Real-Time Behavioral Biometrics and Continuous Authentication Framework for Secure Financial Transaction Ecosystems

Session authentication schemes establish the identity of the user only at the beginning of the session, so they are vulnerable to attacks that tamper with communications after the establishment of the authenticated session. Moreover, smartphones themselves are used as authentication means, especially in two-factor authentication schemes, which are often required by several services. Whether the smartphone is in the hands of the legitimate user constitutes a great concern, and correspondingly whether the legitimate user is the one who uses the services. In response to these concerns, Behavioral Biometrics (BB) Continuous Authentication (CA) technologies have been proposed on a large corpus of literature. This paper presents a research on the development and validation of a BBCA system (named BioPrivacy), that is based on the user’s keystroke dynamics, using a Multi-Layer Perceptron (MLP). Also, we introduce a new behavioral biometrics collection tool, and we propose a methodology for the selection of an appropriate set of behavioral biometrics. Our system achieved 97.18% Accuracy, 0.02% Equal Error Rate (EER), 97.2% True Acceptance Rate (TAR) and 0.02% False Acceptance Rate (FAR).KeywordsMachine learningBehavioral biometricsContinuous authenticationMobile devicesMulti-layer perceptron (MLP)

Continuous authentication with feature-level fusion of touch gestures and keystroke dynamics to solve security and usability issues

Instruction sender authentication of UAV (Unmanned Aerial Vehicle) control is critical for the secure operation of UAV systems. By exploring user touch action characteristics of the user interaction with the UAV control mobile terminal, this paper proposes a novel instruction sender continuous authentication framework for UAV control systems. In particular, we first obtain the touch screen data in real time from the interaction with the mobile device screen of a user when he controls the UAV. Then we create a polynomial to fit the touch trajectory on the screen of the user, and use the least square method to obtain the optimal estimate of the polynomial coefficients. Finally, we mark the grid area covered by the polynomial to extract the user’s touch screen operation action fingerprint(OAF), and employ the fuzzy extractor method to realize the identity authentication of the sender with certain error tolerance. Extensive experiments are conducted to illustrate the authentication performance of the proposed authentication framework in terms of false acceptance rate, false rejection rate and equal-error rate.

Genuine person recognition systems are necessary for a system to identify or authorize the identification of a person requesting their services. Ensuring that only authorized users access the provided services is the aim of this proposed system. These systems are susceptible to impersonation attacks in the absence of strong personal recognition methods. Due to its traditional authentication technique (PIN), the ATM has suffered greatly over the years from PIN theft and other related ATM thefts. Therefore, in this paper, we proposed a multilayer (Typing and Touch) based authentication security arrangement to enhance the security and safety for the ATM and its users. The proposed system demonstrates a threelayered design structure. The first layer is the card verification module, which concentrates on the enrolment phase for ATM card. The second layer is the feature extraction and comparing of the typing pattern from the database server. The last layer compares the touch behavior continue till session end with the stored touch data in the database server. During the implementation phase, MySQL server 2010 served as the backend and Java was used for front-end development on Microsoft Windows 10. Based on the False Rejection Rate (FAR), False Acceptance Rate (FAR), and Equal Error Rate (EER) measurements, the application was evaluated. These metrics demonstrate the security and dependability of the suggested system for the authentication and verification of ATM customers.

Continuous authentication utilizes automatic recognition of certain user\nfeatures for seamless and passive authentication without requiring user\nattention. Such features can be divided into categories of physiological\nbiometrics and behavioral biometrics. Keystroke dynamics is proposed for\nbehavioral biometrics-oriented authentication by recognizing users by means of\ntheir typing patterns. However, it has been pointed out that continuous\nauthentication using physiological biometrics and behavior biometrics incur\nprivacy risks, revealing personal characteristics and activities. In this\npaper, we consider a previously proposed keystroke dynamics-based\nauthentication scheme that has no privacy-preserving properties. In this\nregard, we propose a generic privacy-preserving version of this authentication\nscheme in which all user features are encrypted -- preventing disclosure of\nthose to the authentication server. Our scheme is generic in the sense that it\nassumes homomorphic cryptographic primitives. Authentication is conducted on\nthe basis of encrypted data due to the homomorphic cryptographic properties of\nour protocol.\n

Keystroke dynamics is a form of behavioral biometrics that can be used for continuous authentication of computer users. Many classifiers have been proposed for the analysis of acquired user patterns and verification of users at computer terminals. The underlying machine learning methods that use Gaussian density estimator for outlier detection typically assume that the digraph patterns in keystroke data are generated from a single Gaussian distribution. In this paper, we relax this assumption by allowing digraphs to fit more than one distribution via the Gaussian Mixture Model (GMM). We have conducted an experiment with a public data set collected in a controlled environment. Out of 30 users with dynamic text, we obtain 0.08% Equal Error Rate (EER) with 2 components by using GMM, while pure Gaussian yields 1.3% EER for the same data set (an improvement of EER by 93.8%). Our results show that GMM can recognize keystroke dynamics more precisely and authenticate users with higher confidence level.

Today’s conventional verification system for accessing PC and handheld devices does not incorporate any post login verification. This type of system fails to address risk involved after the initial login session. With increasing personalization of computing devices, the risk extends from the erstwhile focus on malafide intervention to the issue of improper personalization of data generated out of cooperative or inadvertent intervention. Thus to ensure authenticity of the user during their entire active login period, a continuous verification is required. The current paper considers continuous unobtrusive biometric authentication technology as an approach to eliminate this problem. It also analyzes additional requirements for the unobtrusive and continuous nature of the verification system- namely unavailability of any specific modality at a given time, performance under fluctuating quality of measurable parameters and different fusion scenarios for modalities. Finally, it provides a brief framework of continuous multimodal biometric authentication using passive modalities - namely face identification, keystroke dynamics, mouse dynamics, and fingerprint which are suitable for unobtrusive continuous authentication.

The traditional static password-based authentication schemes are insufficient to fully protect user privacy. They suffer from various usability and security issues which are usually utilized by online criminals to obtain users' passwords and control their accounts. In 2014 more than 4.9 million Gmail accounts have been compromise and published online. As a response to such incidents security researchers have started to investigates other alternative authentication methods. Currently there is a growing body of research to improve user authentication based on physiological and behavioral biometrics. In this paper we review the literature and discuss several related studies. Additionally, we propose the use of free-password authentication scheme using vein recognition at the login stage and keystroke dynamics as a continuous authentication during the user session.

Keystroke dynamics is one solution to enhance the security of password authentication without adding any disruptive handling for users. Industries are looking for more security without impacting too much user experience. Considered as a friction-less solution, keystroke dynamics is a powerful solution to increase trust during user authentication without adding charge to the user. In this paper, we address the problem of user authentication considering the keystroke dynamics modality. We proposed a new approach based on the conversion of behavioral biometrics data (time series) into a 3D image. This transformation process keeps all the characteristics of the behavioral signal. The time series do not receive any filtering operation with this transformation and the method is bijective. This transformation allows us to train images based on convolutional neural networks. We evaluate the performance of the authentication system in terms of Equal Error Rate (EER) on a significant dataset and we show the efficiency of the proposed approach on a multi-instance system.

In this paper, we address the problem of score fusion in biometric authentication. Single valued metrics related to the receiver operating characteristics (ROC) curve, such as Equal Error Rate (EER) and False Rejection Rate (FRR) when False Acceptance Rate equals zero, are extensively used for evaluating biometric authentication performances. Various requirements and preferences, for example, lower EER, or smaller FRR, may be imposed on biometric authentication systems in different application scenarios. We propose a novel method of score fusion based on quasi-convex optimization to directly improve biometric authentication metrics. Experiments based on a face recognition system demonstrate the effectiveness of the proposed method.

Behavioral biometrics & continuous user authentication on mobile devices: A survey

Behaviour-based continuous authentication systems like those that utilise an individual user's typing rhythm and device usage behaviour patterns have much potential over password-based schemes since they do not require an individual user to memorise passwords. Irrespective of the progress in biometric technologies, many systems are still susceptible to more complex attacks, and the decision between security and usability has been a perennial struggle for researchers and practitioners. This paper offers a powerful continuous authentication system based on AI and behavioural biometrics, enhancing precision and resistance to motivated attacks. By measuring behavioural data (e.g. keystroke dynamics and motion sensor) on a heterogeneous user population and then analyzing it, we trained our machine learning models to verify users in real-time. Based on our results, our performance is better than that of the traditional and static authentication methods, with an accuracy of 97.2 per cent, with the false acceptance rate (FAR) and false rejection rate (FRR) of 1.8 per cent and 2.3 per cent, respectively. Moreover, error analysis depicted significant trends in behaviour changes, which apply to an adaptive security strategy. This is demonstrated as a potential of AI-based behavioural biometrics to support feasible, secure, and user-friendly continuous authentication systems that work in contemporary cybersecurity scenarios. Future improvements will additionally involve enlarging datasets, combining multi-modal behavioural features, and increasing resistance to spoofing and behavioural drift.

Continuous Authentication (CA) consists of monitoring and checking repeatedly and unobtrusively user behavior during a computing session in order to discriminate between legitimate and impostor behaviors. Stylometry analysis, which consists of checking whether a target document was written or not by a specific individual, could potentially be used for CA. In this work, we adapt existing stylometric features and develop a new authorship verification model applicable for continuous authentication. We use existing lexical, syntactic, and application specific features, and propose new features based on n-gram analysis. We start initially with a large features set, and identify a reduced number of user-specific features by computing the information gain. In addition, our approach includes a strategy to circumvent issues regarding unbalanced dataset which is an inherent problem in stylometry analysis. We use Support Vector Machine (SVM) for classification. Experimental evaluation based on the Enron email dataset involving 76 authors yields very promising results consisting of an Equal Error Rate (EER) of 12.42% for message blocks of 500 characters.

Personal Identification Numbers (PINs) are widely used today for user authentication on mobile devices. However, this authentication method can be subject to several attacks such as phishing, smudge, and side-channel. In this paper, we increase the security of PIN-based authentication by considering behavioral biometrics, specifically the smartphone movements typical of each user. To this end, we propose a method based on anomaly detection that is capable of recognizing whether the PIN is inserted by the smartphone owner or by an attacker. This decision is taken according to the smartphone movements, which are recorded during the PIN insertion through the built-in motion sensors. For each digit in the PIN, an anomaly score is computed using Machine Learning (ML) techniques. Subsequently, these scores are combined to obtain the final decision metric. Numerical results show that our authentication method can achieve an Equal Error Rate (EER) as low as 5% in the case of 4-digit PINs, and 4% in the case of 6-digit PINs. Considering a reduced training set, composed of solely 50 samples, the EER only slightly worsens, reaching 6%. The practicality of our approach is further confirmed by the low processing time required, on the order of fractions of milliseconds.

"This paper explores the application of neural networks in multimodal biometric authentication systems, emphasizing the integration of multiple biometric modalities to enhance security, accuracy, and robustness against various attacks. Traditional authentication methods, such as passwords and single-modal biometrics, often suffer from vulnerabilities, including spoofing, environmental factors, and data breaches. To address these challenges, multimodal authentication systems combine several biometric traits, such as facial recognition, fingerprint scanning, voice recognition, and keystroke dynamics, to achieve higher reliability and resistance to security threats. The study provides an overview of public datasets used for training neural network-based biometric authentication models, including VoxCeleb, RAVDESS, MOBIO, and SDUMLA-HMT. These datasets contain diverse biometric information necessary for developing robust multimodal authentication systems. The paper evaluates the effectiveness of existing approaches using key performance metrics such as accuracy, false acceptance rate (FAR), false rejection rate (FRR), and area under the curve (AUC). Additionally, specialized metrics are considered, including failure to enroll rate (FTE), failure to acquire rate (FTA), and template stability (TS), which are crucial for real-world applications. The role of neural networks in multimodal biometric authentication is analyzed by examining state-of-the-art architectures, including convolutional neural networks (CNNs) and deep learning-based feature fusion methods. Various fusion levels—feature-level, score-level, and decision-level—are discussed to determine the optimal integration strategy for improving authentication performance. The results indicate that multimodal systems significantly outperform unimodal authentication methods by reducing vulnerability to spoofing and environmental variations. Experimental findings suggest that integrating multiple biometric traits enhances the system’s adaptability to dynamic conditions, reducing both false acceptance and false rejection rates. Despite these advantages, several challenges remain, including computational complexity, data privacy concerns, and the need for real-time processing capabilities. Future research should focus on optimizing multimodal fusion techniques, improving generalization across different datasets, and enhancing the security of biometric templates against adversarial attacks. Additionally, developing lightweight neural network architectures suitable for mobile and embedded systems is essential for the practical deployment of multimodal authentication technologies"