Using Keystroke Dynamics for Implicit Authentication on Smartphone

Abstract

Authentication methods on smartphone are demanded to be implicit to users with minimum users' interaction. Existing authentication methods (e.g. PINs, passwords, visual patterns, etc.) are not effectively considering remembrance and privacy issues. Behavioral biometrics such as keystroke dynamics and gait biometrics can be acquired easily and implicitly by using integrated sensors on smartphone. We propose a biometric model involving keystroke dynamics for implicit authentication on smartphone. We first design a feature extraction method for keystroke dynamics. And then, we build a fusion model of keystroke dynamics and gait to improve the authentication performance of single behavioral biometric on smartphone. We operate the fusion at both feature extraction level and matching score level. Experiment using linear Support Vector Machines (SVM) classifier reveals that the best results are achieved with score fusion: a recognition rate approximately 97.86% under identification mode and an error rate approximately 1.11% under authentication mode.

1. INTRODUCTION

Smartphone is becoming more and more popular to the human life. The number of smartphone sales even surpassed sales of feature phones for the first time in 2013 [1]. People can use their phone to send or receive emails, download apps, participate in a video call or video chat, manage and plan, keep entertained, get directions, recommendations, or other location-based information, etc. [2]. Secure authentication is required for access to data or applications. Moreover, the authentication system is demanded to be implicit with very minimum users’ involvement. According to a survey which was conducted by Furnell et al. [3], users want increased security authentication that is transparent when authenticating individuals for the sake of their convenience. But remembrance issue and privacy issues are the main drawbacks of current existing authentication methods on smartphone such as PINs, passwords, visual patterns, etc. [4]. It may be impractical for the users to remember all passwords or PINs from different sites. Moreover, the phone is easily lost, stolen or illegal access [4].

As each individual is identified by a set of unique characteristics and traits, also called as biometrics, these characteristics are good choices for authentication on smartphone with integrated sensors. Physiological biometrics (e.g. iris, fingerprint, etc.) can be implemented to completely overcome the issues of existing authentication methods [5,6] on smartphone, but the data acquisition process requires users’ interaction which does not satisfy the implicitness of user authentication. Behavioral biometrics (e.g. keystroke dynamics, gait, etc.), on the other hand, can be acquired easily and implicitly by using integrated sensors (e.g. touch sensor, motion sensors, etc.) on smartphone. Nevertheless, because of the inherent limitations [7,8] such as noisy data, high intra-class variability, and high inter-class similarity, existing work on authentication using single behavioral biometric [9-14] did not achieve performance which is good enough to implement in real world. Thus, multimodal biometrics has been proposed to alleviate these limitations [7,8].

In the mobile context, we found that most of the smartphone’s users interact with the device (e.g. when typing a text message, when composing an email, etc.) through the touch sensor which is available on most of modern smartphones. Consequently, keystroke dynamics data can be collected without the awareness of the users. In addition, as devices are put into their owners’ pocket for most of the day [4], walking gait signal can be acquired continuously and implicitly by using motion sensors on smartphone. And so, sensor-based gait authentication has a significant advantage in implementation on smartphone [9]. In this paper, we propose a biometric model involving keystroke dynamics for implicit authentication on smartphone. We first design a feature extraction method. And then, we build a fusion model of keystroke dynamics and gait to improve the authentication performance of single behavioral biometric on smartphone. We operate the fusion at both feature extraction level and matching score level. Support vector machines is selected to deal with high dimensional feature vectors. We achieved promising results under both identification and authentication mode when experimenting on real dataset.

The rest of this paper is organized as follow. Section 2 presents related work. Section 3 presents the proposed method. The experimental result is presented in section 4. Section 5 concludes the paper.

 

2. RELATED WORK

Single behavioral biometric authentication methods using keystroke dynamics or gait have been studied in the last decade. More details of these works are given in [9] and [10]. Recently in the mobile context, potential results have been achieved [10-14]. However, the inherent limitations of single behavior modalities make them difficult to achieve good result enough to implement in real world. To the best of our knowledge, the best result on gait authentication was achieved by T. Hoang [10] (in 2013) which was 94.93% recognition rate at zero false acceptance rate (FAR) and 3.89% false rejection rate (FRR). On keystroke dynamics, P.S. Teh [11] studied on multilayer fusion of keystroke dynamics (username, password, 13-character text) on 100 subjects using digraph features and achieved equal error rate (EER) at 1.401% when using template matching with Gaussian Probability Distribution Function and Direction Similarity Measure and score fusion. In 2013, M. Trojath [12] studied on 11-character password on 18 subjects with many features such as digraph, trigraph, pressure, etc. and used many classifiers such as neural networks, Bayesian classifier, etc. The best result which was achieved was EER at 2%. Keystroke dynamics on thumbnails was studied as well. T.Y. Chang [13] (2012) studied on 3-6 thumbnails on 100 subjects using pressure and four types of latencies and achieved EER at 6.9% by using statistical classifier. In 2013, N. Jeanjaitrong [14] studied on 4-16 thumbnails on 10 subjects using four features: dwell time, interval time, interval timing ratio and distance, and achieved recognition rate at 82.18%. In the same year, J. Draffin [15] studied characteristics of single keypress such as touch position, touch force, finger drift and the area of touch for passive authentication by using both discriminant model and generative model. The achieved experimental result on 13 subjects is the recognition rate (RR) at 67.7% within 5 keypresses and after 15 keypresses, this value is 86%.

Some fusion model using keystroke dynamics have been proposed [16-18] to improve the equal error rate of the authentication. In 2010, R. Giot [16] studied on 100 subjects and operated fusion of key stroke dynamics (16-character password with 1 space) and 2D face at matching score level and achieved EER at 2.22%. In 2012, H. Saevanee [17] studied on 30 subjects on fusion of keystroke dynamics (4-digit number, 11 digit number, text message with average length of 14-word), behavioral profiling, linguistic profiling and achieved EER at 8% using score fusion. In 2013, P. Tresadern [18] studied feature fusion and score fusion of face and voice on 150 subjects and achieved EER at approximately 2%. These approaches and their performances on mobile platform with various evaluation metrics such as EER, RR are summarized in Table 1.

Table 1.Recent research on biometric identification and/or authentication systems on smartphone (KD - Keystroke dynamics, RR - recognition rate, EER - equal error rate)

 

3. PROPOSED METHOD

Fig. 1 shows the proposed method where the processing steps for gait biometrics comes from [9]. Fusion can be operated in feature extraction level or matching score level.

Fig. 1.The proposed system.

3.1 Data acquisition

There is no public dataset on multimodal biometrics which consists of keystroke dynamics and gait. Moreover, it is difficult to collect a multimodal dataset. Therefore, we create a virtual database from two separate dataset to use in this study. The specifications of devices used in this experiment are summarized in table 2.

Table 2.Short specification of the phones used for data acquisition.

We used the MotionEvent in the Android SDK and the LG Optimus G E975 phone to collect keystroke dynamics data. The phone do not run any other application during data collection. There were 38 volunteers including 28 males and 10 females participated in this experiment. Participants who had original state of health were asked to sit as comfortable as possible at a chair under standard laboratory condition. The phone was hold freely at hand. Participants were asked to type a user-selected long sentence or paragraph (length greater than 50) and each of which is entered for ten times. In total, we collected 133905 seconds of keystroke dynamics of 38 volunteers. An example of collected data of two characters “S” and “O” is showed in Fig. 2. The data in each line consist of time-stamp in millisecond, X and Y coordinate of the touch point, touch size, touch pressure, touch action, and the typed character.

Fig. 2.Collected information for the input “SO”.

In addition, we collect the same data and in same condition of ten participants (among 38 participants) on the HTC Desire 500 phone. Totally 3552 seconds of keystroke dynamics was collected.

The gait dataset was manually collected by the authors in [10] using a Google Nexus One mobile phone with built-in accelerometer sensor and magnetometer sensor. In the data collection for gait, the phone is freely put into its owner’s trouser pocket.

3.2 Keystroke dynamics feature extraction

For keystroke dynamics data, we ignore the preprocessing steps because we aim in extracting dynamic features from the original data. Segmentation is performed on each data instance corresponds to a text sample to extract patterns. This is done by cutting the long sentence at punctuations such as dots, commas, etc.

After obtaining raw keystroke related information, vital features are extracted and analyzed for training. During a keystroke, the user’s finger/touch pen is usually drifted over the key’s surface, therefore multiple touches can be recorded (see Fig. 3) where “press” and “release” respectively correspond to “TOUCH_DOWN” and “TOUCH_UP” which are defined on the Android SDK. According to the information that can be acquired, we can extract and analyze the following features which are related to keystroke dynamics and touch screen behavior which have been developed in the literature: (1) digraph including dwell time (holding time of a key) and flight time or latency (time difference between “press” action and “release” action of two consecutive keys, of four types: “presspress”, “press-release”, “release-press”, “releaserelease”); (2) N-graph (time difference of “presspress” between a key and the N-th key in the sequence from its position); (3) pressure: the pressure a user applies to the touch surface; (4) size: the size of the touch area; (5) position: position a user touches to the touch surface; (6) drift: the displacement of the finger/touch pen during a keystroke in X and Y direction; (7) typing speed: the average time to type a key; and (8) error rate: the ratio of the number of times the backspace key is pressed to the total number of keys pressed.

Fig. 3.Data collection during a keystroke.

We use statistical features in this paper: mean and standard deviation of dwell time, flight time, trigraph (N-graph with N=3), displacement; minimum, mean and maximum of pressure; standard deviation of size and position; typing speed, error rate.

3.3 Fusion method

Because keystroke dynamics has limitations such as noisy data, high intra-class variation, high inter-class similarity, we build a multimodal authentication system involving keystroke dynamics and gait. Gait biometric is used because it is easy to acquire using integrated accelerometer of smartphone. Moreover, the phones are put to their owner’ pocket most of the day [4]. Therefore, walking gait is appropriate to authenticate on smartphone. In practice, we can collect gait data in separate manner with the keystroke dynamics. And anytime we perform keystroke dynamics authentication, we retrieve the prestored gait data for fusion. We apply the feature extraction method which was proposed in [10] to extract gait features.

After preprocessing and segmentation, the following features [10] are extracted from each component (e.g. Z-dimensional signal, magnitude of the XY-dimensional signal, and magnitude of the signal) of a particular segment: root mean square, mean, standard deviation, average absolute different, waveform length, 10-bin histogram distribution, first 40 fast Fourier transform (FFT) coefficients, and first 40 discrete Cosine transform (DCT) coefficients.

3.3.1 Feature fusion

In feature fusion, two feature vectors from an instance of keystroke dynamics and an instance of gait are fused by concatenation. Given two feature vector fv1 and fv2 of length D which comes from two modalities, the concatenation looks like this:

And before being fed into the SVM classifier, fv is normalized into the interval [-1, 1] based on the min-max rule [7]. In order to balance the number of features of fv1 and fv2, we reduce the number of gait’s features by extracting only one component and reducing the number of coefficients of the FFT and DCT. The final classification result is the average result of the three gait’s components.

In enrollment phase, we calculate and store the parameters of the SVM classifier. In test phase, a test feature vector is first normalized into the same space. And then, it is fed into the SVM classifier. We use the linear SVM for classification instead of the kernel method because the performance of kernel SVM is sensitive to model’s parameters changes [19].

3.3.2 Score fusion

In fusion at matching score level, features from two modalities are classified separately to obtain the score zi. For a particular test instance, the SVM classifier returns a vector of values indicating the probability that the test instance is in each class. Fusion is operated on these values which come from two test instance of two modalities. Because the scores are generally come from different domain, they are normalized to the same domain using the min-max rule [7]. For fusion, sum, product and averaging rule is used in this paper.

 

4. RESULTS

Totally 6100×2 patterns are extracted from the virtual dataset by using segmentation algorithms. There are around 160 patterns corresponding to each participant. These patterns are split into two equal parts: the first part is used for training and the remaining one is used for prediction. We use libsvm [19] as the tool to perform linear SVM classification. In authentication mode, we calculate the EER based on the probability values which are estimated by using the libsvm[19].

We first validate the goodness of the features of keystroke dynamics. The identification result in Fig. 4 reveals that dwell time, flight time and pressure which have been developed in the literature are reliable in this context as well. The experimental result shows that the drift features take advantage over features in the literature. Type of devices does not affect much to the performance of those feature. Similar result is obtained in authentication mode (see Fig. 5).

Fig. 4.Keystroke dynamics identification with single type of feature.

Fig. 5.Keystroke dynamics authentication with single type of feature.

The performance of keystroke dynamics identification method using all features is 92.17%. We operate fusion of keystroke dynamics and gait at both feature extraction level and matching score level. Table 3 shows the overall identification result. Because it’s difficult to operate fusion at feature extraction level, the fusion at matching score level yields better result. The highest recognition rate is achieved when using averaging for score fusion. We use this result in authentication mode.

Table 3.Overall identification result

The number of participants is thirty-eight. For each genuine user, we consider all the remaining as imposters. For measuring the error, the EER value is estimated based on the probability values which are estimated by using the libsvm [19]. The result is showed in Table 4.

Table 4.Overall authentication result

 

5. CONCLUSION

In this paper, we propose a method for implicit authentication on smartphone involving keystroke dynamics and gait. The purpose is to take advantage of integrated sensors for implicit authenticaauthentication on smartphone. We design a feature extraction method for keystroke dynamics. And then, we operate fusion to eliminate the impact of changing conditions such as bad quality data samples or sensor errors in both feature extraction level and matching score level. We use the linear SVM classifier for classification. The experimental result reveals that a significant improvement in authentication performance of method using multimodal modalities is achieved when compared with method using only one modality.