Novelty Detection for Risk-based User Authentication on Mobile Devices

Abstract

User authentication acts as the first line of defense verifying the identity of a mobile user, often as a prerequisite to allow access to resources in a mobile device. For several decades, user authentication was based on the ''something the user knows'', known also as knowledge-based user authentication. Recent studies state that although knowledge-based user authentication has been the most popular for authenticating an individual, nowadays it is no more considered secure and convenient for the mobile user as it is imposing several limitations. These limitations stress the need for the development and implementation of more secure and usable user authentication methods. Toward this direction, user authentication based on the ''something the user is'' has caught the attention. This category includes authentication methods which make use of human physical characteristics (also referred to as physiological biometrics), or involuntary actions (also referred to as behavioral biometrics). In particular, risk-based user authentication based on behavioral biometrics appears to have the potential to increase mobile authentication security without sacrificing usability. In this context, we, firstly, present an overview of user authentication on mobile devices and discuss risk-based user authentication for mobile devices as a suitable approach to deal with the security vs. usability challenge. Afterwards, a set of novelty detection algorithms for risk estimation is tested and evaluated to identify the most appropriate ones for risk-based user authentication on mobile devices.

A Survey on Quantitative Risk Estimation Approaches for Secure and Usable User Authentication on Smartphones

“…To the best of authors’ knowledge, this was the first time that novelty detection algorithms have been considered for risk-based user authentication. The findings in [ 48 , 52 ] highlighted the advantages of one-class novelty detection algorithms, presented in detail in Section 3.2.3 , over popular machine learning classifiers for risk-based user authentication.…”

“…In particular, risk-based user authentication, relying on behavioral biometrics, normally involves single-user smartphone devices where it is necessary to differentiate between a known legitimate user and an unknown malicious user [ 52 ]. In this context, novelty detection algorithms, also known as one-class classifiers [ 54 , 55 , 56 ], have gained interest among researchers due to their potential advantages in user authentication based on behavioral biometrics.…”

Outlier Detection for Risk-Based User Authentication on Mobile Devices

“…Nevertheless, traditional password-based user authentication methods are no longer considered secure or practical for mobile users [5]- [8]. These methods authenticate anyone who possesses the correct credentials, regardless of whether they are the legitimate users or not [9]- [11]. Additionally, mobile users often struggle to remember complex passwords, resulting in weak passwords that are easily guessed or stolen through various attacks such as shoulder-surfing, dictionary or guessing attacks [12].…”