Touchalytics: On the Applicability of Touchscreen Input as a Behavioral Biometric for Continuous Authentication

Abstract

We investigate whether a classifier can continuously authenticate users based on the way they interact with the touchscreen of a smart phone. We propose a set of 30 behavioral touch features that can be extracted from raw touchscreen logs and demonstrate that different users populate distinct subspaces of this feature space. In a systematic experiment designed to test how this behavioral pattern exhibits consistency over time, we collected touch data from users interacting with a smart phone using basic navigation maneuvers, i.e., up-down and left-right scrolling. We propose a classification framework that learns the touch behavior of a user during an enrollment phase and is able to accept or reject the current user by monitoring interaction with the touch screen. The classifier achieves a median equal error rate of 0% for intra-session authentication, 2%-3% for inter-session authentication and below 4% when the authentication test was carried out one week after the enrollment phase. While our experimental findings disqualify this method as a standalone authentication mechanism for long-term authentication, it could be implemented as a means to extend screen-lock time or as a part of a multi-modal biometric authentication system.

I Sensed It Was You: Authenticating Mobile Users with Sensor-Enhanced Keystroke Dynamics

“…Han et al [22] suggested using accelerometer data to infer the GPS coordinates of a mobile device within a 200m radius from the real location. Frank et al [19] presented a continuous authentication system based on 30 touchbased gestures. Their SVM and kNN detection algorithms resulted in 0%-4% EER depending on whether training and testing were performed during the same user session.…”

K-means++ vs. Behavioral Biometrics: One Loop to Rule Them All

“…Traditionally, these included keyboards, [11], [15], [19], and mouse [2], [18], [38]. Now, modern smartphones also provide an array of sensor information, which can be used similarly to construct user profiles based on touchscreen swipes [4], [14], gait analysis [12], [27], and other metrics. These signals are collected from the legitimate user and then analyzed at authentication time to verify the identity of the user attempting to log in.…”

Multi-privacy biometric protection scheme using ensemble systems

“…The TouchAnalytics [15] dataset is a behavioural trait collected through strokes in mobile touchscreen interaction. TouchAnalytics is composed of 30 attributes derived from observed strokes performed by 41 users.…”

“…The number of stroke attempts is different for each user. Thus, a stroke is defined in [15] as a trajectory encoded as a sequence of vectors with real numbers, s n = (x n , y n , t n , p n , A n , o f n , o ph n ) where n ∈ 1, 2, ..., N enumerates the number of strokes (and there are N strokes), with location x n , y n , time stamp t n , pressure on screen p n , area A n occluded by the finger, finger orientation o f n , and phone orientation o ph n which can be landscape or portrait. Therefore, it is possible to derive the information about area covered, stroke pressure, direction, velocity and acceleration from the above raw data.…”