Behavioral biometrics & continuous user authentication on mobile devices: A survey

Recent advances in sensing and wireless communication technologies have led to an explosion in the use of touch-screen mobile devices such as smartphones and tablets in mobile commerce and other daily work and life activities. These activities have resulted in more and more private and sensitive information stored on those devices. Therefore, improving the security of mobile devices by effective user authentication to prevent unauthorized information access becomes an imminent task. Mobile user authentication refers to the process of checking a user’s identity and verifying whether he/she is authorized to access a device. Due to the increasing incidence of mobile phones getting lost, stolen, or snatched while being used by the owner, continuous user authentication (CUA) after logging in a mobile device has attracted increasing attention. Prior research has shown that traditional password authentication is insufficient or ineffective for CUA. Despite the recent research progress in CUA, many existing methods are explicit by nature in that they require users to perform specific operations, which can cause interruptions to users’ ongoing activities or may be easily learned from observation by others. In this research, we propose a new touch dynamics based approach to CUA on touch screen mobile devices that authenticates users while they are interacting with mobile devices. Touch dynamics, which is rich in cognitive quality and unique to individuals, has yet to be explored for implicit CUA. We conducted a longitudinal study to evaluate the proposed mobile CUA approach. The results demonstrate that our method can improve the security of CUA for touch screen mobile devices. The findings have significant implications for the security and adoption of m-commerce.

The use of mobile devices in our day to day life has increased drastically in the last ten years. Much of it can be contributed to the breakthrough in the field of communication. Since they contain most of our personal information, the constant worry of security and privacy has increased. In order to tackle this problem, non-obstructive and continuous user authentication has been proposed. This paper deals with the methods that have been proposed till now and the challenges that are yet to be overcome in this field.

User authentication acts as the first line of defense verifying the identity of a mobile user, often as a prerequisite to allow access to resources in a mobile device. For several decades, user authentication was based on the “something the user knows”, known also as knowledge-based user authentication. Recent studies state that although knowledge-based user authentication has been the most popular for authenticating an individual, nowadays it is no more considered secure and convenient for the mobile user as it is imposing several limitations. These limitations stress the need for the development and implementation of more secure and usable user authentication methods. Toward this direction, user authentication based on the “something the user is” has caught the attention. This category includes authentication methods which make use of human physical characteristics (also referred to as physiological biometrics), or involuntary actions (also referred to as behavioral biometrics). In particular, risk-based user authentication based on behavioral biometrics appears to have the potential to increase mobile authentication security without sacrificing usability. In this context, we, firstly, present an overview of user authentication on mobile devices and discuss risk-based user authentication for mobile devices as a suitable approach to deal with the security vs. usability challenge. Afterwards, a set of novelty detection algorithms for risk estimation is tested and evaluated to identify the most appropriate ones for risk-based user authentication on mobile devices.

With the ubiquity of wearable devices, various behavioural biometrics have been exploited for continuous user authentication during daily activities. However, biometric authentication using complex hand behaviours have not been sufficiently investigated. This paper presents an implicit and continuous user authentication model based on hand-object manipulation behaviour, using a finger-and hand-mounted inertial measurement unit (IMU)-based system and state-of-the-art deep learning models. We employed three convolutional neural network (CNN)-based deep residual networks (ResNets) with multiple depths (i.e., 50, 101, and 152 layers) and two recurrent neural network (RNN)-based long short-term memory (LSTMs): simple and bidirectional. To increase ecological validity, data collection of hand-object manipulation behaviours was based on three different age groups and simple and complex daily object manipulation scenarios. As a result, both the ResNets and LSTMs models acceptably identified users’ hand behaviour patterns, with the best average accuracy of 96.31% and F1-score of 88.08%. Specifically, in the simple hand behaviour authentication scenarios, more layers in residual networks tended to show better performance without showing conventional degradation problems (the ResNet-152 > ResNet-101 > ResNet-50). In a complex hand behaviour scenario, the ResNet models outperformed user authentication compared to the LSTMs. The 152-layered ResNet and bidirectional LSTM showed an average false rejection rate of 8.34% and 16.67% and an equal error rate of 1.62% and 9.95%, respectively.

Evaluation of Deep Learning Models for Continuous Authentication Using Behavioral Biometrics

Continuous authentication with feature-level fusion of touch gestures and keystroke dynamics to solve security and usability issues

Session authentication schemes establish the identity of the user only at the beginning of the session, so they are vulnerable to attacks that tamper with communications after the establishment of the authenticated session. Moreover, smartphones themselves are used as authentication means, especially in two-factor authentication schemes, which are often required by several services. Whether the smartphone is in the hands of the legitimate user constitutes a great concern, and correspondingly whether the legitimate user is the one who uses the services. In response to these concerns, Behavioral Biometrics (BB) Continuous Authentication (CA) technologies have been proposed on a large corpus of literature. This paper presents a research on the development and validation of a BBCA system (named BioPrivacy), that is based on the user’s keystroke dynamics, using a Multi-Layer Perceptron (MLP). Also, we introduce a new behavioral biometrics collection tool, and we propose a methodology for the selection of an appropriate set of behavioral biometrics. Our system achieved 97.18% Accuracy, 0.02% Equal Error Rate (EER), 97.2% True Acceptance Rate (TAR) and 0.02% False Acceptance Rate (FAR).KeywordsMachine learningBehavioral biometricsContinuous authenticationMobile devicesMulti-layer perceptron (MLP)

AuthConFormer: Sensor-based Continuous Authentication of Smartphone Users Using A Convolutional Transformer

Continuous authentication utilizes automatic recognition of certain user\nfeatures for seamless and passive authentication without requiring user\nattention. Such features can be divided into categories of physiological\nbiometrics and behavioral biometrics. Keystroke dynamics is proposed for\nbehavioral biometrics-oriented authentication by recognizing users by means of\ntheir typing patterns. However, it has been pointed out that continuous\nauthentication using physiological biometrics and behavior biometrics incur\nprivacy risks, revealing personal characteristics and activities. In this\npaper, we consider a previously proposed keystroke dynamics-based\nauthentication scheme that has no privacy-preserving properties. In this\nregard, we propose a generic privacy-preserving version of this authentication\nscheme in which all user features are encrypted -- preventing disclosure of\nthose to the authentication server. Our scheme is generic in the sense that it\nassumes homomorphic cryptographic primitives. Authentication is conducted on\nthe basis of encrypted data due to the homomorphic cryptographic properties of\nour protocol.\n

Today’s conventional verification system for accessing PC and handheld devices does not incorporate any post login verification. This type of system fails to address risk involved after the initial login session. With increasing personalization of computing devices, the risk extends from the erstwhile focus on malafide intervention to the issue of improper personalization of data generated out of cooperative or inadvertent intervention. Thus to ensure authenticity of the user during their entire active login period, a continuous verification is required. The current paper considers continuous unobtrusive biometric authentication technology as an approach to eliminate this problem. It also analyzes additional requirements for the unobtrusive and continuous nature of the verification system- namely unavailability of any specific modality at a given time, performance under fluctuating quality of measurable parameters and different fusion scenarios for modalities. Finally, it provides a brief framework of continuous multimodal biometric authentication using passive modalities - namely face identification, keystroke dynamics, mouse dynamics, and fingerprint which are suitable for unobtrusive continuous authentication.

Adding machine learning (ML) and artificial intelligence (AI) logic models to authentication is an inevitable process. In this work, we show that the combination of qualitative and quantitative verification over model created on training data may significantly reduce false access probability, even if the user's credentials ID and password are compromised. We propose three layers of authentication based on user ID and password, silent signals, and biometrical data. The system uses supervised ML to determine the user's risk level. Basic model and associate implementation performance shows that we can, with high probability, identify an intruder based on silent signals, historical data, and behavioural biometrics. The system is compositional, so further improvement by introducing more silent signals and behavioural analytics can, theoretically, eliminate false acceptance. Whenever the risk level is higher than some threshold, an additional verification is required. The threshold may increase over time and in that case, the probability of additional verification of a legitimate user decreases.

Zero Trust Architecture (ZTA) integration with Federated Learning (FL) is a game changer in authentication systems of controlled industries. This study hypothesizes the privacy saving model based on a framework that integrates behavioral biometrics with decentralized machine learning to allow continuous user authentication without accessing sensitive data. The suggested system will utilize hybrid Convolutional Neural Network-Recurrent Neural Network (CNN-RNN) models in a federated learning setup to involve spatio-temporal trends in user behavior whilst data localization on edge devices. The outcomes of the experiment show that the accuracy rates are over 92% when it comes to identifying a user in a variety of behavioral modalities, such as the keystroke dynamics and the patterns of mouse movement. The framework is used to eliminate centralized data storage vulnerabilities that can lead to critical privacy requirements in the healthcare, financial services, and government sectors. Differential privacy mechanisms both guarantee that sensitive information is not leaked when updating the model and also guard against inference attacks with the help of secure aggregation protocols. The overhead reduction in performance measures is found to be 27% versus the traditional centralized methods. The Zero Trust model confirms user identity by behavioral signature continually giving adaptive risk scoring to access control decisions. This piece of work adds new elements of architecture combining policy enforcement points with federated aggregators and blockchain-generated audit trails. The system ensures compliance with the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) by implementing the principle of data minimum and clear processing. The viability of the framework to be deployed in the production with latency under 150ms to make authentication decisions is validated empirically in three regulated industry settings.

Mobile Cloud Computing (MCC) is a highly complex topic that encompasses several information security issues. The authentication area of the various entities involved has been extensively discussed in recent years and shown a wide range of possibilities. The use of inadequate authentication processes leads to several problems, which range from financial damage to users or providers of Mobile Commerce (M-Commerce) services to the death of patients who depend on Mobile Healthcare (M-Health) services.<br><br>The design of reliable authentication processes that minimize such issues involves the use of non-intrusive authentication techniques and continuous authentication of users by MCC service providers. In this sense, biometrics may satisfy such needs in various scenarios.<br><br>This research has explored some conceptual bases and presents a continuous authentication protocol for MCC environments. Such a protocol is part of a cyberphysical system (CPS) and is based on the monitoring of physiological information interpreted from users’ electrocardiograms (ECG). Machine learning techniques based on the Adaptative Boost (Adaboost) and Random Undersampling Boost (RUSBoost) were used for the classification of the cardiac cycles recognized in such ECGs.<br><br>The two ML techniques applied to electrocardiography were compared by a random subsampling technique that considers four analysis metrics, namely accuracy, precision, sensitivity, and F1-score. The experimental results showed better performance of RUSBoost regarding accuracy (97.4%), precision (98.7%), sensitivity (96.1%), and F1- score (97.4%).<br>

As distance learning platforms become increasingly attractive among the Jamaican cohort of university students, there are renewed concerns around the exploitation of authentication protocols. The literature suggest that static authentication alone may not be sufficient in validating user identity. In the context of the distance learning environment, it is often challenging to demonstrate that the integrity of user sessions has not been compromised. In this paper, the researchers experimented and demonstrated the use of Behavioral Biometrics to; continuously authenticate students in a Distance Learning Environment. The key features/dataset used in this experiment originates from two (2) primary physical input devices (Keyboard and Mouse). This dataset aided in the development of a user biometric profile that would, in turn, authenticate a user based on statistical matching, utilizing a combination of algorithms. The results garnered from the study revealed evidence that suggested that the application of behavioural biometrics seems promising in enhancing user authentication as a mean of identifying genuine and imposter users on the distance learning platform thus meeting the regulatory requirement as established by the University Council of Jamaica (UCJ).

The traditional static password-based authentication schemes are insufficient to fully protect user privacy. They suffer from various usability and security issues which are usually utilized by online criminals to obtain users' passwords and control their accounts. In 2014 more than 4.9 million Gmail accounts have been compromise and published online. As a response to such incidents security researchers have started to investigates other alternative authentication methods. Currently there is a growing body of research to improve user authentication based on physiological and behavioral biometrics. In this paper we review the literature and discuss several related studies. Additionally, we propose the use of free-password authentication scheme using vein recognition at the login stage and keystroke dynamics as a continuous authentication during the user session.