No abstract

No abstract

Smart head-worn or head-mounted devices, including smart glasses and Virtual Reality (VR) headsets, are gaining popularity. Online shopping and in-app purchase from such headsets are presenting new e-commerce opportunities to the app developers. For convenience, users of these headsets may store account login, bank account and credit card details in order to perform quick in-app purchases. If the device is unattended, then an attacker, which can include insiders, can make use of the stored account and banking details to perform their own in-app purchases at the expense of the legitimate owner. To better protect the legitimate users of VR headsets (or head mounted displays in general) from such threats, in this paper, we propose to use eye movement to continuously authenticate the current wearer of the VR headset. We built a prototype device which allows us to apply visual stimuli to the wearer and to video the eye movements of the wearer at the same time. We use implicit visual stimuli (the contents of existing apps) which evoke eye movements from the headset wearer but without distracting them from their normal activities. This is so that we can continuously authenticate the wearer without them being aware of the authentication running in the background. We evaluated our proposed system experimentally with 30 subjects. Our results showed that the achievable authentication accuracy for implicit visual stimuli is comparable to that of using explicit visual stimuli. We also tested the time stability of our proposed method by collecting eye movement data on two different days that are two weeks apart. Our authentication method achieved an Equal Error Rate of 6.9% (resp. 9.7%) if data collected from the same day (resp. two weeks apart) were used for testing. In addition, we considered active impersonation attacks where attackers trying to imitate legitimate users' eye movements. We found that for a simple (resp. complex) eye tracking scene, a successful attack could be realised after on average 5.67 (13.50) attempts and our proposed authentication algorithm gave a false acceptance rate of 14.17% (3.61%). These results show that active impersonating attacks can be prevented using complex scenes and an appropriate limit on the number of authentication attempts. Lastly, we carried out a survey to study the user acceptability to our proposed implicit stimuli. We found that on a 5-point Likert scale, at least 60% of the respondents either agreed or strongly agreed that our proposed implicit stimuli were non-intrusive.

This paper presents theory, algorithms, and validation results for system identification of continuous-time statespace models from finite input-output sequences. The algorithms developed are methods of subspace model identification and stochastic realization adapted to the continuous-time context. The resulting model can be decomposed into an input-output model and a stochastic innovations model. Using the Riccati equation, we have designed a procedure to provide a reducedorder stochastic model that is minimal with respect to system order as well as the number of stochastic inputs, thereby avoiding several problems appearing in standard application of stochastic realization to the model validation problem.

This paper demonstrates the use of a continuous-time subspace model identification method, in the identification of MIMO state-space models. The measured input and output signals are assumed to be measured at regularly spaced sampling instances. The presence of both measurement, and process noise is considered. The proposed method gives a biased estimate of the system matrices, but we shall show how to minimise this bias by a proper choise of the lag used for the instruments. Finally, the applicability of the method is demonstrated in the identification of aircraft dynamics.