DAKOTA: Sensor and Touch Screen-Based Continuous Authentication on a Mobile Banking Application

Abstract

Authenticating a user in the right way is essential to IT systems, where the risks are becoming more and more complex. Especially in the mobile world, banking applications are among the most delicate systems requiring strict rules and regulations. Existing approaches often require point-ofentry authentication accompanied by a one-time password as a second-factor authentication. However, this requires active participation of the user and there is continuous authentication during a session. In this paper, we investigate whether it is possible to continuously authenticate users via behavioral biometrics with a certain performance on a mobile banking application. A currently used mobile banking application in Turkey is chosen as the case, and we developed a continuous authentication scheme, named DAKOTA, on top of this application. The DAKOTA system records data from the touch screen and the motion sensors on the phone to monitor and model the user's behavioral patterns. Forty-five participants completed the predefined banking transactions. This data is used to train seven different classification algorithms. The results reveal that binary-SVM with RBF kernel reaches the lowest error scores, 3.5% equal error rate (EER). Using the end-to-end DAKOTA system, we investigate the performance in real-time, both in terms of authentication accuracy and resource usage. We show that it does not bring extra overhead in terms of power and memory usage compared to the original banking application and we can achieve a 90% true positive recognition rate, on average.

Few-Shot Continuous Authentication for Mobile-Based Biometrics

“…Touch-gesture authentication verifies users based on screen-touch behaviors, summarized by touch trajectory, device motion, and orientation. Prior works either utilize the screen touch coordinates, pressure, or motion sensor data captured by the accelerometer and gyroscope [10][11][12][13][14][15][24][25][26][27][28].…”

“…Most existing methods have relied on hand-crafted features such as length of trajectory, the median of finger pressure, etc [11][12][13][14][15][24][25][26][27][28]. This is mainly attributed to touch-gesture being sensitive to behavioral changes.…”

“…Continuous authentication is a promising way to provide an additional security layer for mobile devices, which monitors user identities implicitly through their behavioral biometrics using device built-in sensor data. [2][3][4][5][6][7][8][9][10][11][12][13][14][15].…”

“…Large intra-class variance of user behavior data Due to the significant intra-class variance of raw touch sensor data, most touchgesture authentication solutions adopt hand-crafted features and conventional machine learning models such as support vector machine, random forest, etc., which are noise-robust than learned features [11][12][13][14][23][24][25][26][27][28]. However, hand-crafted features lack refined feature information, making it hard to characterize delicate imposter patterns.…”

Evaluation of a User Authentication Schema Using Behavioral Biometrics and Machine Learning

“…The use of mobile devices has become an integral part of our everyday lives and because of this storing personal information on our devices has become commonplace. People now use their devices to hold passwords, store credit card numbers, perform mobile banking, and a myriad of other things involving personal information (Ackerson at al., 2021, Incel et al, 2021, Gunn et al, 2019, Mason et al, 2020. However, despite having all of this personal data on devices, the current security measures taken to protect this data are weak.…”