Behavior-based Authentication Systems. Multimedia Security

Transcription

1 Behvior-bsed Authentiction Systems Multimedi Security

2 Prt 1: User Authentiction Through Typing Biometrics Fetures Prt 2: User Re-Authentiction vi Mouse Movements 2

3 User Authentiction Through Typing Biometrics Fetures Lívi C. F. Arújo Luiz H. R. Sucupir Jr. Miguel G. Lizárrge Lee L. Ling nd João B. T. Ybu-Uti Correspondence IEEE Trnsctions on Signl Processing vol. 53 no. 2 Feb. 2005

4 Introduction The login-pssord uthentiction is the most usul mechnism used to grnt ccess. lo-cost fmilir to lot of users hoever frgile creless user / ek pssord) The pper provides better pproch to improve bove one using biometric chrcteristics. unique cnnot be stolen lost forgotten 4

5 Introduction cont.) The technology used is typing biometric keystroke dynmics. monitoring the keybord inputs to identify users bsed on their hbitul typing rhythm pttern The method's dvntges lo-cost using keybord) unintrusive using pssord) using sttic pproch using the login session) 5

6 Some Keyords Trget String The input string typed by the user nd monitored by system String length is importnt issue. t lest ten chrcters) Number of Smples Smples collected during the enrollment process to compound the trining set Its number vries lot. Fetures key durtion the time intervl tht key remins pressed) keystroke ltency the time intervl beteen successive keystrokes) 6

7 Some Keyords cont.) Timing Accurcy The precision of the key-up nd key-don times hve to be nlyzed. It vries beteen 0.1ms d 1000ms. Trils of Authentiction The legitimte users usully fil in the first of uthentiction. If the user still fil in the second time he ill be considered n impostor. Adpttion Mechnism Biometric chrcteristics chnges over time. The system need updted. Clssifier k-mens Byes fuzzy logic neurl netorks etc. 7

8 The Approch Proposed Get trget string ith t lest ten chrcters. Get ten smples. more thn ten smples my nnoy the users) Anlysis fetures: The combintion of these fetures is novel in this pper.) key code to keystrokes ltencies key durtion 1-ms time ccurcy is used. An dpttion mechnism is used to updte templte. 8

9 Flochrt of the Methodology 9

10 Min Issue Timing Accurcy Keystroke Dt Fetures Templte Clssifier Adpttion Mechnism 10

11 Timing Accurcy Since 98% of the smples' vlue re beteen 10 nd 900ms 1-ms precision is used. 11

12 Keystroke Dt m chrcters n keystrokes m n) smple ccount K { k ) k )... k )} 1 2 n Ech k i ) is composed of t idon ) t ) c ) iup i 12

13 13 Fetures key code don-don DD) up-don UD) This feture my be pos. or neg.) don-up DU) key intervl) )} )... ) { 2 1 c c c C n ) ) ) )} )... ) { t t dd dd dd dd DD don i don i i n ) ) ) )} )... ) { t t ud ud ud ud UD up i don i i n ) ) ) )} )... ) { 2 1 t t du du du du DU don i up i i n

14 Fetures cont.) The distnce ill be discussed lter. 14

15 15 Templte constructed by ten smples) ) : ) ) ) ) 10 1 ) orud DU DD fet Feture j fet j fet j fet i fet j i fet i i i

16 16 Clssifier If the smple is considered flse. Otherise for ech time feture clculte the distnce beteen templte nd smples. C C ) ) 1 ) ) ) 1 ) fet fet i i n i i fet i i fet d d n D

17 Clssifier cont.) The smple ill be considered true if D dd ) T dd ) D du ) T du ) D ud ) T ud ) A user s feture ith loer vrince demnds higher threshold nd vice vers. 17

18 Adpttion Mechnism d i T If fet ) fet ) dd this smple into templte nd discrd the oldest one. The stndrd devition for ech feture is modified nd the threshold re modified. 18

19 Experiements 30 users men nd omen beteen 20 nd 60 yers old) Three sitution Legitimte user uthentiction Imposter user uthentiction Observer imposter user uthentiction Seven experiments 1) only DD; 2) only UD; 3) only DU; 4) DD nd UD; 5) DD nd DU; 6) UD nd DU; 7) DD UD nd DU 19

20 Result Flse Acceptnce Rte FAR) Flse Rejection Rte FRR) Zero FAR Zero FRR Equl Error Rte EER) 20

21 1) Only DD time; 2) Only UD time; 3) Only DU time; 4) DD nd UD times; 5) DD nd DU times; 6) UD nd DU times; 7) DD UD nd DU times. 21

22 22

23 Discussion A trget string ith cpitl letters increses the difficulty of uthentiction. The fmilirity of the trget string to the user hs significnt impct. FRR 17.26%) One-tril uthentiction significntly increse the FRR. FRR 11.57%) The dpttion mechnism decreses both rte. FAR 4.70% FRR 4.16%) 23

24 Discussion cont.) If the dpttion mechnism is lys ctivted the FAR increse lot. FAR 9.4% FRR 3.8%) A higher timing ccurcy decreses both rte. FRR 1.63% FAR 3.97) FRR increses s the number of smples is reduced. 24

25 25

26 26

27 Conclusion The method pplied uses just one trget string nd ten smples in enrollment. The best performnce s chieved using sttisticl clssifier bse on distnce nd the combintion of four feture key code DD UD DU times) hich is novel obtining 1.45% FRR nd 1.89% FAR. This pper shos the influence of some spects such s the fmilirity of the trget string the totril uthentiction the dpttion mechnism the time ccurcy the number of smples in enrollment. 27

28 User Re-Authentiction vi Mouse Movements Mj Pusr nd Cri E.Brodley Proceedings of the 2004 ACM orkshop on Visuliztion nd dt mining for computer security

29 Outline Introduction User Re-Authentiction vi Mouse Movements An Empiricl Evlution Future ork 29

30 Introduction1/3) Why re-uthentiction? The purpose of re-uthentiction system is to continully monitor the user s behvior during the session to flg nomlous behvior Defend insider ttcks Ex. Forget to logout forget to lock Ex. Employees temporry orkers consultnts. 30

31 Introduction2/3) Trditionl re-uthentiction Periodiclly sk the user to uthentiction vi pssords tokens. Behviorl re-uthentiction Direct: keystroke mouse. Indirect: system cll trce progrm execution trces. 31

32 Introduction3/3) This pper Collect dt form 18 users ll orking ith Internet Explorer nd brose the fixed ebpges ith fixed mouse device. 32

33 Roughly User Re-Authentiction vi Mouse Movements Dt Collection nd Feture Extrction Building Model of Norml Behvior Anomly Detection 33

34 User Re-Authentiction vi Mouse Movements Dt Collection nd Feture Extrction1/4) The cursor movement Exmine hether the mouse hs moved every 100msec. Record distnce ngle nd speed. Extrct men stndrd devition nd the third moment vlues over indo of N dt points. 34

35 User Re-Authentiction vi Mouse Movements Dt Collection nd Feture Extrction2/4) The mouse event NC re: the re of the menu nd toolbr 35

36 User Re-Authentiction vi Mouse Movements Dt Collection nd Feture Extrction3/4) The mouse event Record time of the event. Record distnce ngle nd speed beteen pirs of dt point A nd B here B occurs fter A. Clculte the vlue every f frequency) dt points. Extrct men stndrd devition nd the third moment vlues over indo of N dt points 36

37 User Re-Authentiction vi Mouse Movements Dt Collection nd Feture Extrction4/4) Summry of feture extrction The # of observed events in the indo. 6) - events. The men stndrd devition nd the third moment of the distnce ngle nd speed beteen pirs of points. 3 * 3 * 6+1) ) - cursor & events. The men stndrd devition nd the third moment of the X nd Y coordintes. 3 * 2 * 6+1) ) - cursor & events. 37

38 User Re-Authentiction vi Mouse Movements Building Model of Norml Behvior1/1) Using supervised lerning lgorithm Specify the indo size N Specify frequency for every ctegories 38

39 User Re-Authentiction vi Mouse Movements Anomly Detection1/1) Simple method Trigger n lrm ech time dt point in the profile is clssified s nomlous Smooth filter Require t lrms to occur in m observtions of the current user s behvior profile. If it is nomlous : sks the user to uthenticte gin or reports the nomly to system dministrtor. 39

40 An Empiricl Evlution1/6) The gol of our experiments is to determine hether user x hen running n ppliction e.g. Internet Explorer) cn be distinguished from the other n-1 users running the sme ppliction. 40

41 An Empiricl Evlution2/6) 2/4 for trining 1/4 for prmeter selection 1/4 for testing. Dt Sources 18 students unique cursor loctions The sme set of eb pges Windos Internet Explorer Prmeter selection Frequency: Windo size: Smoothing filter m:

42 An Empiricl Evlution3/6) Decision Tree Clssifier 42

43 An Empiricl Evlution4/6) Pir-Wise Discrimintion: Distinguish to people #6 nd #18 ith too fe mouse movements 43

44 An Empiricl Evlution5/6) Anomly Detection: Flse positive rte: uthorized user -> intruder Flse negtive rte: intruder -> uthorized user A high flse positive rte mens too fe mouse events 44

45 An Empiricl Evlution6/6) Smoothing Filter: 45

46 Future ork Reserch the impct of reply ttcks Ho best to pply unsupervised lerning Ho to incorporte the results from different sources. ex keystroke mouse) 46