Cover Page PIN Authentication Using Multi-Model Anomaly Detection in Keystroke Dynamics on Mobile Devices التحقق من الرقم الشخصي باستخدام نموذج متعدد لكشف التباين في اسلوب الكتابة على المفاتيح على االجهزة المحمولة By Ghofran Mahmood Khalaf Supervisor Dr. Mudhafar Al-Jarrah A Thesis Submitted in Partial Fulfillment of the Requirements for the Master Degree in Computer Science Department of Computer Science Faculty of Information Technology Middle East University Jan. 2019 II Authorization III Thesis Committee Decision IV Acknowledgement (شيء بعد ٍ و ِم ْل َء ما ِشْئ َت ِمن،األرض ِ ِ ِملء السمو،) اللهم ربنا لك الحمد ات و ِم ْل َء َْ First and above all, I give special thanks, praise and glory to Almighty Allah for his mercy, and reconcile and for granting me knowledge, confidence, patience to pass this Master thesis successfully. I would like to express my profound thank to my thesis advisor.
Muthafar Al- Jarrah for suggesting this field of research work and continue working with full enthusiasm. I gratefully acknowledge his kindness, patience, encouragement, for the complete guidance throughout the thesis stages, and for the critical assistance in designing and proceeding the methodology of my research. In addition, I would like to express my deepest gratitude to all the respectable lecturers at the Faculty of Information Technology, Middle East University. I also appreciate the effort and time that the professors of the committee spend in reading and discussing the thesis.
The Researcher Ghofran Mahmood V بسم هللا الرحمن الرحيم ""وقل ربي زدني علما Dedication This thesis dedicated to my whole family; Especial thanks to my one and only my mother, who always proud of me and supported me in every step of my life, no words can describe what you have done for me, thank you for your endless love. My Father, who taught me to work hard for the things that I aspire to achieve. My Sisters and brother, who are one part of my life. My aunts, who support and love me.
My best friends, who always been there for me during difficult and stressful times, particularly, Renad Al-Manaseer. My friends Fatima and Russel, who support me with their precious words and love me, and I thank Allah for their presence in my life. My friends, who supported me with their nice words, who were the cause of my happiness during my last days at university, and who loved them and will stay in my heart. VI Table of Contents Title.
II Thesis Committee Decision. V Table of Contents. VI List of Abbreviations. VIII List of Tables.
IX List of Figures. XI Arabic Abstract. XII Chapter One .2 Background of the Study.4 Scope of Work.5 Limitations of the Research Work .6 Goal and Objectives .8 Significance of Work. 6 Background and Literature Review .6 Keystroke Dynamics Technology .7 Ensemble Models Concept .1 Simple Ensemble Techniques.2 Advanced Ensemble Techniques .9 Summary of Related Work.
23 Methodology and the Proposed Model .2 Outline of the Proposed Model .3 The Proposed Work .4 Anomaly Detector Models .1 Single Anomaly Detection Models .2 Multi-Model Anomaly Detectors .3 Template Calculation of the Single Anomaly Detectors .4 Score Calculation and Outcome of the Typed PIN .6 The Data Collection System. 34 Experimental Results and Discussion .2 Objectives of the Experimental Work .3 Feature Sets Selection .4 The Proposed (PIN Dynamics) System.5 Screen Shots of the Proposed (PIN Dynamics) System .6 EER Analysis Steps.7 Data Collection Using the Proposed (PIN Dynamics) System .8 Results and Discussion .9 Comparison with EER Results of the MOBIKEY data set. 48 Conclusion and Future Work .2 Suggestion for Future Work. 57 VIII List of Abbreviations Abbreviations Meaning AAD Average Absolute Deviation CSV Comma Separated Values EER Equal-Error-Rate FAR False-Acceptance-Rate FRR False-Rejection-Rate KSD Keystroke Dynamics MAD Median Absolute Deviation PIN Personal Identification Number STD Standard Deviation IX List of Tables Chapter No.
Contents Page No.1 Summary of the Review of Related Study 20 4.1 List of Primary and Secondary Feature Sets 35 4.2 EER Analysis Results Using Primary Features 43 4.3 EER Analysis Results Using Secondary Features 44 4.4 EER Analysis Results Using a Reduced Imposter Set 45 4.5 Summary of EER Results of the MOBKEY Data set 47 X List of Figures Chapter No. Contents Page No.3 Enter PIN Code Enrollment Screen 39 XI PIN Authentication Using Multi-Model Anomaly Detection in Keystroke Dynamics on Mobile Devices By: Ghofran Mahmood Khalaf Supervisor: Dr. Mudhafar Al-Jarrah Abstract The use of behavioral biometrics in user authentication has recently moved to new security application areas, one of which is verifying the Personal Identification Number (PIN). This thesis investigates the design of anomaly detectors and feature sets for PIN authentication on touch mobile devices.
The work involved a selection of raw data feature sets that are extracted from modern mobile devices, such as finger area, pressure, and timestamp. A set of primary and secondary authentication features have been formulated, which are calculated from the raw data features. The proposed anomaly detectors are based on the outlier concept, where an input PIN’s calculated feature element is classified as imposter value if it is outside an acceptable zone from a central value such as the mean or median of a set of training values. The Z-Score method is used as the distance function of the anomaly detectors, and three versions are investigated; the standard deviation-based Z-Score, the modified Z-Score which uses the Median-Absolute-Deviation (MAD) and the Average- Absolute-Deviation (AAD) Z-Score function.
Also, the three single models are combined into ensemble models. The proposed feature sets are implemented as a data collection system on a Nexus-9 Android tablet. Experimental work resulted in collecting a PIN dataset (PIN Dynamics) from 70 subjects, where the data included genuine and imposter PIN data. The raw data features data from the new dataset were converted to the proposed authentication primary and secondary features.
The authentication features dataset was analyzed by utilizing the three single anomaly detectors and the three ensemble anomaly detectors, using the Equal-Error-Rate (EER) metric. The results showed that the AAD Z-Score anomaly detector produced the lowest error rate among the single models, while the merged AAD and MAD ensemble model achieved the lowest overall error rate. The thesis ends with a conclusion and suggestion for future work. Keywords: PIN; Anomaly Detector; Z-Score; EER; MAD; AAD; Feature Set; Ensemble Model.يتم استخدام طريقة Z-Score كوظيفة المسافة للكشف عن الشذوذ ،ويتم التحقيق في ثالثة إصدارات؛ مقياس Z-Scoreالمعتمد على االنحراف المعياري ،المعدل Z-Scoreالذي يستخدم االنحراف المطلق ( )MADودالة Z-Score لالمتداد المطلق ( .نتج عن موضوعا ،حيث تضمنت ً العمل التجريبي جمع مجموعة بيانات ) PIN (PIN Dynamicsمن 07 البيانات بيانات PINحقيقية ونامية .)EERوأظهرت النتائج أن كاشف الشاذة AAD Z-Scoreأنتج أدنى معدل للخطأ بين النماذج المفردة ،في حين حقق نموذج AADو MADالمدمج أدنى معدل للخطأ الكلي . 1 Chapter One Introduction 1.1 Research Context This thesis deals with the problem of user authentication on mobile devices, using keystroke dynamics behavioral biometrics of the user on touch screens, through anomaly detection models and features to support the verification of Personal Identification Number (PIN) codes.2 Background of the Study The research explores different behavioral biometric approaches to increase the authentication security on mobile devices, using available sensor data on modern tablets and smartphones (mobile devices).
Several studies have addressed the issue of user authentication using the keystroke dynamics modality, based on various anomaly detection models and feature sets (Killourhy, 2012; Aljarrah2013; Al-Obaidi2016). Most of the reported experimental work utilized a common 12-character password that was proposed by Kilorhy and Maxion (2009), while Antal and Lehel Nemes (2016) considered alternative strong and easy passwords. The use of short passcodes such as the PIN code in security systems has been investigated due to the wide-spread utilization of 4-digit PIN codes in banks’ ATM and credit cards, on mobile devices, and in buildings access control systems. Problem Statement The problem addressed in this study is the strengthening of user authentication on mobile devices where an intruder has captured the PIN code.
The research investigates the use of the keystroke dynamics modality features on mobile devices, combined multi-model anomaly detection models, to improve the detection accuracy of the short 4-digit PIN code.4 Scope of Work The research proposes to examine anomaly detection models and features that can be utilized to enhance user authentication on touch / mobile devices, using a short numeric passcode, based on the keystroke dynamics approach. Alternative single models and ensemble models will be investigated, using alternative feature sets derived from PIN typing data.5 Limitations of the Research Work The main limitation of this research is that the proposed model and experimental work will be based on the Android platform. Further work will be needed for implementation on other mobile platforms such as IOS.6 Goal and Objectives The aim of this research is to improve the authentication of users on touch mobile devices using a short password approach, the 4-digit Personal Identification Number (PIN) and the keystroke dynamics approach. The following objectives are taken into consideration: 1.
Investigation of the set of biometric features that will be used in the user authentication process. Selection of alternative single anomaly detection models and model ensembles to enhance authentication. Implementation of the raw features data collection system as a tool on the Android operating system. Experimental work to collect the raw features data.
Evaluation of the proposed anomaly detection models and feature sets using the new datasets.7 Motivation The need for better authentication of users on technological systems such as mobile devices, banks ATM terminals, and buildings access control panels, continue to require higher dependability methods to prevent illegal access by impostors. Traditional PIN or password- based approaches have the limitation that secret codes can be elicited by various methods such as shoulder-surfing or video recording, therefore additional traits of a user are needed to be included in the authentication process.8 Significance of Work The expected significance of this work is in enhancing the security of mobile devices, and similar touch devices, by adopting new anomaly detection models and features, and utilizing available sensor data, without the need to add any special hardware. What are the single and multi-model anomaly detectors that will be used in the authentication process? 2. What are the new authentication features that will be used? 3.
Will increasing the number of biometric features result in better authentication? 4. Will combining several anomaly detectors as an ensemble result in better authentication? 5. What will be the error metrics that will be measured in the experimental study and what are the achieved error rates? 1.10 Thesis Organization This thesis is divided into five chapters: Chapter one: contains general concepts of this thesis which include the topic, background of the study, problem statement, scope of work, limitation of the proposed work, goal and objectives, motivation, the significance of work and questions to be answered. Chapter two: presents the literature review, concepts, and definitions which introduced the introduction, classification methods, biometric technologies, and related work.
Chapter three: presents the methodology and the proposed model, which introduced the methodology approach, the outline of the proposed model, methodology steps, features selection, the anomaly detector, the proposed system and error metrics. 5 Chapter four: presents experimental results and discussion, which introduced the introduction, objectives of the experimental work, EER analysis steps, feature sets selection, analysis of the (PIN Dynamics) dataset, the proposed system, data collection the proposed system and discussion of results. Chapter five: contains conclusions and future work. 6 Chapter Two Background and Literature Review 2.1 Background The last decades have witnessed an explosion of computing (i., mobile devices, the applications running on them, and the underlying infrastructure).
Mobile computing is a prime target of authentication fraud because the level of security in mobile devices is, in general, kept to the minimum not only by design but sometimes for the convenience of the users. While numerous protection schemes are available on these devices, many users view these protections as hindrances and tend to disable or bypass them.