Login session using mouse biometrics A static authentication proposal using mouse biometrics Christopher Johnsrud Fullu 2008

Presentation outline Biometrics? Problem description Experiment setup Data analysis and distance measurements Results Conclusions Further work

Biometrics – What? There are three ways of authenticating someone: – By something the person know – By something the person have – By something the person is A biometric is something a person is

Biometrics - Why? Hard to mimic unique features about a person Passwords are subject to shoulder hacking. People can forget passwords Key cards / dongles can be stolen

Biometrics – How?

Biometrics – Performance? Performance of biometric systems are measured using false positives and false negatives The difference is measured between templates and the data submitted for verification. This is the distance between users. Same users should have low distance Different users should have high distance

Problem description Using any computer mouse as authentication tool (except mouse pads or ball mouse's) Design tasks to capture mouse data Preprocessing / feature extraction Measure the distance between users (distance metrics)

Motivation It is cheap Most people have one Not threatening Alternative to passwords, do not have to remember Previous project performed showed potential to go further

Research questions What data to collect and how to analyze it? What features should be extracted and how should they be compared? Is mouse authentication a good technique alone?

Experiment setup Experiment performed with 46 participants Program with two tasks written in java to support today's major operating systems and platforms Tasks: Labyrinth and connect-the-dots

Experiment setup – Program (Labyrinth)

Experiment setup – Program (Connect-the-dots)

Experiment setup - Practical Participants performed a total of 30 session over a period of 1-2 week(s). During this period the sessions were split into 5 sessions over 6 different days. Users may become very used to doing the same tasks over and over.

Data - Filtering Program collects position data (X, Y) of mouse pointer at given time and stores. Data sampled every 10 ms. Raw data filtered with Moving Average Filter or Weighted Moving Average. Remove noise.

Data - Feature extraction Focused on labyrinth Velocity data calculated after filtering Horizontal and vertical tracks (movement) were classified Tracks extracted form velocity data and variance calculated in opposite axis

Data – Distance measurements Edit distance / Levenshtein distance used Include distance on variance Distance metrics proposed: – Applying edit distance to filtered velocity data – Analyzing tracks using edit distance – Analyzing tracks using edit distance and optionally involving variance as penalty

Results – edit distance to filtered velocity data

Results – Tracks with variance This distance metric uses the distance of the variance as a penalty First the edit distance between the tracks in the same alignment (vertical or horizontal) are calculated. This is then multiplied with the Euclidean distance of the variance in the opposite axis.

Results – Tracks with variance

Results – Tracks with penalty This metric calculates the edit distance for the tracks in the same alignment. Then a the ratio between the variances in the opposite axis is calculated. This is supplied to a function that decides the penalty factor.

Results – Tracks with variance

Conclusions Mouse authentication shows potential and should be further researched Feature extraction should be further researched Results show that using the techniques presented here is not adequate to use mouse authentication as a stand alone system

Further work Further research into features Distance metrics that uses these features How to analyze random data as produced by the connects-the-dots task Other data collection tasks