Behavioural Biometrics for Continuous Mobile Authentication: A Synthesis of Modalities, Models, and Deployment Challenges
Keywords:
behavioral biometrics; continuous authentication; keystroke dynamics; touch dynamics; gait recognition; sensor fusion; deep learning; equal error rate; mobile security; usable privacy; adversary modeling; multimodal fusionAbstract
Complementing traditional point of entry mobile authentication, behavioural biometrics is a newer authentication technology that allows for passive, continuous verification of users through touch gestures, keystroke rhythm, motion sensors and application-usage patterns. This paper attempts to summarise the results of 31 papers published from 2013 to 2024, which describe modalities, algorithmic approaches, performance metrics, and deployment constraints of continuous mobile authentication. The touch and keystroke-based system is demonstrated to achieve equal error rates (EER) between 4 and 15 per cent when tested separately, while the motion-based gait recognition system based on a convolutional architecture is demonstrated to achieve EER under 5 per cent. It is shown that the single-modality behaviour channels suffer from noise and intra-user variability, and that multimodal fusion, at both the feature and score level, can reduce the EER to around three to four per cent and increase reported classification accuracy over ninety-seven per cent. Deep learning models, which are based on long short-term memory networks and convolutional neural networks, consistently outperform traditional classifiers, such as support vector machines and random forests, by a few percentage points with higher computational and energy demands. Adversary modelling shows that mimicry, sensor-replay, and video-based imitation attacks are only partially addressed, and empirical adoption research shows that perceived usefulness (β = 0.62) and perceived security (β = 0.58) are the most important factors affecting user acceptance, while privacy concern has a strong negative impact (β = −0.41). The results show that hybrid, privacy-preserving and computationally efficient fusion architectures are the most promising direction to realize large scale deployment of continuous mobile authentication.
Downloads
References
M. Abuhamad, A. Abusnaina, D. Nyang, and D. Mohaisen, "Sensor-based continuous authentication of smartphones' users using behavioral biometrics: A contemporary survey," IEEE Internet of Things J., vol. 8, no. 1, pp. 65–84, 2021.
A. Acien, A. Morales, J. V. Monaco, R. Vera-Rodriguez, and J. Fierrez, "TypeNet: Deep learning keystroke biometrics," IEEE Trans. Biometrics, Behavior, Identity Sci., vol. 4, no. 1, pp. 57–70, 2021.
J. Al-Saraireh and M. R. AlJa'afreh, "Keystroke and swipe biometrics fusion to enhance smartphones authentication," Comput. Secur., vol. 125, art. 103022, 2023.
M. Antal, Z. Bokor, and L. Z. Szabó, "Information revealed from scrolling interactions on mobile devices," Pattern Recognit. Lett., vol. 56, pp. 7–13, 2015.
L. Aversano, M. L. Bernardi, M. Cimitile, and R. Pecori, "Continuous authentication using deep neural networks ensemble on keystroke dynamics," PeerJ Comput. Sci., vol. 7, art. e525, 2021.
A. Buriro, B. Crispo, and M. Conti, "AnswerAuth: A bimodal behavioral biometric-based user authentication scheme for smartphones," J. Inf. Secur. Appl., vol. 44, pp. 89–103, 2019.
D. Buschek, A. De Luca, and F. Alt, "Improving accuracy, applicability and usability of keystroke biometrics on mobile touchscreen devices," in Proc. 33rd Annu. ACM CHI Conf., 2015, pp. 1393–1402.
L. de-Marcos, J.-J. Martínez-Herráiz, J. Junquera-Sánchez, C. Cilleruelo, and C. Pages-Arévalo, "Comparing machine learning classifiers for continuous authentication on mobile devices by keystroke dynamics," Electronics, vol. 10, no. 14, art. 1622, 2021.
E. Ellavarason, R. Guest, F. Deravi, R. Sanchez-Riello, and B. Corsetti, "Touch-dynamics based behavioural biometrics on mobile devices—A review from a usability and performance perspective," ACM Comput. Surv., vol. 53, no. 6, pp. 1–36, 2020.
M. Frank, R. Biedert, E. Ma, I. Martinovic, and D. Song, "Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication," IEEE Trans. Inf. Forensics Security, vol. 8, no. 1, pp. 136–148, 2013.
M. Gadaleta and M. Rossi, "IDNet: Smartphone-based gait recognition with convolutional neural networks," Pattern Recognit., vol. 74, pp. 25–37, 2018.
G. Giorgi, A. Saracino, and F. Martinelli, "Using recurrent neural networks for continuous authentication through gait analysis," Pattern Recognit. Lett., vol. 147, pp. 157–163, 2021.
L. Hernández-Álvarez, J. M. de Fuentes, L. González-Manzano, and L. H. Encinas, "SmartCAMPP—Smartphone-based continuous authentication leveraging motion sensors with privacy preservation," Pattern Recognit. Lett., vol. 147, pp. 189–196, 2021.
R. Kumar, V. V. Phoha, and A. Serwadda, "Continuous authentication of smartphone users by fusing typing, swiping, and phone movement patterns," in Proc. IEEE 8th Int. Conf. Biometrics Theory, Appl., Syst. (BTAS), 2016, pp. 1–8.
A. Mahfouz, T. M. Mahmoud, and A. S. Eldin, "A survey on behavioral biometric authentication on smartphones," J. Inf. Secur. Appl., vol. 37, pp. 28–37, 2017.
J. Mallet, L. Pryor, R. Dave, N. Seliya, M. Vanamala, and E. Sowells-Boone, "Hold on and swipe: A touch-movement based continuous authentication schema based on machine learning," in Proc. Asia Conf. Algorithms, Comput., Mach. Learn. (CACML), 2022, pp. 442–447.
R. Mayrhofer and S. Sigg, "Adversary models for mobile device authentication," ACM Comput. Surv., vol. 54, no. 9, pp. 1–35, 2021.
S. Mekruksavanich and A. Jitpattanakul, "Deep learning approaches for continuous authentication based on activity patterns using mobile sensing," Sensors, vol. 21, no. 22, art. 7519, 2021.
V. M. Patel, R. Chellappa, D. Chandra, and B. Barbello, "Continuous user authentication on mobile devices: Recent progress and remaining challenges," IEEE Signal Process. Mag., vol. 33, no. 4, pp. 49–61, 2016.
S. Roy, J. Pradhan, D. R. D. Adhikary, U. Roy, D. Sinha, and R. K. Pal, "A systematic literature review on latest keystroke dynamics-based models," IEEE Access, vol. 10, pp. 92192–92236, 2022.
C. Shen, Y. Zhang, X. Guan, and R. A. Maxion, "Performance analysis of touch-interaction behavior for active smartphone authentication," IEEE Trans. Inf. Forensics Security, vol. 11, no. 3, pp. 498–513, 2016.
Z. Sitová et al., "HMOG: New behavioral biometric features for continuous authentication of smartphone users," IEEE Trans. Inf. Forensics Security, vol. 11, no. 5, pp. 877–892, 2016.
I. Stylios, S. Chatzis, O. Thanou, and S. Kokolakis, "Continuous authentication with feature-level fusion of touch gestures and keystroke dynamics to solve security and usability issues," Comput. Secur., vol. 132, art. 103363, 2023.
I. Stylios, S. Kokolakis, O. Thanou, and S. Chatzis, "Behavioral biometrics & continuous user authentication on mobile devices: A survey," Inf. Fusion, vol. 66, pp. 76–99, 2021.
I. Stylios, S. Kokolakis, O. Thanou, and S. Chatzis, "Key factors driving the adoption of behavioral biometrics and continuous authentication technology: Empirical research," Inf. Comput. Secur., vol. 30, no. 4, pp. 562–582, 2022.
Z. Syed, J. Helmick, S. Banerjee, and B. Cukic, "Touch gesture-based authentication on mobile devices: The effects of user posture, device size, configuration, and inter-session variability," J. Syst. Softw., vol. 149, pp. 158–173, 2019.
P. S. Teh, N. Zhang, A. B. J. Teoh, and K. Chen, "A survey on touch dynamics authentication in mobile devices," Comput. Secur., vol. 59, pp. 210–235, 2016.
H. C. Volaka, G. Alptekin, O. E. Basar, M. Isbilen, and O. D. Incel, "Towards continuous authentication on mobile phones using deep learning models," Procedia Comput. Sci., vol. 155, pp. 177–184, 2019.
Y. Yang, B. Guo, Z. Wang, M. Li, Z. Yu, and X. Zhou, "BehaveSense: Continuous authentication for security-sensitive mobile apps using behavioral biometrics," Ad Hoc Netw., vol. 84, pp. 9–18, 2019.
M. Yao, D. Tao, R. Gao, J. Wang, S. Helal, and S. Mao, "PressAFE: Barometer-based on-screen pressure assisted implicit authentication for smartphones," IEEE Internet of Things J., vol. 10, no. 1, pp. 1–17, 2023.
T. Zhu, Z. Weng, G. Chen, and L. Fu, "A hybrid deep learning system for real-world mobile user authentication using motion sensors," Sensors, vol. 20, no. 14, art. 3876, 2020.
Downloads
Published
How to Cite
Issue
Section
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
All papers should be submitted electronically. All submitted manuscripts must be original work that is not under submission at another journal or under consideration for publication in another form, such as a monograph or chapter of a book. Authors of submitted papers are obligated not to submit their paper for publication elsewhere until an editorial decision is rendered on their submission. Further, authors of accepted papers are prohibited from publishing the results in other publications that appear before the paper is published in the Journal unless they receive approval for doing so from the Editor-In-Chief.
IJISAE open access articles are licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. This license lets the audience to give appropriate credit, provide a link to the license, and indicate if changes were made and if they remix, transform, or build upon the material, they must distribute contributions under the same license as the original.
