Scalable Behavioral Authentication

Abstract

A Behavioral Authentication (BA) system constructs a behavioral profile for a user and uses it to verify their identity claims. It is primarily used as a second factor in user authentication. A BA system starts with an initial database of user profiles, and uses a verification algorithm to accept or reject a verification request, that consists of a claimed identity and behavioral data by measuring the distance between the profile of the claimed identity and the presented behavioral data. As new users join the system, the size of profile database grows and for a user u, the probability of other users with "close" profiles increases, and this results in an increase in the error probability of verification algorithm. We analyze this problem in distance-based verification systems, and introduce the notion of scalability of BA systems that requires the system error probability to remain (almost) unchanged as the size of the profile database grows. To achieve scalability, we propose personalization of verification algorithm. More specifically, for a user u the verification algorithm considers a set of doppelgangers that consists of users that have "close" profiles to u, and uses the set to form additional verification checks for verification requests against u. We use extensive experiments to validate the above, including the increase in the verification error with the increase in the database size, and implement and evaluate our proposed scalable verification algorithm in reducing this error. To our knowledge, this is the first systematic treatment of scalability of BA systems. Our notion of scalability and the approach to achieving it are general and applicable to other distance-based authentication systems.

AuthentiSense: A Scalable Behavioral Biometrics Authentication Scheme using Few-Shot Learning for Mobile Platforms

“…In the past, different approaches for authenticating the users of mobile devices have been developed. These approaches use either statistical features extracted on touch gestures [52], [67], [33], [69], [68], [44], [26], values that are captured by the sensors for identifying the user based on its motions [51], [38], [18], [22], [14], [70], [50], [37], [15], [30], [49], [65], [25], or correlate the touch gestures and motion sensors [29], [16], [20], [21]. However, these existing approaches are 1) restricted to identifying a user among a set of known users, thus can only detect intruders that were part of the training data [30], [33], [52], [65], [67], 2) require training the model when a new user joins the system limiting their scalability [15], [24], [70], or 3) work only in certain situations and not in a continuous way, e.g., when picking up the phone [19], [20], [21].…”

“…The solution by Islam et al requires the users to solve a challenge, e.g., draw a circle [44]. However, with this explicit authentication action, there is no advantage compared to standard explicit authentication approaches, e.g., scanning the fingerprint.…”