouraging and point to the possibility of touch based biometric systems in real world applications like user verification and active authentication.