Defending Touch-based Continuous Authentication Systems from Active Adversaries Using Generative Adversarial Networks

Some of the earliest studies that explored touch gesture for authentication include [3, 4, 5, 6, 7]. These studies focused primarily on collecting data and demonstrating that touch gestures are unique to an individual under the non-existent active adversary’s assumption. Later studies [8, 6, 19] divided the swipes into multiple types such as left, right, up, and down; built a separate model for each of these types to authenticate users. Kumar et al. [8] studied touch gestures and corresponding movements captured by an accelerometer. They argued that it would be a little more difficult for adversaries to reproduce both the touch gestures and the underlying movements at any given point in time than just spoofing the swipes.

The majority of the previous studies focused on analyzing touch gestures collected from smartphones [3, 20, 4, 21, 22, 6, 5, 8]. These studies collect data from human participants while they answered a set of questions, browsed websites, or scrolled images. Later, they extracted a list of features from raw touch events, usually consisted of touch coordinates, time of touch events, pressure, and area along with those coordinates. The extracted features were used to train the authentication models. The training part consisted of training of one [23, 24] or two class classifiers [3, 6, 19]. While the testing part focused on passing genuine and non-genuine samples through the model and computing the genuine fail (false reject rates) and impostor pass rates (false accept rates). The majority of the studies have used these two metrics to report the performance of TCAS. Some studies have also reported Equal Error Rate [3] and Half Total Error Rates (an average of false accept and false reject rates) [20]. Researchers have recommended the use of Half Total Error Rates to report the testing performance as it is not possible to change the threshold during testing [25].

The majority of the studies that use touch gestures collected from smartphones have reported error rates under $10\%$ percent, which is an accepted region, especially for continuous authentication. A continuous authentication system with $10\%$ or lower error rates has several applications in the civilian domain. The problem, however, is that the studies have assumed the non-existence of active adversaries or people with malicious intent. Since the data generated or stored on smart devices are invaluable, there is a high likelihood that active adversaries would attack these systems. Therefore, this study focuses on the evaluation of TCAS under an active adversarial environment and proposing countermeasures.

Apart from smartphones, one of the heavily used touch-enabled devices is the tablet. Thus, a few studies have explored touch gestures collected via tablet for continuous authentication [24, 26]. Saravanan et al. [24] trained LibSVM, a one-class classifier, and obtained an average accuracy of $97.9\%$ and $96.79\%$ on the smartphone and tablet, respectively, on a small dataset of $20$ users. While Trojahn et al. [26] analyzed the slide-touch-type and reported as low as $2\%$ error rates on a dataset of $18$ users. It is worthwhile to note that not many studies have explored smartphones and tablets together, especially keeping the users common across the devices.

The idea of adversarial frameworks or attack models is still developing with a common goal, i.e., to fool the authentication system. Based on the current literature, the adversarial frameworks can be divided into two categories, namely, data-injection-based [18] and imitation-based [17, 16].

The data-injection-based attacks assume that it would be possible to bypass the link between the sensor and the authentication Application Programming Interface (API). Thus, the attackers inject snooped, spoofed, random or population-derived samples into the authentication API such that the API will grant (or keep granting) the access [18]. The data-injection-based attacks could be grouped into random [18], user-tailored (from keystrokes [27]), and population-based attacks (from keystrokes [28]). The random attacks include the injection of samples collected from random individuals or random samples generated statistically. The user-tailored attacks include the injection of samples stolen or estimated for a targeted user (popular as snoop-forge-replay attacks). In comparison, population-based attacks inject the average samples (similar to average face) derived from a large public dataset. Needless to say, that population attack eliminates the requirements of stealing the sample from the genuine user.

On the other hand, the imitation-based attacks use live samples collected from humans, robots, or human plus robots. Based on the amount and method of training the individuals or robot, the imitation-based attacks fall into zero-effort or high-effort categories. The zero-effort refers to the scenarios in which attackers use random users who produce the touch gestures without any explicit training or attempt to copy [3, 20, 4, 21, 22, 6, 5, 8]. While under the high-effort, the attackers either train an individual or robot to mimic targeted individual or average gestures derived from publicly available databases [17, 16]. The imitation-based attacks are realistic but tedious and require a much higher level of effort than the data-injection attacks because they eliminate the assumption of bypassing the sensor to API link. In this study, we focus on the data-injection-based attack frameworks and leave the imitation-based attacks for the future, as they require much more resources to realize (e.g. designing a robot).

It is important to note that a biometric system like TCAS could be attacked from many different sources as described in [29]. The attack methods other than the ones described earlier would require write permission to the authentication API. The authentication API’s implementation is supposed to be secure, leaving other sources of attack almost impractical. Therefore, researchers have focused mostly on data-injection- and imitation-based attacks. The success of these attacks depends on the resilience of the pattern matching component in the authentication API. Researchers have noted that raw data level distance-based matching is more resilient to the attacks; however, they exhibit very high error rates, in general, [18, 30, 31, 32]. Machine learning-based matchers, on the other hand, achieve much lower error rates, therefore, heavily studied for implementing TCAS [19, 12, 6] than the distance-based matchers. Therefore, we chose to experiment with machine learning-based implementations of TCAS. To summarize, we evaluate the most widely studied implementations of TCAS under the most common adversarial scenarios.

We used a public dataset named Syracuse University and Assured Information Security-Behavioral Biometrics Multi-Device, and Multi-Activity Data (SU-AIS BB-MAS) [33]. SU-AIS BB-MAS consists of multiple modalities like keystroke, touch, and gait; however, we consider only the touch part, therefore, refer to the dataset as BBMAS-Touch throughout this paper. The reasons to choose BBMAS-Touch include the number of users, the number of samples per user, and common users across multiple devices. Additionally, we used another publicly available dataset [6] to create a more realistic population-based attack environment and refer to the same as Serwadda-Touch.

Both BBMAS-Touch and Serwadda-Touch datasets consisted of raw touch information (coordinates, pressure, and area at every touchpoint) collected while participants answered a series of questions in two different sessions. The questions were designed in such a way that they generated both horizontal and vertical swipes. More details in the data and data collection experiment are available in [6] and [33, 34].

As mentioned earlier, comparison of raw data does not result in acceptable error rates. Therefore, almost all previous studies have relied on the extraction of features from the raw touch events. The derived features have been effectively used to train classifiers that successfully distinguished between genuine and non-genuine (impostor) users. Following previous studies, we extracted features from individual swipes (a swipe here is a series of touch events after finger down, during the slide, and till finger up events). The outlying swipes (with less than five touch points) were removed from the database. A swipe with five or fewer points can be considered a tap. We decided to exclude them from our study because those events were not found unique enough among the users during exploratory swipe analysis. The numbers of total swipes extracted from the phone and tablet were 22625 and 18527, respectively. The outlier removal process resulted in the exclusion of 2339 (10.33%) and 4713 (25.43%) swipes. We chose to include swipes with longer latency in contrast to [20] because the data collection experiments consisted of questions with varying cognitive load, resulting in longer duration swipes. In other words, longer swipes could be someone’s unique trait. We extracted the $30$ features used in Frank et al. [3] from each swipe, and added $17$ more features which were variations of the idea around the thirty features. As a result, we used $47$ features in total from each swipe as listed in Table 1.

A swipe $S$ is a culmination of $n$ touch events. It can be represented as a tuple given in Equation 1.

where $x,y,t,a,$ and $b$ represent, x-coordinate, y-coordinate, time, and major-axis and minor-axis of the fingertip of each touch event, respectively.

Pairwise velocities ($v_{x}$ and $v_{y}$) for x and y axes, $\forall i\in[1,n)$ were computed as described in Equation 2.

Similarly, pairwise accelerations $(a_{x}$ and $a_{y})$, length of the swipe ($l$), mean area of the fingertip ($A$), can be calculated as shown in Equations 3, 4, 5, respectively.

Meanwhile, the deviations of each point, defined as the distance from the line joining the starting and ending point of the swipe ($d_{i}$), can be calculated with Equation 6.

Assuming the equation of the line to be $y=m\times x+c$

The velocity, acceleration, and speed features were computed at first, second, and third quantiles of the swipe’s touch events. These features capture the live nature of the swipes. Similarly, velocities and accelerations at the beginning and end of the swipe help us distinguish between the users who start/end their swipe aggressively or gently.

The authentication framework depicted in Figure 1 consisted of the following components.

The training and testing datasets. The dataset was split into train and test sets with $60\%$ and $40\%$ of swipes for every user, respectively. The train set was used for parameter tuning with $k$-fold cross-validation ($k=5$). The test set was kept separate (unseen) and was used only during the testing process to mimic a real-world setup.

Continuous authentication. One of the simplest ways to achieve continuous authentication via touch gestures is to use sliding windows of touch gestures and provide authentication decisions for each window. The design goal generally is to minimize both the window size and the sliding interval. The former decides the time taken in the first authentication decision, while the latter dictates the time taken by the subsequent authentication decision. We took $p$ consecutive swipes in one window with the removal and addition of $q$ swipes for the next window. A range of values for $p$ and $q$ were inspected. $p=5$ and $q=1$ achieved the best training error rates, in turn, adapted for training the final models and testing.

Choice of classification algorithms. We applied three criteria to choose the classifiers for our study. First, the classifiers must have been used successfully (achieved less than $10\%$ error rates) in the past studies. Second, the classifier should not be data-hungry for training, primarily because most public datasets have a small number of touch gestures per user. The third criterion was the diversity of learning paradigms. The process resulted in the selection of Support Vector Machine (SVM), Random Forest (R.F.), and Multilayer Perceptron (MLP) [3, 19, 6, 16]. We added Extreme Gradient Boosting (XGB), which has not been studied much in the touch biometric domain but has performed well in other domains.

The class imbalance. The two-class classifiers require samples from both classes to be trained. To meet this requirement, traditionally, researchers have used the genuine users’ feature vectors as genuine samples and feature vectors of users other than the genuine users as impostor samples. However, this strategy results in a heavy class imbalance as the number of impostor samples is always higher. Past studies have used under-sampling, over-sampling, or both to address the problem. In this paper, first, we take only a limited number (four from each possible impostor) of samples from the rest of the users, so the number of impostor samples is $4\times(n-1)$, where $n$ is the total number of users in the dataset. The process of not choosing all the samples from all possible impostors can be termed as under-sampling. At the same time, we employed an Adaptive synthetic sampling approach for imbalanced learning (ADASYN) [35] to over-sample the genuine feature vectors. As a result, every training and testing activity in our experiment used an equal number of genuine and impostor samples.

The adversarial environments. We implemented two adversarial environments. First, the zero-effort adversarial environments, one of the most studied adversarial environments in the literature. Likely because it is the easiest to implement. The feature vectors of the users other than genuine users serve as the attack vectors in this environment. The second commonly studied adversarial environment is the population-based attack in which the impostor samples are derived from all the users in a given database. In the phone case, we were able to find a separate public dataset (Serwadda-Touch). Thus, we used BBMAS-Touch as well as the Serwadda-Touch dataset for population attack. In contrast, we failed to find such a dataset for the tablet environment. Consequently, we used the same BBMAS-Touch for the population attack. The process of computing the population feature vectors from a dataset is described through Algorithm 1. As shown, we generated $n$ population attack vectors, using the formula = $\mu+r\times\sigma$ where $r=\mathcal{N}(0,3)$.

Training V-TCAS. We followed the strategy widely implemented in the literature to train the Vanilla authentication framework. To train the selected classifiers for user $u_{i}$, we labeled the feature vectors belonging to $u_{i}$ as genuine and the feature vectors belonging to the other users than $u_{i}$ as impostors. We conducted five-fold cross-validation to find the hyperparameters that resulted in the highest balanced accuracy. The models were retrained using the best hyperparameters and pickled for testing.

Training G-TCAS. GANs have been extensively used to generate synthetic data points [36]. It consists of Generator ($G$) and Discriminator ($D$). $G$ captures the data distribution, whereas $D$ estimates the probability of generated data belonging to $G$. $G$ is trained until $D$ exhibits an acceptable level of error. The idea behind GANs is to consider $G$ and $D$ as two players of a min-max game with value function $V(D,G)$ represented in Equation 9.

To learn the distribution $p_{g}$ over data $x$, a prior on input noise variables $p_{z}(z)$ is defined and $G(z;\theta_{g})$ represent a mapping to data space. Where $G$ is a function with parameters $\theta_{g}$. Second layer $D(x;\theta_{d})$ outputs a single scalar. Here, $D(x)$ represents the probability that $x$ came from the data and not from $p_{g}$. We train $D$ to maximize the probability of assigning the correct label to both training examples and samples from $G$. We simultaneously train $G$ to minimize $\log(1-D(G(z)))$.

The combination of GANs generated data and the actual dataset can make the authentication models more resilient to attacks. This hypothesis motivated us to implement a GAN-assisted TCAS. Figure 1 demonstrates the block diagram of the framework. To summarize, we used two GANs to generate both legitimate and adversarial feature vectors. We customized the implementation of GAN provided at [37] to fit our requirements. In particular, we tuned the parameters (epoch, bath_size, and learning_rate) to obtain the accuracy beyond $93\%$ for both GANs. We refer to these GANs as Legitimate-GAN and Adversarial-GAN, respectively. We generated synthetic samples for each user separately. The Legitimate-GAN input was the genuine feature vectors, while the input for the Adversarial-GAN was the impostor feature vectors (i.e. feature vectors from users other than the genuine user).

The GANs did not perform well when the number of requested synthetic feature vectors was too low or too high. To find the optimal number of feature vectors generated, we randomly tested many values between $[50,1000]$ and found that $n=250$ was optimal.

Performance evaluation. The performance of the implemented TCAS was evaluated using three measures, False Accept Rate (FAR–the percentage of successful impostor attempts), False Reject Rates (FRR–the percentage of failed genuine attempts), and Half Total Error Rate (HTER–an average of FAR and FRR). Another measure that has been widely used to report the test performance of TCAS is Equal Error Rate (EER). However, researchers have advised using HTER instead of EER to report the test performance of a biometric system primarily because EER is computed by varying the threshold. The threshold, however, cannot and should not be adjusted during testing [25]. The attack’s impact can be measured by the increase in the False Accept Rates (FAR).

Table 2 presents the performance of Vanilla TCAS (V-TCAS) in terms of FAR, FRR, and HTER under zero-effort for both smartphone and tablet devices. V-TCAS’s performance under the population-based adversarial environment is reported using only FAR, and HTER; the FRRs remain the same as of the zero-effort adversarial environment.

Smartphone. Both Random Forest and XGBoost achieved $5\%$ HTERs which was better than SVM and MLP ($6\%$ HTERs) under the zero-effort adversarial setup. On the other hand, SVM ($14\%$ increase in the FAR) and XGBoost ($17\%$ increase in FAR) showed more resilience to the population-based adversarial setup created using the same dataset than Random Forest ($21\%$ increase in FAR) and MLP ($20\%$ increase in FAR).

Tablet. The performance of Random Forest and XGBoost rounded to $5\%$ HTER, which was better than MLP ($6\%$ HTER) and SVM ($7\%$ HTER). SVM was the most resilient ($12\%$ increase in the FAR) classifier compared to MLP ($27\%$), Random Forest ($31\%$), and XGBoost ($33\%$).

We can conclude that SVM was the most resilient classifier, irrespective of the device.

Table 2 presents the G-TCAS’s performance in terms of FAR, FRR, and HTER under the zero-effort for both smartphone and tablet devices. G-TCAS’s performance under the population-based adversarial environment is reported using only FAR and HTER; the FRRs remain the same as of the zero-effort adversarial environment.

Smartphone. GTCAS achieved similar performance to V-TCAS for the majority of the classifiers. Random Forest ($5\%$ HTER) and XGBoost ($5\%$ HTER) did better than SVM ($7\%$ HTER) and MLP ($6\%$ HTER) under the zero-effort adversarial setup. However, SVM ($-1\%$ increase in FAR) and Random Forest ($3\%$ increase in FAR) showed more resilience to the population-based adversarial setup created using the same dataset than MLP ($16\%$ increase in FAR) and XGBoost ($12\%$ increase in FAR). The same phenomenon holds for the population-based adversarial setup created using a different dataset as RForest ($6\%$) and SVM ($7\%$), which showed more resilience than XGBoost ($20\%$) and MLP ($28\%$).

Tablet. The performance of SVM and Random Forest rounded to $5\%$ HTER, which was better than MLP ($7\%$ HTER) and XGBoost ($7\%$ HTER). SVM ($0\%$ increase in FAR) and Random Forest ($5\%$ increase in FAR) were most resilient compared to MLP ($9\%$) and XGBoost ($12\%$).

Overall, the results table suggest that G-TCAS performed much better under a stringent (population-based) adversarial environment than V-TCAS. GAN-generated synthetic samples (both legitimate and adversarial) included in the authentication pipeline helped draw a better boundary. To analyze the idea, we plotted the top two principal components for a random user (a sample is shown in Figure 2). We observed that the G-TCAS helped separate the classes better, making the implementation more robust than V-TCAS.