Walk the Walk: Attacking Gait Biometrics by Imitation

Abstract

Abstract. Since advances in gait biometrics are rather new, the current volume of security testing on this feature is limited. We present a study on mimicking, or imitation, of the human gait. Mimicking is a very intuitive way of attacking a biometric system based on gait, and still this topic is almost nonexistent in the open literature. The bottom line question in our research is weather it is possible to learn to walk like someone else. If this turned out to be easy, it would have a severe effect of the potential of gait as an authentication mechanism in the future. We have developed a software tool that uses wearable sensors to collect and analyze gait acceleration data. The research is further based on an experiment, involving extensive training of test subjects, and using various sources of feedback like video and statistical analysis. The attack scores are analyzed by regression, and the goal is to determine whether or not the participants are increasing their mimicking skills, or simply: if they are learning. The experiment involved 50 participants enrolled into a gait authentication system. The error rates compete with state of the art gait technology, with an EER of 6.2%. The mimicking part of the experiment revealed that gait mimicking is a very difficult task, and that our physiological characteristics work against us when we try to change something as fundamental as the way we walk. The participants showed few indications of learning, and the results of most attackers even worsened over time, showing that training did nothing to help them succeed. The research identified a natural boundary to the impostors' performance, a point of resistance so significant that it was given a name; a plateau. The location or value of this plateau predetermines the outcome of an attack; for success it has to lie below the acceptance threshold corresponding to the Equal Error Rate (EER).

Scenario test of accelerometer-based biometric gait recognition

“…The gait of a subject is visible to potential attackers who might analyze it to get access to the phone via mimicking. This was considered in a study by Mjaaland [8]. Despite having obtained feedback in the form of videos and statistical analysis, the participants did not show a significant improvement in learning a different gait.…”

“…The cycles identified in the previous step are cleaned by deleting unusual cycles (see also [8]). The pairwise distance between all cycles is computed using dynamic time warping (DTW) [12].…”

Gait authentication on mobile phone using biometric cryptosystem and fuzzy commitment scheme

“…The minimal polynomials for each element in GF(2 v ) are determined, respectively. Then, the generator polynomial g(x) is calculated according to (10). Finally, m(x) is multiplied by g(x) yielding a codeword c(x) = c n−1 x n−1 + c n−2 x n−2 + · · · + c 0 , where c 0 · · · c n−1 are coefficients of the codeword…”

“…Specifically, gait could be collected implicitly without the user awareness. It is difficult to mimic gait data [10], whereas a copy of a fingerprint or face could be easily obtained, and the system security fully depends on the resistance of the sensor [2].…”

“…From 2010, implicit sensor-based gait recognitions are initially proposed to support existing authentication mechanisms that are obtrusive and inconvenient in frequent use on mobile phones [5] and achieved promising results [6][7][8][9]. Gait-based authentication has significant advantages in terms of user friendliness and security aspects, compared with using other biometric modalities [9,10]. Specifically, gait could be collected implicitly without the user awareness.…”