Itus

Abstract

Security and usability issues with pass-locks on mobile devices have prompted researchers to develop implicit authentication (IA) schemes, which continuously and transparently authenticate users using behavioural biometrics. Contemporary IA schemes proposed by the research community are challenging to deploy, and there is a need for a framework that supports: different behavioural classifiers, given that different apps have different requirements; app developers using IA without becoming domain experts; and real-time classification on resource-constrained mobile devices. We present Itus, an IA framework for Android that allows the research community to improve IA schemes incrementally, while allowing app developers to adopt these improvements at their own pace.We describe the Itus framework and how it provides: ease of use: Itus allows app developers to use IA by changing as few as two lines of their existing code-on the other hand, Itus provides an oracle capable of making advanced recommendations should developers wish to fine-tune the classifiers; flexibility: developers can deploy Itus in an application-specific manner, adapting to their unique needs; extensibility: researchers can contribute new behavioural features and classifiers without worrying about deployment particulars; low performance overhead: Itus operates with minimal performance overhead, allowing app developers to deploy it without compromising end-user experience. These goals are accomplished with an API allowing individual stakeholders to incrementally improve Itus without reengineering new systems. We implement Itus in two demo apps and measure its performance impact. To our knowledge, Itus is the first open-source extensible IA framework for Android that can be deployed off-the-shelf.

A survey on touch dynamics authentication in mobile devices

“…Knowledge-based authentication methods, such as passwords, PINs or pattern locks (hereafter referred to as passcode), are still the primary methods used to authenticate mobile users (Khan et al, 2014). However, these methods are vulnerable to a number of security threats or attacks, including brute force attacks (Kim, 2012), shoulder surfing (Zakaria et al, 2011), and smudge attacks (Giuffrida et al, 2014).…”

Data driven user authentication with multi-level behavior profiling

“…This makes behavioral characteristics based authentication simpler and less costly to implement. In general, it includes but not limited to human voice Muda et al (2010), mouth movements Lu et al (2019), keystroke Kim et al (2018); Wu et al (2018); Shekhawat and Bhatt (2019), mouse-operation behavior Ahmed and Traore (2007); Bours and Fullu (2009); Aksari and Artuner (2009); Nakkabi et al (2010); Ahmed and Traore (2011); Shen et al (2012a);Feher et al (2012); Shen et al (2013Shen et al ( , 2014Shen et al ( , 2016; Chong et al (2018Chong et al ( , 2019, as well as software-level behavior Salem and Stolfo (2012); Dash et al (2005); Kholidy et al (2015); Salem and Stolfo (2011); Camina et al (2011);Camiña et al (2014); Nickel et al (2012); Islam and Safavi-Naini (2016); Khan et al (2014); Wang et al (2013). Among these behavioral characteristics, we are the most interested in the software-level behavior and mouse-operation behavior, which we will further study in this dissertation.…”

“…Software-level behavior includes operation command frequency Salem and Stolfo (2012), operation command ordering Dash et al (2005); Kholidy et al (2015), search behavior Salem and Stolfo (2011); Camina et al (2011);Camiña et al (2014), etc. Although some prior works in this field exist, most of them are platform-specific, such as Nickel et al (2012); Islam and Safavi-Naini (2016) for mobile users, Khan et al (2014) for Android systems, and Wang et al (2013) for social networks.…”

“…Chapter 2 expands the content of Section 1.3.2, in which we introduce a generic continuous authentication scheme for software systems. Although lots of work has been proposed in this area as discussed in Chapter 1.3.2, most of them are platform-specific, such as Nickel et al (2012); Islam and Safavi-Naini (2016) for mobile users, Khan et al (2014) for Android systems, and Wang et al (2013) for social networks. Muñoz, Gonzalez and Maña Muñoz et al (2012) once proposed a robust architecture for dynamic security monitoring that can be applicable to various cloud systems, but it has significant disadvantages.…”