PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Behavioral Biometric Authentication on Smartphones

Ahmed Mahfouz, Tarek M. Mahmoud, Ahmed Sharaf Eldin

arXiv:1801.09308v1cs.CR

TL;DR

Smartphones’ sensitive data and weaknesses in traditional and biometric authentication motivate interest in behavioral authentication. This paper surveys active authentication systems, their traits and evaluations, and their strengths, limitations, and open challenges.

  • Problem

    Smartphones contain sensitive information, while traditional and biometric authentication mechanisms have weaknesses.

    Source: §1 · p. 1

  • Method

    The paper surveys active authentication systems, covering their components, operating process, evaluation metrics, behavioral traits, and comparisons.

    Source: §1 · p. 1, §3.4 · p. 5

  • Results

    The survey reviews behavioral traits and smartphone evaluations, compares their strengths and limitations, and identifies challenges and open research problems.

    Source: §1 · p. 1

  • Takeaways & Limitations

    The paper identifies challenges, open research problems, and recommendations for behavioral biometric authentication research.

    Source: §1 · p. 1

    A major weakness in many proposed systems is the lack of real-world datasets, making systematic studies with more users important for evaluation.

    Source: §8 · p. 13

Abstract

from arXiv · show

Recent research has shown the possibility of using smartphones' sensors and accessories to extract some behavioral attributes such as touch dynamics, keystroke dynamics and gait recognition. These attributes are known as behavioral biometrics and could be used to verify or identify users implicitly and continuously on smartphones. The authentication systems that have been built based on these behavioral biometric traits are known as active or continuous authentication systems. This paper provides a review of the active authentication systems. We present the components and the operating process of the active authentication systems in general, followed by an overview of the state-of-the-art behavioral biometric traits that used to develop an active authentication systems and their evaluation on smartphones. We discuss the issues, strengths and limitations that associated with each behavioral biometric trait. Also, we introduce a comparative summary between them. Finally, challenges and open research problems are presented in this research field.

1. Introduction

Smartphones hold sensitive information and attract attackers, while traditional and biometric authentication mechanisms have weaknesses. The paper surveys behavioral active authentication on smartphones, covering system operation, biometric traits, evaluation, and research challenges.

1. Introduction

  • Smartphones’ sensors and services make them useful to users but also draw attackers seeking access to sensitive and private data.The paper distinguishes insider attackers, who know the user, from strangers who do not.Source: §1 · p. 1
  • Behavioral authentication based on traits such as gesture, keystroke, and gait is presented as an alternative to traditional and biometric mechanisms with weaknesses.These systems are also called active or continuous authentication mechanisms.Source: §1 · p. 1
  • The paper surveys smartphone active authentication systems, their behavioral traits and evaluations, associated strengths and limitations, and comparative findings.It also identifies challenges, open research problems, and recommendations for the field.Source: §1 · p. 1
  • The review introduces smartphone sensors, services, and devices that could support person recognition using physiological or behavioral traits.The paper then outlines the sections on authentication systems, trait selection and design, behavioral traits, and limitations and challenges.Source: §1 · pp. 1–2, Figure 1 · p. 2

2. Adversary Attacks

The paper frames adversary attacks as attempts to gain physical access to a victim’s device for snooping or data destruction. It distinguishes insiders, who know the user, from strangers, who do not.

2. Adversary Attacks

  • Attackers seek physical access to a victim’s device for snooping or data destruction.Source: §2 · p. 2
  • Insiders are friends or family who know the user and may gain unauthorized access through their proximity.A cited study found traditional device authentication and Facebook account security measures ineffective against social insider attacks.Source: §2 · p. 2
  • Strangers do not know the victim and may steal or find the victim’s device.Source: §2 · p. 2

3. The Active Authentication

Active authentication verifies or identifies users through biometric information, with behavioral mechanisms surveyed here. The section explains its operation, modes, and evaluation metrics.

3.1. What is an active authentication system?

  • Continuous, background verification distinguishes active authentication from traditional authentication and is the focus of this survey’s behavioral mechanisms.The system repeatedly authenticates while the user uses the smartphone, without requiring intervention.Source: §3.1 · pp. 2–3

3.2. How does the active authentication system work?

  • Enrollment builds feature templates from acquired and analyzed biometric data; recognition extracts new features and compares them with stored templates.The system’s modules cover data acquisition, preprocessing and feature extraction, template storage, and matching with a decision.Source: §3.2 · p. 3

3.3. Modes of operation

  • Active authentication can operate in verification or identification mode, depending on the recognition context.Verification compares one claimed identity with its template, while identification compares a sample against all stored user templates.Source: §3.3 · p. 3, §3.3.1 · p. 3, §3.3.2 · p. 4

3.3.1. Verification mode

  • Verification is one-to-one matching: a classifier score above threshold α accepts the claimed identity; otherwise, the system rejects it as an imposter.The score p(ui) is the authentication score for user ui, and α is a predefined threshold in (0, 1).Source: §3.3.1 · pp. 3–4

3.3.2. Identification mode

  • Identification is one-to-many matching: the system compares a sample with all user templates and selects the highest score subject to a threshold.Source: §3.3.2 · p. 4

3.4. Performance metrics

  • Evaluation choice depends on whether testing compares algorithms on fixed data, tests a system with real subjects, or measures it in real time in a specific application.The metrics discussion assumes a single-user mobile device and binary classification between the legitimate user and an imposter.Source: §3.4 · p. 4
  • ROC curves plot TAR against FAR across thresholds, while AUC summarizes model quality and remains useful under class imbalance.EER is where genuine and imposter error rates are equal; lower EER indicates better performance.Source: Figure 3 · p. 4, §3.4 · p. 5

4. The Selection of The Biometric Trait

Trait suitability depends on the application context and can be assessed through seven stated factors.

4. The Selection of The Biometric Trait

  • Universality, uniqueness, and permanence assess whether a trait is available across users, discriminates between users, and remains durable over time.Source: §4 · p. 5
  • Collectability and performance concern how easily a trait is measured and whether its accuracy is robust in the intended environment.Source: §4 · p. 5
  • Acceptability and circumvention address user willingness to present a trait and its susceptibility to spoofing or other attacks.Source: §4 · p. 5

5. Design Factors

Mobile biometric-system design is shaped by user behavior, deployment conditions, and template reuse across applications.

5. Design Factors

  • User cooperation distinguishes users who interact as intended from those who do not perform the biometric trait as expected.Source: §5 · p. 5
  • Deployment control and user awareness capture whether the environment is indoor, outdoor, or mixed and whether users know biometric recognition is occurring.Source: §5 · p. 5
  • Habituation concerns prior experience with the biometric system, while open versus closed design concerns whether templates can be reused across applications.Source: §5 · p. 5

6. Common Behavioral Biometric Traits

Behavioral biometric traits are characteristics acquired from user actions and are reviewed as inputs to smartphone active-authentication systems.

6. Common Behavioral Biometric Traits

  • Touch gestures are one example of user actions from which behavioral biometric traits can be acquired.Source: §6 · p. 6
  • Keystroke dynamics are another behavioral biometric trait included in the review of smartphone active-authentication systems.Source: §6 · p. 6
  • Behavioral profiling is also identified as a trait reviewed for designing active-authentication systems on smartphones.Source: §6 · p. 6

6.1. Gesture based authentication

Gesture-based authentication treats a user's touch patterns as a behavioral trait for continuous, background identity checks. The surveyed systems acquire touch data, extract distinguishing features, and evaluate them with different datasets and classifiers.

6.1. Gesture based authentication

  • Touch gestures are hand-drawn shapes made of one or more strokes, captured as timed coordinate points from smartphone touchscreens at the application or operating-system level.The review distinguishes touch mechanics from touch activities; gesture parameters such as size, length, speed, pressure, and direction can vary between users.Source: §6.1 · p. 6, §6.1.1 · p. 6

6.1.1. Data collection

  • Touch data is collected from the touchscreen, and systems assume gesture parameters reflect user behavior; Android was the most commonly used acquisition platform.Gesture authentication offers continuous re-authentication during phone use and background collection, but most studies used 50 or fewer participants and controlled lab datasets.Source: §6.1.1 · p. 6

6.1.2. Feature extraction

  • Gesture features include timing, spatial properties such as position and pressure, touch dynamics, and geometric relationships among points, lines, curves, and strokes.Temporal features can use the interval between touch-down and touch-up timestamps.Source: §6.1.2 · pp. 6–7

6.1.3. Evaluation

  • Evaluations mainly use verification; most reported gesture systems achieve EER values below 10%, though dataset size, classifier, operating mode, and metric vary.The review notes that larger datasets, including millions of samples, would make evaluation more realistic; some studies instead report AUC, FRR, or FAR.Source: §6.1.3 · pp. 7–8

6.2. Keystroke dynamics

The survey reviews smartphone keystroke authentication, including how typing data is collected, which features are extracted, and how systems are evaluated. Reported results vary across methods and settings, including a field study using unconstrained typing.

6.2.1. Data collection

  • Most studies collected keystrokes from predefined text; Draffin et al. instead gathered 86,000 keypresses from 13 users over three weeks in an unconstrained field study.Structured tasks included passwords, messages, or specified sentences; Buschek et al. used two sessions at least a week apart.Source: §6.2.1 · pp. 8–9
  • Keystroke dynamics can support continuous, implicit re-authentication while users type on the virtual keyboard, with acquisition and processing in the background.The review contrasts verification, used in most studies, with the less common identification evaluations.Source: §6.2.1 · p. 9, §6.2.3 · p. 9

6.2.2. Extracted features

  • Common keystroke features are keypress duration and latency, alongside spatial properties such as press position, area, pressure, and size.Duration is the time between pressing and releasing a key; latency is the interval from the previous key's release to the current key's press.Source: §6.2.2 · p. 9

6.2.3. Evaluation

  • Buschek et al. reduced EER by 26.4 - 36.8%, while unconstrained Draffin et al. reported 67.7% detection on 15-keypress sessions.Trojahn et al. reported best FAR and FRR of 2.03% and 2.67%; Feng et al. reported best FAR of 8.93% and best FRR of 0.27%; Clarke et al. reported average EER of 12.8%.Source: §6.2.3 · pp. 9–10

6.3. Behavioral profiling

Behavioral profiling authenticates users by comparing activity profiles built from mobile-sensor and service interactions. The surveyed studies use varied data sources and collection designs, with continuous, transparent authentication balanced by inconsistent performance during unusual phone use.

6.3. Behavioral profiling

  • The review describes behavioral profiling as comparing current activity with a user profile built over time from interactions with mobile sensors and services.Earlier approaches used network activity, application usage, and location; recent techniques also describe data collection, feature extraction, and evaluation.Source: §6.3 · p. 10

6.3.1. Data collection

  • Li et al. report FRR of 11.45% and FAR of 4.17% overall on the MIT Reality dataset, which includes 100 users’ sensor profiles collected over nine months.The dataset includes call logs, nearby Bluetooth devices, cell-tower IDs, and application usage.Source: §6.3.1 · p. 10
  • Kayacik et al. [33] compared current and stored profiles across GCU, Rice Livelab, and MIT Reality datasets, whose collection settings and durations differed.The GCU data came from Android devices; Rice Livelab used iPhone 3GS devices and included application use, WiFi, cell towers, GPS, battery, and accelerometer data.Source: §6.3.1 · p. 10
  • Shi et al. retained data from 50 of 276 app downloaders who used the collection app for at least 12 days, evaluating legitimate-user use before failure and adversary use before detection.The dataset contains SMS, phone calls, browser history, and location.Source: §6.3.1 · p. 10
  • Table 3 summarizes behavioral-profiling methods by participant count, dataset status, feature count, classifier, and best reported result.Source: Table 3 · p. 11
  • Gupta et al. report Precision:85 and Recall:91 for a prototype using GPS traces and regular WiFi and Bluetooth scans to identify contexts of interest.Their dataset was collected with a large-scale data collection tool.Source: §6.3.1 · p. 11
  • Bassu et al. combine app use, location and movement pace, clock time, and gesture or input-output interactions as what, where, when, and how features, then classify with a Bayesian model.The features use spatial and temporal analysis.Source: §6.3.1 · p. 11

6.3. Behavioral profiling

  • Behavioral profiling can authenticate continuously and transparently from profile sensor data, but performance may be inconsistent when users interact with phones unusually.The profile compares a user’s current activity with an established profile using machine-learning approaches.Source: §6.3 · p. 10, §6.3.1 · p. 11

6.4. Gait recognition

Gait authentication identifies users from their walking patterns using smartphone inertial sensors. The surveyed methods range from controlled walking trials to daily, unconstrained motion collection, and report varied verification outcomes.

6.4. Gait recognition

  • Gait systems use walking patterns captured by smartphone accelerometers and gyroscopes; these inertial sensors are described as non-contact and nonobtrusive and could support methods resistant to spoofing attacks.Source: §6.4 · pp. 11–12
  • Juefei-Xu et al. report a 99.4% verification rate at 0.1% FAR for normal-to-normal pace using phone gyroscope data and Continuous Wavelet Transform features.The study used data from 36 subjects walking 50.5 meters.Source: §6.4 · p. 11
  • Mantyjarvi et al. achieved a best EER of 7% with signal correlation, while Derawi et al. achieved EER 20% using a mobile-device accelerometer.The former collected data with a body-worn 3-D accelerometer; the latter used 51 subjects and a 37-meter walking dataset.Source: §6.4 · p. 11
  • Table 4 organizes gait methods by participant count, dataset status, operating system, motion sensors, and best reported result.Source: Table 4 · p. 12
  • Hoang et al. report zero FAR with approximately 16.18% FRR for a system that verifies a stored key biometrically encrypted by gait templates from a mobile accelerometer.Their dataset included 38 participants using Google Nexus One devices.Source: §6.4 · p. 12
  • Neverova et al. collected unconstrained daily motion data from approximately 1,500 volunteers using accelerometer, gyroscope, and magnetometer sensors, and report that human kinematics convey information about user identity.The accelerometer and gyroscope sampled at 200 Hz, and the magnetometer at 5 Hz.Source: §6.4 · p. 12

7. Fusing Different Biometric Traits

The paper describes combining behavioral biometric traits at several stages, from raw sensor data to classifier decisions. For decision-level fusion, local decisions are combined by plurality voting.

7. Fusing Different Biometric Traits

  • Fusion can combine raw sensor data, feature vectors, modality matching scores, or decisions from multiple classifiers.These are sensor-level, feature-level, score-level, and decision-level fusion, respectively.Source: §7 · p. 12
  • Decision-level fusion combines local decisions from multiple behavioral traits by majority voting to predict the final decision.Figure 6 illustrates gesture, keystroke, and behavioral-profiling decisions.Source: §7 · pp. 12–13
  • For authentication, the decision classes are accept or reject, and the number of local decisions corresponds to the number of modalities being fused.Source: §7 · p. 13

8. Limitations and Challenges

The paper identifies measurement and user-behavior challenges for active authentication, alongside open needs in adaptation, data, usability, and resource efficiency. It notes that its survey covers a representative subset rather than all literature.

8. Limitations and Challenges

  • Active authentication faces noisy sensor measurements, non-universality, intra-class variation, limited uniqueness, and vulnerabilities including spoofing and robot attacks.The paper cites Lego-driven robotic attacks on touch-based authentication.Source: §8 · p. 13
  • The review covers a representative subset of the literature, and calls for greater accuracy, domain adaptation as user characteristics change, and improved feature extraction and selection.Source: §8 · p. 13
  • The paper identifies a shortage of real-world and public datasets, noting that most proposed systems use datasets with only hundreds of samples.It also calls for systematic user studies with more participants.Source: §8 · p. 13
  • Usability and computation cost remain design challenges because smartphone capabilities are lower than desktop systems, so system complexity should be considered.Source: §8 · p. 13
Loading 1801.09308v1…