Security Aspects of Behavioral Biometrics for Strong User Authentication

Jancok, Vladimir; Ries, Michal

doi:10.1145/3546118.3546152

Cited by 4 publications

(4 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, implementing biometric authentication can be complex and may not work for all users. Factors such as hardware requirements, accuracy, and user acceptance must be considered when implementing biometrics in online banking systems [58]- [60].…”

Section: ) Bba Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Online Banking User Authentication Methods: A Systematic Literature Review

Karim,

Khashan,

Kanaker

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Online banking has become increasingly popular in recent years, making it a target for cyberattacks. Banks have implemented various user authentication methods to protect their customers' online accounts. This paper reviews the state-of-the-art user authentication methods used in online banking and potential cyber threats. This paper starts by exploring different user authentication methods, such as knowledge-based authentication (KBA), biometrics-based authentication (BBA), possession-based authentication (PBA), and other methods. The advantages and disadvantages of each user authentication method are then discussed. Furthermore, the paper discusses the various cyber threats that can compromise user authentication for online banking systems, such as malware attacks, social engineering, phishing attacks, man-in-the-middle (MiTM) attacks, denial of service (DoS) attacks, session hijacking, weak passwords, keyloggers, SQL injection, and replay attacks. Also, the paper explores the user authentication methods used by popular banks, which can provide insights into best practices for safeguarding online banking accounts and future user authentication methods in online banking and cyber threats. It states that the increasing use of BBA, two-factor authentication (2FA), and multi-factor authentication (MFA) will help improve the security of online banking systems. However, the paper also warns that new cyber challenges will emerge, and banks need to be vigilant in protecting their customers' online banking accounts.

show abstract

Section: ) Bba Methodsmentioning

confidence: 99%

“…[50], [58], [81], [83], [84] Behavioral Authentication (e.g., Voice pattern, Keystroke) -It might not work for all users, and it might not be simple to implement. -Over time, changes in user behavior may also have an impact.…”

Section: Pinmentioning

confidence: 99%

Online Banking User Authentication Methods: A Systematic Literature Review

Karim,

Khashan,

Kanaker

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Wiefling et al consider the privacy of RBA systems [44] and re-authentication [43]. Several authors focus on the evaluation of fingerprinting and behavioral biometrics for RBA [19,30,34,35], whereas Misbahuddin et al [25] design a risk engine. Rivera et al [33] study the detection of user authentication attacks involving network tunneling geolocation deception, Papaioannou et al [26] estimate the risk in the use case of mobile passenger ID devices, and Wiefling et al [40] mimic humanoid usage behavior for future studies.…”

Section: Related Workmentioning

confidence: 99%

Evaluation of Real-World Risk-Based Authentication at Online Services Revisited: Complexity Wins

Makowski,

Pöhn

2023

Proceedings of the 18th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Risk-based authentication (RBA) aims to protect end-users against attacks involving stolen or otherwise guessed passwords without requiring a second authentication method all the time. Online services typically set limits on what is still seen as normal and what is not, as well as the actions taken afterward. Consequently, RBA monitors different features, such as geolocation and device during login. If the features' values differ from the expected values, then a second authentication method might be requested. However, only a few online services publish information about how their systems work. This hinders not only RBA research but also its development and adoption in organizations. In order to understand how the RBA systems online services operate, black box testing is applied. To verify the results, we re-evaluate the three large providers: Google, Amazon, and Facebook. Based on our test setup and the test cases, we notice differences in RBA based on account creation at Google. Additionally, several test cases rarely trigger the RBA system. Our results provide new insights into RBA systems and raise several questions for future work. CCS CONCEPTS• Security and privacy → Authentication; Web application security; Usability in security and privacy.

show abstract

“…(Juneja, 2017). Behavioral biometrics depend on the user's behavioral characteristics (Jancok & Ries, 2022). The commonly used behavioral characteristics include keystroke dynamics, voice print, mouse movement, gait, signature, and pulse (Karim et al, 2020).…”

Section: Introductionmentioning

confidence: 99%

Using interface preferences as evidence of user identity: A feasibility study

Karim,

Abdulraheem,

Kanaker

et al. 2024

10.5267/j.ijdns

View full text Add to dashboard Cite

Research on human-computer interaction currently focuses on enhancing system usability by establishing an appropriate user interface (UI) that depends on users’ features. Online users typically have different perceptions of their favored interface design depending on their preferences. Thus, those interface preferences could be utilized to recognize online users’ identities. User authentication is another critical issue that should be considered to improve online security mechanisms without compromising usability. This study investigates the feasibility of using UI preferences as evidence of user identity. The proposed method applies to the design preferences of users dealing with online systems (e.g., e-exam and e-banking). These preferences are closely associated with individual characteristics, whether physical, cognitive, psychological, psychomotor, demographic, or experience based. Many design characteristics could be used in online systems; for example, the e-exam interface design may use features such as the font (size, color, and face), the number of questions per page, background color, questions group, timer type, and sound alert. The feasibility evaluation of this study indicated that 96.8% of research participants have variations in their preferences, and each participant kept 94.5% of their design preferences throughout different sessions.

show abstract

Security Aspects of Behavioral Biometrics for Strong User Authentication

Cited by 4 publications

References 15 publications

Online Banking User Authentication Methods: A Systematic Literature Review

Online Banking User Authentication Methods: A Systematic Literature Review

Evaluation of Real-World Risk-Based Authentication at Online Services Revisited: Complexity Wins

Using interface preferences as evidence of user identity: A feasibility study

Contact Info

Product

Resources

About