PaperlayerView exact revision on arXiv

Source-linked AI summary

Active Authentication on Mobile Devices via Stylometry, Application Usage, Web Browsing, and GPS Location

Lex Fridman, Steven Weber, Rachel Greenstadt, Moshe Kam

arXiv:1503.08479v1cs.CRstat.ML

TL;DR

The paper studies continuous identity verification on mobile devices using behavioral biometrics across diverse sensors and usage contexts. It collects an unconstrained 200-subject Android dataset, builds classifiers for four modalities, and fuses their decisions; fused error rates decrease as the decision window increases.

  • Problem

    Mobile active authentication requires continuous identity verification amid diverse sensors, behavioral profiles, device form factors, and usage environments.

  • Method

    The authors collect at least 30 days of unrestricted Android activity from 200 subjects and combine TEXT, APP, WEB, and LOCATION classifiers through parallel binary decision fusion.

  • Results

    The fusion system reaches an equal error rate of 0.05 after 1 minute and 0.01 after 30 minutes of user interaction.

  • Takeaways & Limitations

    Location contributes most across the tested time windows, while the fused system characterizes how each modality affects global authentication decisions.

Abstract

from arXiv · show

Active authentication is the problem of continuously verifying the identity of a person based on behavioral aspects of their interaction with a computing device. In this study, we collect and analyze behavioral biometrics data from 200subjects, each using their personal Android mobile device for a period of at least 30 days. This dataset is novel in the context of active authentication due to its size, duration, number of modalities, and absence of restrictions on tracked activity. The geographical colocation of the subjects in the study is representative of a large closed-world environment such as an organization where the unauthorized user of a device is likely to be an insider threat: coming from within the organization. We consider four biometric modalities: (1) text entered via soft keyboard, (2) applications used, (3) websites visited, and (4) physical location of the device as determined from GPS (when outdoors) or WiFi (when indoors). We implement and test a classifier for each modality and organize the classifiers as a parallel binary decision fusion architecture. We are able to characterize the performance of the system with respect to intruder detection time and to quantify the contribution of each modality to the overall performance.

I. INTRODUCTION

The paper addresses continuous authentication on mobile devices, where diverse sensors coexist with varied behavioral profiles, devices, and environments. It introduces four low-power modalities and a modular decision-fusion approach evaluated on a large, unconstrained dataset.

  • Mobile active authentication continuously verifies identity from behavioral interaction data when point-of-entry locking is absent or fails.
  • The study analyzes TEXT, APP, WEB, and LOCATION modalities, selected partly for their relatively low power consumption.These represent text analysis, application usage, web browsing, and physical device location.
  • A parallel decision-level fusion architecture asynchronously integrates modality decisions and supports adding classifiers without changing the basic fusion rule.The approach also enables evaluation of each classifier’s marginal contribution to overall performance.
  • The evaluation characterizes local and fused error rates, temporal intruder detection performance, and each local classifier’s contribution to the global decision.

B. Mobile Active Authentication

Mobile active authentication research uses behavioral biometrics from smartphones, but prior studies often used smaller or simulated datasets and limited modalities. This paper builds a large, unconstrained, colocated dataset and tracks four modalities while addressing collection constraints such as battery drain and reduced GPS sampling.

  • Prior work and dataset: Prior mobile authentication studies often used smaller or simulated datasets, while this work collected data from 200 subjects over 30+ days.The authors characterize their dataset as unique in size, duration, and concurrently tracked modalities.
  • Dataset and modalities: Participants were colocated in Philadelphia, while usage patterns, Android devices, and operating-system versions were unrestricted.The study included students or employees using personal Android smartphones or tablets.
  • Collection limitations: Battery constraints prevented tracking some modalities and reduced GPS sampling to once per minute on most devices.Excluded modalities included front-facing video, gyroscope, accelerometer, and touch gestures.
  • Dataset and modalities: The dataset tracks text, application usage, web browsing, and device location as four behavioral biometric modalities.TEXT events are keystrokes, APP events are app-focus changes, WEB events are URL entries, and LOCATION events are GPS or WiFi samples.
  • Dataset processing: Idle periods longer than five minutes were compressed for time-based cross-validation, producing timestamps called “active interaction.”The original event date and time were retained, while the timestamps used for training and testing were updated.
  • Dataset and modalities: Location data was relatively unique to individuals and generally stable from day to day outside occasional travel.The paper presents a Philadelphia GPS heatmap and interprets location as a measure of habitual behavior.

A. Features and Classifiers

The study extracts four behavioral modalities and maps their features into binary decisions, combining event probabilities across a fixed time window.

  • The four modalities are TEXT, APP, WEB, and LOCATION, representing keyboard text, applications, websites, and GPS/WiFi-derived physical location.
  • Each modality’s features are processed by classifiers that map observations into binary decision space.
  • The system constructs 800 classifiers: one for each of 200 users across four modalities, distinguishing valid-user data from the other 199 users.
  • For multiple events of one modality, classifier probabilities are fused across time using maximum likelihood over a fixed recent-event window.

1) Text:

Text activity is captured from keyboard interactions, while APP and WEB models represent usage through normalized frequency distributions over user-specific entities.

  • 1) Text:: Mobile text-entry activity commonly occurs in communication applications such as SMS, MMS, WhatsApp, Facebook, and Google Hangouts.
  • 1) Text:: TEXT events are captured as short bursts of touched keyboard keys rather than autocorrected message results.For SMS, the submitted result is also recorded, but keystroke data can include misspellings and erased words.
  • 2) App and Web:: APP and WEB classifiers count visits to apps or URL domains, treating subdomains such as m.facebook.com and www.facebook.com as distinct domains.
  • 2) App and Web:: For each user, the valid-class model uses the top 20 visited entities with normalized frequencies, while the invalid class counts those entities across the other 199 users.
  • 2) App and Web:: Table III summarizes top-20 apps by text-entry and visit frequency and top-20 websites by visit frequency to characterize dataset structure.

3) Location:

The fusion system combines local binary decisions from modality classifiers into a global decision using the Chair–Varshney rule, with thresholds calibrated in practice rather than fixed solely by priors.

  • B. Decision Fusion: Each local detector makes a binary decision from its own observations, and the fusion center combines these decisions to choose between H0 and H1.
  • B. Decision Fusion: The Chair–Varshney formulation combines local classifier decisions into a computationally efficient and scalable global fusion rule.The formulation is optimal when local detectors are fixed and observations are conditionally independent, making the resulting design suboptimal only because local detectors are fixed.
  • B. Decision Fusion: Fig. 3 shows modality-level decisions formed across classifiers and then fused into one global binary decision.
  • B. Decision Fusion: The fusion rule uses a likelihood-ratio decision with weights based on each classifier’s false rejection and false acceptance rates.
  • B. Decision Fusion: Because hypothesis priors are unavailable in practice, the threshold is determined using considerations such as fixing false-alarm or false-rejection probability.

A. Training, Characterization, Testing

Evaluation divides each user’s interaction history into five temporal folds and cycles training, characterization, and testing to estimate individual and fused-system performance.

  • A. Training, Characterization, Testing: Each user’s data is divided into five equal-size temporal folds, with three folds for training, one for characterization, and one for testing.
  • A. Training, Characterization, Testing: Characterization estimates FAR and FRR for the fusion algorithm, whereas testing evaluates individual classifiers and the fusion system.
  • A. Training, Characterization, Testing: The five experiments rotate which fold is used for testing while retaining three training folds and one characterization fold.The listed schedules cycle the testing fold through folds 1–5.
  • A. Training, Characterization, Testing: Fig. 4 depicts the three processing phases used to determine individual-classifier and fusion-system performance.
  • A. Training, Characterization, Testing: Performance is evaluated using averaged error rates across the five experiments.

B. Performance: Individual Classifiers

Individual classifiers generally become more accurate as the decision window grows, but modality firing patterns make longer windows less beneficial than expected. Location performs best despite sparse events, while text remains comparatively weak despite frequent input.

  • Decision-window definition: The “time before decision” measures the interval from the first activity event to the fusion system’s first authentication decision.Events older than the selected time window are disregarded, and windows without modality events add no error to the average.
  • Individual modality performance: Location achieves the lowest error rates, with FAR under 0.1 and FRR under 0.05, despite firing only 3.5 times per hour on average.The result indicates that a single GPS coordinate can be sufficient for correct user verification in this setting.
  • Individual modality performance: Text converges to FAR 0.16 and FRR 0.11 after 30 minutes despite firing 557.8 times per hour.At that window, the average text block contains 279 characters; these error rates improve on prior results using 500-character blocks.
  • Event-rate effects: Most modality events arrive in bursts followed by inactivity, so 1-, 10-, and 30-minute windows have similar event-count distributions.This burstiness explains why waiting longer does not reduce error as much as expected.
  • Fused performance: The fusion system’s EER decreases from 0.05 with a 1-minute window to below 0.01 with a 30-minute window.Its ROC curve represents the FAR–FRR tradeoff obtained by varying the decision threshold.

D. Contribution of Local Classifiers to Global Decision

The study measures each modality’s relative contribution by comparing fusion errors with and without that classifier. Location contributes most across all evaluated windows, while the ranking of other modalities depends on the window.

  • Contribution method: Relative contribution is computed by comparing the full four-classifier fusion error with the error after removing each local classifier.The analysis evaluates contributions at 1-, 10-, and 30-minute decision windows.
  • Contribution results: Location is the largest contributor at all three decision-window sizes, with web browsing the second largest.The relative contributions are computed for the four-classifier fusion system described in the study.
  • Contribution results: Text contributes least for the 1-minute window but contributes more at larger windows, while app usage is the least predictable contributor.The contribution ranking therefore changes with the available decision time.
  • Contribution results: The first app opened in a session is a strong and frequent identity indicator, explaining its high contribution under short decision windows.This explanation concerns the app modality’s short-window behavior.

VI. CONCLUSION

The paper presents parallel binary decision-level fusion for four mobile behavioral modalities and evaluates it on 200 Android users observed for at least 30 days. The system reaches 5% EER after one minute and 1% EER after 30 minutes, with location contributing most despite its low firing rate.

  • Approach: The proposed architecture performs parallel binary decision-level fusion across text, application usage, web browsing, and location modalities.It addresses active authentication on mobile devices.
  • Evaluation: The evaluation uses a real-world dataset of 200 subjects, each using a personal Android device for at least 30 days.The conclusion reports this dataset scope as the basis for performance characterization.
  • Results: 5% EER is achieved after 1 minute of interaction, decreasing to 1% after 30 minutes.The conclusion reports these as the system’s equal error rates at the two interaction durations.
  • Results: The location classifier contributes most to the fused decision despite having the lowest firing rate.The conclusion contrasts location’s sparse event availability with its leading contribution.
Loading 1503.08479v1…