Multimodal mobile keystroke dynamics biometrics combining fixed and variable passwords

Abstract

Recent works have demonstrated the possibility to craft successful statistical attacks against keystroke dynamic biometric password. Those attacks leverage the possibility to capture several keystroke dynamics samples for a given password string, and then extract and use their distributional properties to craft the attack. These approaches are by design more likely to be successful when launched against fixed passwords, as several samples of the passwords can be captured through successive login sessions. Although the dynamics obtained from specific keys or key sequences for consecutive passwords slightly vary, by definition the distributional properties remain fairly stable for the same user. One way to thwart such that attack to use a variable password, also know as one‐time password (OTP). However, the fact that the keystroke dynamic OTP is different from one session to the other, makes it extremely difficult to reconstruct a valid biometric profile for a user. Modeling accurate keystroke dynamic OTP is challenging, due to the underlying variability and the sparse amount of information involved. We tackle the aformentioned challenge by presenting, in this paper, by presenting a multimodal approach tat combines fixed and variable keystroke dynamic biometric passwords. We investigate two different fusion models and evaluate our approach using a data set involving 100 different users, yielding encouraging performance results in terms of accuracy and resistance against statistical attacks.

Framework for user behavioural biometric identification using a multimodal scheme with keystroke trajectory feature and recurrent neural network on a mobile platform

“…As mobile systems advance, more features related to keystroke biometrics trait are extracted. Button touching pressure and button touching area are factors that differentiate users besides temporal and spatial features [28][29][30][31]. In one study that fused temporal features, finger area, and finger pressure, an EER of 2.3% was achieved [31].…”

Adversary Models for Mobile Device Authentication

“…Our classification of adversary models in mobile device authentication is related to the ISO/IEC 62443 security levels that have been specified in ISA99 [131] 10 : SL0 "No special requirement or protection required" SL1 "Protection against unintentional or accidental misuse" 9 Changes in electromagnetic signals at a radio receiver caused by movement of a user or object reflecting the signals are visible in the CSI. 10 Only a summary document of this standard is available online at the time of this writing, in the form of public slides by Pierre Cobes; Available online at http://isa99.isa.org/Public/Meetings/Committee/201205-Gaithersburg/ISA-99-Security_ Levels_Proposal.pdf. In this article, we use the slightly more detailed wording from https://en.wikipedia.org/wiki/IEC_ 62443.…”

“…Image-based authentication has an advantage [261,292] over password or PIN-based authentication due to improved usability [293], and since it is easier to recognize or recall an image than a text [62,73]. However, memorability and security strength of image-based recognition in comparison to PIN and password based solutions when multiple (10)(11)(12)(13)(14)(15)(16)(17)(18)(19)(20) of such passwords need to be remembered, has not been considered in the literature. Davis et al [61] further found that (1) user password selection is biased by race and gender [39], thus lowering password entropy, (2) the need for several rounds to provide a reasonably large password space impairs usability, and (3) recognition-based systems are vulnerable to replay attacks [15,266].…”

“…9 Changes in electromagnetic signals at a radio receiver caused by movement of a user or object re ecting the signals are visible in the CSI. 10 Only a summary document of this standard is available online at the time of this writing, in the form of public slides by Pierre Cobes; Available online at http://isa99.isa.org/Public/Meetings/Committee/201205-Gaithersburg/ISA-99-Security_ Levels_Proposal.pdf…”

Mobile keystroke dynamics for biometric recognition: An overview

“…Standard machine learning approaches have been used in most of the studies performing closed‐set verification on KD data acquired when typing free text on mobile devices. Specifically, RF has guaranteed the best recognition rates in [52, 55], while CART have been used together with LR in [11]. SVMs with Gaussian kernels have been employed in [56], and also neural networks have been exploited, as in [54, 61].…”