Behavioral biometrics
- 2. What you haveWhat you know What you ARE ! Secret Based Biometric Devices Password, PIN, code, secret question… Fingertips, iris, veins, ear, speak, walking pattern, keystroke… Swipe card, smart card, token, key, smartphone…
- 3. Hard Biometrics Face Eye: Retina & Iris Fingerprint Hand Geometry DNA Behavioral Biometrics Speech Handwriting Gait Writing Style Semantic Soft Biometrics Age Ethnicity Nationality Build Mannerisms Derived Biometrics Test News Internet Indirect Biometrics Driver’s License Medical Reconds Forms Cognitive factors • eye-hand coordination • applicative behaviour patterns • usage preferences • device interaction patterns • responses to Challenges Physiological factors • left/right handedness • press-size • hand tremors • arm size • muscle usage Contextual factors •transaction •navigation •device •network patterns EVERYTHING YOU ARE & DO CAN BE USED AS BIOMETRICS! “Biometric data is any data derived from biological properties, behavioural aspects, physiological characteristics, living traits or repeatable actions where those features and/or actions are both unique to that individual and measurable, even if the patterns used in practice to technically measure them involve a certain degree of probability.”
- 5. COMMON SENSORS NOT SPECIALIZED: • ACCELLEROMETER • GYROSCOPE • LIGHT SENSOR • PROXIMITY SENSOR • MICROPHONE • CAMERA • ECC.. SPECIALIZED: • HEART FREQUENCY • PRESSURE • SWEATING • IRIS RECOGNITION • FINGER PRINT RECOGNITION • ECC…
- 7. What is analyzed Speech input Frequency Duration Cadence Intonation Benefits User friendly Possible implementation in every devices Disadvantages Needs Neutral tone Background noise Device quality Illness , emotional behavior Time consuming enrollment Large processing template Non-traceless
- 8. What is analyzed Signature measures (dynamic) Speed Velocity Pressure Benefits High user acceptance Very fast procedure Very easy procedure Traceless Disadvantages High signature variance Affected by age, illness, emotions Requires high quality hardware High FAR Easy to emulate
- 9. What is analyzed Face geometry Eye Distance Mouth proportion Nose position Skin color Hair color Thermal Image (Possible) Benefits User friendly Can use neural networks Can be highly accurate Stable in time (Adults) Disadvantages Background noise Device quality Illness , emotional behavior Large processing template Large Database Non-Traceless
- 10. What is analyzed Global: Whole ear Local: Sections of ear Geometric: Measurements Benefits Contains surface shape information related to anatomical structure Relatively insensitive to illumination Slightly high performance Stable in time Disadvantages Template Database Dimension Device Quality Time consuming Process Non-Traceless
- 11. What is analyzed User typing pattern Speed Press and Release Rate Benefits Easy and invisible implementation Unique patterns are generated Difficult to emulate Disadvantages Not very scalable FAR is high Can be spoofed (recorders)
- 12. • Recognize individuals by the way they walk • Unobtrusive 2D silhouettes are changed into an associated sequence of 1D signals: di=((xi-xc)2+(yi-yc)2)1/2
- 13. Secret Based • One time authentication Biometric • One time authentication • Require time and procedure to procedure to authenticate • Draws criminal’s attention • Requires specific tech • Economical Impact • Biometric characteristics are not Devices • One time authentication • Can be lost • Should bring with you wherever Biometrics Universality Uniqueness Permanence Collectability Security Acceptability Circumvention Hardware required Fingerprint M H H M H M H Y Hand geometry M M M H M M M Y Keystrokes L L L M L M M N Hand veins M M M M M M H Y Iris H H H M H L H Y Retinal scan H H M L H L H Y Signature L L L H L H L Y Voice M L L M L H L N Face H H L H M H H N Odor H H H L L M L Y DNA H H H L H L L Y Gait M L L H L H M N Ear Canal M M H M M H M Y
- 18. X-Axis Authentication Type Description of Security Level 1 Password Can be guessed by fraudsters. Susceptible to brute force attacks 2 Security questions 3 OTP over SMS Verifies that you have your mobile device but susceptible to Man-In-The-Middle attacks 4 Soft Token 5 Hardware Token Verifies that you have your Hardware Token but susceptible to Man-In-The-Middle attacks 6 Biometric Verifies who you are but susceptible to Man-In-The-Middle attacks 7 Out-of-Band(Mobile) NO Man-In-The-Middle attacks are possible because verification happens through a separate channel but spoofing easy by creating a duplicate SIM or acquiring the credentials related to Push Notifications8 Push Notifications(Mobile) 9 Device Authenticaion(Mobile) NO Man-In-The-Middle attacks are possible and Spoofing is much more difficult 10 Biometric+Mobile Verifies who you are and what you have 11 Password+Mobile Verifies what you know and what you have 12 Password+Biometric Verifies what you know and who you are 13 Password+Biometric+Mobile Verifies what you know, who you are and what you have 14 Risk Based Access Verifies what you have, where you are, what time you are accessing the resources that you need and is your different from what you have done in the past
- 21. Continuous • Continuously protects the data after access authentication Adaptive • Continuously learns the behavior of the user and improves the user’s behavioral profile Transparent •Users cannot see or manipulate the software Easy to integrate •Algorithm requires no additional hardware Non intrusive • Respects the users integrity, not registering but only verifying how the user is working
- 22. PRES S FLIGHT SEQUENCE SEQUENCEFLIGHTPRES S MOUSE SURFACE GYROSCOPE ACCELEROMETER MOTIONPRESSURE HIT ZONE DESKTOP MOBILE Measures: • Information Processing • Coordination • Mechanics • Physics • Cognition
- 23. Very high in all moves? Very slow in short moves? Moderate in long moves?
- 24. Much more than a Pattern Lock! Invisible security with no additional hardware!
- 25. METODOLOGY • DTW-D-Sa: DTW-D algorithm to the data collected by the accelerometer sensor (Sa) • DTW-D-So: DTW-D algorithm to the data collected by the orientation sensor (So) • DTW-S-Sa: DTW-S algorithm to the data collected by the accelerometer sensor (Sa) • DTW-S-So: DTW-S algorithm to the data collected by the orientation sensor (So) 0 20 40 60 80 100 DTW-D- S a DTW-S- S a DTW-D- S o DTW-S- S o IPR FAR Method τ T IPR FAR DTW-D-Sa 0 6 13.1111 23.6666 DTW-S-Sa 58 20 12.8888 20.6666 DTW-D-So 0 20 4.4444 9.3333 DTW-S-So 14 20 32.0000 19.6666 RESULTS 0.00% 20.00% 40.00% 60.00% n=1 n=2 n=3 n=4 Algorithms to success IPR FAR 0.00% 20.00% 40.00% 60.00% T=-0,5 T=0,0 T=0,5 T=1,0 Threstold IPR FAR METODOLOGY • DTW-D-Sa: DTW-D algorithm to the data collected by the accelerometer sensor (Sa) • DTW-D-So: DTW-D algorithm to the data collected by the orientation sensor (So) • DTW-S-Sa: DTW-S algorithm to the data collected by the accelerometer sensor (Sa) • DTW-S-So: DTW-S algorithm to the data collected by the orientation sensor (So) LEGEND Symbol Meaning FAR False Alarm Rate IPR Impostor Pass Rate DTW-D Dynamic Time Warping algorithm with distance feature DTW-S Dynamic Time Warping algorithm with similarity feature SA Accelerometer sensor SO Orientation sensor τ Threshold value for algorithm DTW-D Threshold value for algorithm DTW-S Threshold value for combined methods
- 26. PERSON A Red/Green: x-y movement of device Blue: vertical movement (up/down) PERSON B
- 27. Normal phone usage Invisible challenge: 5° rotation to your move Your brain won’t let this happen! • spontaneously start correcting • won’t sense any change to the user experience Different people respond differently. Left: sharp, single correction (red) Right: complex, multiple corrections (blue) PERSON A PERSON B Passive traits: Rotation speed Cognitive choice: what do you spin first? # of corrections at the end of spin Final selection strategy (tap vs. spin) Pro-active, invisible challenges: Slight Increase / Decrease Rotation speed Slight change of speed during correction spins Various small effects during final selection
- 28. • • • •
- 29. Linking together different biometrical aspects Login Computer in use Logout Initial Authentication by password, smartcards or biometrics Continuous Authentication with behavioural biometrics software
- 30. 𝐴 = 0,62x0,78x0,64x0,52x0,48x0,51 = 0,0393986212 B = 1 − 0,62 x 1 − 0,78 x 1 − 0,64 x 1 − 0,52 x x(1 − 0,48)x(1 − 0,51) = 0,00368086118 𝐴 (𝐴 + 𝐵) 0,0393986212 (0,0393986212 + 0,00368086118) = 𝟎, 𝟗𝟏𝟒𝟓𝟓𝟔𝟓𝟏𝟑 THE BAYES EQUATION: Engine 1 Engine 2 Engine3 Engine4 Engine5 Engine6 62% 78% 64% 52% 48% 51%
- 31. Governmental organizations Finance Private Enterprises Healthcare