1. Biometric Identity Misrepresentation Risk in Transactional Processes
Bojan Cukic, Emanuela Marasco
Department of Computer Science
UNCC
February 2017

2. Problem

3. Problem (2) Biometric misrepresentation risk is difficult to estimate.
We cannot know how often if occurs in unsupervised settings! 1 2 3

4. Work Elsewhere
State-of-the-art commercial systems vulnerable to replays
50 subjects, 100 replayed videos from different locations
Fingerprint liveness detection is improving (LiveDet 2015 results)
Iris spoof detection is work in progress

5. Our Approach
We understand vulnerabilities and state-of-the-art defense
Develop an application specific risk assessment approach which includes the analysis of
Impact (of identity misrepresentation attacks)
Adversary motivations
Adversary resources
Adversary methods
Create a risk assessment framework
A data analytics study of fraudulent identification or “suspect” authentication attempts.

6. Research Plan Establish collaboration with an industry affiliate.
Analyze use cases of specific 2FA system that includes biometric authentication.
Develop risk model using applied Security Cards methodology ( )
Analyze patterns of biometric match and quality scores related to the biometric system in use. Develop anomaly detection (possible fraudulent transactions). Include findings into risk assessment.
FaceVacs Similarity Score Comparison
FaceVacs Imposter Score Comparison
FaceVacs Genuine Score Comparison

7. Existing funding, Prior IP
Currently funded project: “A Systematic process for Vulnerability Assessment of Biometric Systems at Borders”
Funded through the DHS Academic Center of Excellence on Borders, Trade and Immigration (BTI Institute)
Assessment of risk related to identity fraud by traveler, immigrant and refugee populations.
Major difference: Biometric collection at DHS is supervised, most transactions are unsupervised.
No prior IP

8. I/UCRC Affiliate Benefits
(Financial) Transaction fraud is a serious threat.
Mobile transactions rely on secure authentication. When attack evidence is lacking, fraud becomes “invisible”.
Accurate risk estimation is the first step towards risk mitigation and reduction.
Better understanding of fraud patterns leads to improved trust and lower overhead cost per transaction.