# Self-enhancing GPS-Based Authentication Using Corresponding Address

Tran Phuong Thao, Mhd Irvan, Ryosuke Kobayashi, Rie Shigetomi

Yamaguchi, Toshiyuki Nakata

► To cite this version:

Tran Phuong Thao, Mhd Irvan, Ryosuke Kobayashi, Rie Shigetomi Yamaguchi, Toshiyuki Nakata. Self-enhancing GPS-Based Authentication Using Corresponding Address. 34th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jun 2020, Regensburg, Germany. pp.333-344, 10.1007/978-3-030-49669-2_19. hal-03243648

HAL Id: hal-03243648

https://inria.hal.science/hal-03243648

Submitted on 3 Jul 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Self-enhancing GPS-Based Authentication
Using Corresponding Address

Tran Phuong Thao(✉), Mhd Irvan, Ryosuke Kobayashi,
Rie Shigetomi Yamaguchi, and Toshiyuki Nakata

Graduate School of Information Science and Technology, The University of Tokyo,
Bunkyo, Japan

{tpthao,irvan}@yamagula.ic.i.u-tokyo.ac.jp,
{kobayashi.ryousuke,nakata.toshiyuki}@sict.i.u-tokyo.ac.jp,
yamaguchi.rie@i.u-tokyo.ac.jp

**Abstract.** Behavioral-based authentication is a new research approach for user authentication. A promising idea for this approach is to use loca- tion history as the behavioral features for the user classification because location history is relatively unique even when there are many people living in the same area and even when the people have occasional travel, it does not vary from day to day. For Global Positioning System (GPS) location data, most of the previous work used longitude and latitude val- ues. In this paper, we investigate the advantage of metadata extracted from the longitude and latitude themselves without the need to require any other information other than the longitude and latitude. That is the location identification name (i.e., the address). Our idea is based on the fact that given a pair of longitude and latitude, there is a corresponding address. This is why we use the term self-enhancing in the title. We then applied text mining on the address and combined the extracted text fea- tures with the longitude and latitude for the features of the classification. The result showed that the combination approach outperforms the GPS approach using Adaptive Boosting and Gradient Boosting algorithms.

**Keywords:** Location-based authentication · Lifestyle authentication · Global Positioning System (GPS) · Text mining · Reverse geocoding

# 1 Introduction

Japan aims to become the first country in the world to achieve Society 5.0 (after Society 1.0 (the hunting society), Society 2.0 (agricultural society), Society 3.0 (industrial society), and Society 4.0 (information society)) which is defined as: “A human-centered society that balances economic advancement with the resolution of social problems by a system that highly integrates cyberspace (virtual space) and physical space (real space)” according to the Government of Japan [1]. It sets a blueprint for a super-smart society with the support of Artificial Intelligent
(AI) and cutting-edge technology. Let's consider an example of the payment system. In 1946, John Biggins invented a credit card which can be used to replace paper money. In 2011, Google was the first company to launch a project of mobile wallet which can be used to replace physical cash and even credit cards. Nowadays, the cashless payment system becomes a recent trend and many digital wallet services appeared such as Apple Pay (from 2014), Google Pay (from 2015 as Android Pay and from 2018 as Google Pay), Rakuten Pay (from 2016), etc. The biggest challenge for such payment systems is how to authenticate (verify) the users. The current approach is to rely on the authentication of the mobile phones using PIN code, biometrics information (i.e., fingerprinting, iris, palm vein, etc), or multi-factor method.

**Motivation.** Toward the construction for a smarter mobile-based authentication system, we have several research questions. First, several studies found that a large number of users do not lock their smartphones such as 33% by B. Dirk et al. [20], 29% by S. Egelman et al. [21], 48% by L. Fridman et al. [12], or even 57% by M. Harbach et al. [22]. So we ask the question: *Is there an additional mobile-based authentication method that can support the conventional method like using PIN code or biometrics information?*. Second, in the current cashless payment system, even though the users do not need to bring their credit cards, they have to bring their phones. So, we ask another question: *Is it "human-centered" enough? Whether a new authentication system can be done via smaller wearable devices such as smartwatches, RFID chips, or satellite sensors rather than the smartphone?*. Third, imaging the scenario that a person is on the way going to a coffee shop. Before he/she arrives, the coffee shop can predict that he/she will arrive 10 min later with a high probability, and prepares in advance his/her usual order, and will automatically subtract the charge from his account. The person then does not need to wait time for the order and payment process. So, the final question is: *Is it possible to authenticate and predict the location (for example, the coffee shop) that the users are likely going to?*

An idea that can answer these questions is using behavioral (or habit)-based information. There are very few studies focusing on it due to the challenge of how to decide behavioral information for authentication. Inspired from L. Fridman et al. [12], GPS location history is the most promising approach because “It is relatively unique to each individual even for people living in the same area of a city. Also, outside of occasional travel, it does not vary significantly from day to day. Human beings are creatures of habit, and in as much as location is a measure of habit”. If we can construct a payment system in which the users do not need to bring anything even small wearable devices such as smartwatches or RFID chips (e.g., the data can be collected via satellite sensors) and which can replace the conventional biometrics authentication, it is a successful achievement for the Society 5.0 goal.

**Contribution.** Most of the previous papers utilized longitude and latitude of GPS as the features in the classification machine learning models for the user authentication. In this paper, we propose an idea of extracting metadata of the
GPS itself without the need to request any other information besides the GPS. That is the location identification name (i.e., the address) which can be inferred from the longitude and latitude. We then applied text mining on the address and combined the extracted text features with the longitude and latitude for the learning features. We made an experiment to see how the combination approach is compared with the approach using only the GPS.

Considering it reasonability, it may raise the discussion that since the address can be inferred from a pair of longitude and latitude (i.e., using reverse geocoding), so whether the entropy of the address is the same as that of the GPS (in other words, whether the address gives no additional information to the GPS). However, we should remark that, for machine learning, a pair of two float numbers (i.e., longitude and latitude) and a string of text (i.e., address) are totally different and independent. Therefore, we hypothesized that the combination approach may add a certain amount of information to the approach using only GPS. Furthermore, the model using GPS and address, of course, can be improved if they can combine with other factors such as date times, indoor location history like wifi information, web browser log, etc. However, the goal in this paper is to make clear whether information (i.e., the GPS) along with the metadata extracted from that information itself (i.e., the address) can be helpful for the better classification model. We thus excluded other factors to make the comparison clean.

To evaluate how the feasibility of our hypothesis is, concretely, we collected 14,655 GPS records from 50 users. We extracted the corresponding address using reverse geocoding. We applied text mining on the address and obtained 3,803 text features using the term frequency-inverse document frequency. We performed multi-class classification using different ensemble algorithms on total of 3,805 scaled features including longitude, latitude, and text features. The result showed that the combination approach outperforms the approach using only the GPS with the Adaptive Boosting and Gradient Boosting ensemble algorithms.

**Roadmap.** The rest of this paper is organized as follows. The related work is described in Sect. 2. The proposed idea is presented in Sect. 3. The experiment is given in Sect. 4. The discussion is mentioned in Sect. 5. Finally, the conclusion is drawn in Sect. 6.

# 2 Related Work

## 2.1 Multimodal Location-Based Authentication

The term *multi-modal* (not multi-model) is used in biometrics authentication to indicate multiple biometric data; it is opposite with *unimodal* that uses only a single biometric data. L. Fridman et al. [12] collected behavioral data of four modalities collected from active mobile devices including text stylometry typed on a soft keyboard, application usage patterns, web browsing behavior, and physical location of the device from GPS and Wifi. The authors proposed a
location-based classification method and showed that its performance is applica-
ble to an actual authentication system. W. Shi et al. [14] proposed an authenti-
cation framework that enables continuous and implicit user identification service
for a smartphone. The data is collected from four sensor modalities including
voice, GPS location, multitouch, and locomotion. A. Alejandro et al. [15] ana-
lyzed their behavior-based signals obtained from the smartphone sensors includ-
ing touch dynamics (gestures and keystroking), accelerometer, gyroscope, WiFi,
GPS location and app usage. They proposed two authentication models includ-
ing the one-time approach that uses all the channel information available during
one session, and the active approach that uses behavioral data from multiple
sessions by updating a confidence score. B. Aaron et al. [16] proposed a wallet
repository that can store biometric data using multiple layers: biometric layer,
a genomic layer, a health layer, a privacy layer, and a processing layer. The pro-
cessing layer can be used to determine and track the user location, the speed
when the user is moving using GPS data. R. Valentin et al. [17] presented the
context of multimodal sensing modalities with mobile devices when the GPS,
accelerometer, and audio signals are utilized for human recognition. They then
discussed several challenges for modality fusion such as imbalance distribution
when the GPS samples have to be correlated to accelerometer readings.

## 2.2 Learning from Metadata

We introduce related work that utilize metadata extracted from the main infor-
mation to gain additional knowledge or the accuracy like our paper. T. Thao et
al. [11] proposed a classification method of landing and distribution webpages
from drive-by-download attack. A landing webpage is the original webpage that
the victim visits while a distribution webpage is the final webpage that exploits
malware in the redirection chain of the attack. While most of the previous
papers analyze the characteristics around the landing and distribution webpages
themselves (e.g., the HTML content, the pattern of the URL, etc.), this paper
found the benefits when using the metadata from the webpages. Concretely, they
extracted the registration information from the domain of the webpages called
Whois. Whois contains registration name, organization, registration date, update
date, expiration date, address, email, etc. They then applied text mining to the
Whois documents and proved that the method can increase the classification
accuracy. Similarly, Whois was also used to distinguish whether a homograph
domain is registered by brand companies or by attackers [23]. A Castiglione et
al. [18] analyzed the format extracted from a plain-text document using digital
forensics and found that such kind of evidence in the forensic environment can
provide a lot of valuable hidden information such as author name, organizational
information of users involved, previously deleted text, and machine-related infor-
mation. B. Duy et el. [19] proposed a classification method to extract the data
from a PDF document. Besides using the information from the documents itself
such as title, abstract, body-text, and semi-structure, the authors used meta-
data surround the document including publication information (i.e., authorship,
affiliation, bibliography), journal name, header and footer, and references. Their method can improve 9.7% of accuracy from the best performing algorithm.

# 3 Our Method

## 3.1 Data Collection

The data is collected from 50 Internet users who installed a smartphone navigation application (named MITHRA (Multi-factor Identification/autHentication ReseArch)) created by a project of the University of Tokyo. The application runs in the background and collects the GPS data including the longitude and latitude. The application works for both Android and iOS versions. The data is collected for four months from January 11th to April 26th in 2017. Although the GPS was collected from smartphones in this project, nowadays, GPS can be collected from smaller devices such as smartwatch or smartband.

The privacy agreement is showed during the installation process. The application installation is only done if the users accept the agreement. Even after the installation is finished, the users can choose to start participating or stop using the application anytime during the experimental period. The project was reviewed by the Ethics Review Committee of the Graduate School of Information Science and Technology, the University of Tokyo. No personal information such as age, name, race, ethnicity, income, education, etc. is collected. Only the email address is used as the user identity in the collected data. Finally, all 50 users agreed to participate in our project.

The total number of samples (i.e., GPS records including pairs of longitude and latitude) from the 50 users is 14,655. Each user has a different number of samples that range from 67 to 999. The distribution curve and distribution summary of the number of samples are described in Fig. 1. The Kurtosis and Skewness scores are computed as 1.864 and 1.537, respectively. Both of the scores lie in the range [-2, +2] which are acceptable for normal distribution [2, 4, 5].

<figure><img src="image_2.png" /></figure>

<table><caption>Fig. 1. Distribution curve and distribution summary of the number of samples</caption><thead><tr><td>Metric</td><td>Value</td></tr></thead><tbody><tr><td>Mean</td><td>293.100</td></tr><tr><td>Standard Error</td><td>31.899</td></tr><tr><td>Median</td><td>237.000</td></tr><tr><td>Standard Deviation</td><td>225.561</td></tr><tr><td>Kurtosis</td><td>1.864</td></tr><tr><td>Skewness</td><td>1.537</td></tr><tr><td>Range</td><td>932.000</td></tr><tr><td>Min</td><td>67.000</td></tr><tr><td>Max</td><td>999.000</td></tr><tr><td>Confidence Level (95.0 %)</td><td>64.104</td></tr></tbody></table>
## 3.2 Feature Selection

All the samples are unique for each user. Each GPS sample is a pair of a longitude and a latitude represented by two float numbers with 6 decimal digits, and can be positive or negative values.

**Address Extraction.** Reverse geocoding is the process of reverse coding of a pair of latitude and longitude to a corresponding address. There are several reverse geocoding methods but we use Google's reverse geocoding [3] since it is the most reliable, fast, and stable. Especially, different from other services, Google's reverse geocoding can provide pinpoint addresses. For each request containing a pair of longitude and latitude, the service returns the addresses and the corresponding tags with the following values: *rooftop* (the most precise geocode), *range interpolated* (the address is interpolated between two precise points like intersections), *geometric center* (such as a polyline (street) or polygon (region)), and *approximate* (the approximated address). Since it is possible that multiple addresses with different tags are returned, we sorted each tag in the descending order of precision scale (rooftop → range interpolated → geometric center → approximate) and selected the first one (the most precise one).

**Address Text Mining.** Given the address texts, the word tokenization is performed to build a dictionary of features. The texts are then transformed to feature vectors. N-grams of words which are the sequences of N consecutive characters from the given words are counted. Let $T = \{t_1, t_2, \cdots, t_n\}$ denote the set of n texts $t_i$ for $i = [1, n]$. Given a word $w$, the *Term Frequency* ($tf$) of $w$ in $t_i$ and the *Inverse Document Frequency* ($idf$) used for measuring how much information that $w$ provides or whether $w$ is common or rare in all the texts $T$ are computed as: $tf(w, t_i) = \frac{occ(w, t_i)}{|corpus(t_i)|}$ and $idf(w, T) = \log(\frac{1+n}{1+df(w, T)}) + 1$ where $corpus(t_i)$ denotes the set of all tokenized unique words in $t_i$. $|corpus(t_i)|$ denotes its length. $occ(w, t_i)$ denotes the occurrence count of $w$ in $t_i$. $idf(w, T)$ denotes the number of text $t_i \in T$ that contains $w$. The *Term Frequency Inverse Document Frequency* ($tf-idf$) is then computed to downscale weights of $w$ that may occur in many texts: $tf-idf(w, t_i) = tf(w, t_i) \cdot idf(w, T)$. Finally, each word tokenized from the texts is used as a feature with its $tf-idf$.

**Feature Scaling.** While the longitude and the latitude range from [-180, +180] and from [-90, +90] respectively, the text features mostly range from (0, 1]. We thus use *Standard (Z-score)* scaling to normalize the features. For a given original feature $f_x$, the new standard for $f_x$ is computed as: $f'_x = \frac{f_x - \mu}{\sigma}$ where $\mu$ and $\sigma$ denote the mean and the standard deviation of the training samples, respectively. Standard scaling rescales the features by subtracting the mean and scaling the features to unit variance (the data distribution is centered around 0 and a standard deviation of 1).
## 3.3 Training

There are multiple users and each user has a different set of data. The conventional solution is the one-class classification in which each label corresponds to each user. However, when the number of users is large, the authentication performance can be low. Furthermore, if there is a new user participating in the system, it is not scalable since the classification should be trained again. Therefore, the one-class classification is transformed into a more lightweight approach known as the multi-class classification. Each user has a different classifier with binary classes representing whether or not a new sample belongs to that user.

**One-vs-rest Multi-class Classification.** We use One-vs-rest strategy that consists in fitting one classifier per class (the samples belonging to the considered class are labelled as positive and the other samples of the other classes are marked as negatives). Suppose there are *q* classifiers $c_i$ where $i \in \{1, \dots, q\}$. Given a new sample *x*, the one-vs-rest approach classifies *x* into the label *k* such that: $\hat{y} = \underset{k}{\operatorname{argmax}} c_k(x)$ where $k \in \{1, \dots, q\}$ and all the classifiers are applied to *x* and predict *k* which has the highest confidence score. $\hat{y}$ represents the approximate score. Besides the computational efficiency and scalability when there is a new class, an advantage of this approach is the interpretability. The learner can gain knowledge about the class by inspecting its corresponding classifier.

**Ensemble Algorithms for One-vs-rest.** Since our data contains a large number of samples (14,655) with a large number of features (3,805), instead of using traditional algorithms we use advanced *ensemble techniques*. The ensemble technique combines base estimators to produce one optimal predictive estimator with better performance using two approaches: boosting and averaging. In boosting approach, the base estimators are built sequentially. Each base estimator is used to correct and reduce the bias of its predecessor. We use two algorithms AdaBoost [6] (Adaptive Boost) and Gradient Boost [7]. In averaging approach, the estimators are built independently and their predictions are then averaged based on the aggregated results. The combined estimator reduces the variance. We use three algorithms: ExtraTrees [8], Bagging [9] (Bootstrap Aggregating), and Random Forest [10].

## 3.4 Validation

**Stratified KFold.** First, the data is shuffled. The numbers of samples of the classes are imbalanced, ranging from 66 to 999 (0.45% to 6.82% of 14,655 samples). Using normal *k*-fold cross validation can lead to the problem that there may exist a class such that all the samples from the class belong to the test set, and the training set does not contain any of them. The classifier then cannot learn about the class. We thus used *Stratified k-fold* to deal with such imbalanced data. It splits the data in the train and the test sets and returns stratified folds made by preserving the percentage of samples for each class.
<table><caption>**Table 1.** GPS-based, address-based, and combination approaches</caption><thead><tr><th rowspan="2">Alg.</th><th rowspan="2"></th><th colspan="4">#Classes = 10</th><th colspan="4">#Classes = 30</th><th colspan="4">#Classes = 50</th></tr><tr><th>LL</th><th>A</th><th>LLA</th><th>Δ</th><th>LL</th><th>A</th><th>LLA</th><th>Δ</th><th>LL</th><th>A</th><th>LLA</th><th>Δ</th></tr></thead><tbody><tr><td rowspan="4">AdaBoost</td><td>Acc</td><td>99.36</td><td>99.21</td><td><span style="color:red;">99.40</span></td><td></td><td>96.79</td><td>96.44</td><td><span style="color:red;">97.29</span></td><td></td><td>95.09</td><td>95.04</td><td><span style="color:red;">95.67</span></td><td></td></tr><tr><td>Pre</td><td>99.43</td><td>99.28</td><td><span style="color:red;">99.45</span></td><td></td><td>96.86</td><td>96.54</td><td><span style="color:red;">97.32</span></td><td></td><td>95.26</td><td>95.25</td><td><span style="color:red;">95.80</span></td><td></td></tr><tr><td>Rec</td><td>99.36</td><td>99.21</td><td><span style="color:red;">99.40</span></td><td></td><td>96.79</td><td>96.44</td><td><span style="color:red;">97.29</span></td><td></td><td>95.09</td><td>95.04</td><td><span style="color:red;">95.67</span></td><td></td></tr><tr><td>F1</td><td>99.37</td><td>99.23</td><td><span style="color:red;">99.41</span></td><td>+0.04</td><td>96.78</td><td>96.44</td><td><span style="color:red;">97.28</span></td><td>+0.50</td><td>95.11</td><td>95.07</td><td><span style="color:red;">95.70</span></td><td>+0.59</td></tr><tr><td rowspan="4">GradientBoost</td><td>Acc</td><td>99.74</td><td>99.51</td><td><span style="color:red;">99.81</span></td><td></td><td>97.24</td><td>97.07</td><td><span style="color:red;">97.35</span></td><td></td><td>95.55</td><td>95.36</td><td><span style="color:red;">95.91</span></td><td></td></tr><tr><td>Pre</td><td>99.74</td><td>99.52</td><td><span style="color:red;">99.82</span></td><td></td><td>97.29</td><td>97.11</td><td><span style="color:red;">97.39</span></td><td></td><td>95.63</td><td>95.46</td><td><span style="color:red;">96.05</span></td><td></td></tr><tr><td>Rec</td><td>99.74</td><td>99.51</td><td><span style="color:red;">99.81</span></td><td></td><td>97.24</td><td>97.07</td><td><span style="color:red;">97.35</span></td><td></td><td>95.55</td><td>95.36</td><td><span style="color:red;">95.91</span></td><td></td></tr><tr><td>F1</td><td>99.74</td><td>99.51</td><td><span style="color:red;">99.81</span></td><td>+0.07</td><td>97.21</td><td>97.06</td><td><span style="color:red;">97.35</span></td><td>+0.14</td><td>95.55</td><td>95.36</td><td><span style="color:red;">95.94</span></td><td>+0.39</td></tr><tr><td rowspan="4">ExtraTrees</td><td>Acc</td><td>99.59</td><td>99.18</td><td>99.14</td><td></td><td>98.14</td><td>97.14</td><td>97.35</td><td></td><td>97.78</td><td>96.02</td><td>96.28</td><td></td></tr><tr><td>Pre</td><td>99.60</td><td>99.19</td><td>99.15</td><td></td><td>98.16</td><td>97.17</td><td>97.37</td><td></td><td>97.80</td><td>96.05</td><td>96.31</td><td></td></tr><tr><td>Rec</td><td>99.59</td><td>99.18</td><td>99.14</td><td></td><td>98.14</td><td>97.14</td><td>97.35</td><td></td><td>97.78</td><td>96.02</td><td>96.28</td><td></td></tr><tr><td>F1</td><td>99.59</td><td>99.17</td><td>99.13</td><td>-0.46</td><td>98.13</td><td>97.10</td><td>97.33</td><td>-0.80</td><td>97.78</td><td>96.01</td><td>96.28</td><td>-1.50</td></tr><tr><td rowspan="4">Random Forest</td><td>Acc</td><td>99.70</td><td>99.14</td><td>99.44</td><td></td><td>97.93</td><td>96.85</td><td>97.06</td><td></td><td>97.33</td><td>95.58</td><td>95.79</td><td></td></tr><tr><td>Pre</td><td>99.71</td><td>99.16</td><td>99.45</td><td></td><td>97.95</td><td>96.85</td><td>97.08</td><td></td><td>97.37</td><td>95.60</td><td>95.87</td><td></td></tr><tr><td>Rec</td><td>99.70</td><td>99.14</td><td>99.44</td><td></td><td>97.93</td><td>96.85</td><td>97.06</td><td></td><td>97.33</td><td>95.58</td><td>95.79</td><td></td></tr><tr><td>F1</td><td>99.70</td><td>99.12</td><td>99.44</td><td>-0.26</td><td>97.92</td><td>96.81</td><td>97.03</td><td>-0.89</td><td>97.33</td><td>95.56</td><td>95.79</td><td>-1.54</td></tr><tr><td rowspan="4">Bagging</td><td>Acc</td><td>99.59</td><td>99.44</td><td>99.55</td><td></td><td>97.81</td><td>97.03</td><td>97.44</td><td></td><td>97.07</td><td>95.61</td><td>96.23</td><td></td></tr><tr><td>Pre</td><td>99.60</td><td>99.45</td><td>99.57</td><td></td><td>97.82</td><td>97.11</td><td>97.49</td><td></td><td>97.13</td><td>95.65</td><td>96.27</td><td></td></tr><tr><td>Rec</td><td>99.59</td><td>99.44</td><td>99.55</td><td></td><td>97.81</td><td>97.03</td><td>97.44</td><td></td><td>97.07</td><td>95.61</td><td>96.23</td><td></td></tr><tr><td>F1</td><td>99.59</td><td>99.44</td><td>99.55</td><td>-0.04</td><td>97.78</td><td>97.03</td><td>97.43</td><td>-0.35</td><td>97.07</td><td>95.59</td><td>96.22</td><td>-0.85</td></tr></tbody></table>

(LL): the GPS approach, (A): the address approach, (LLA): the combination approach Acc: accuracy, Pre: precision, Rec: recall

## 4.3 Analysis

We analyze how well the data points fit the data mean in boosting and averaging algorithms by measuring the variance and the bias. Let $y$ and $\hat{y}$ denote the true samples and the predicted samples. The variance is calculated as: $var(\hat{y}) = \frac{\sum_{i=1}^{n} (x_i - \bar{x})^2}{n-1}$ where $x_i$, $\bar{x}$, and $n$ denote the sample in the dataset, the sample mean, and the number of samples. The bias is calculated as: $bias(\hat{y}) = mean((mean(\hat{y}) - y)^2) - var(\hat{y}) - 0.01$ where $mean((mean(\hat{y}) - y)^2)$ is the sum of squared errors. We set the number of estimators varying $\{1, 2, \dots, 10\}$. We choose the second plan ($\#class = 30, n = 9,068$) for the analysis. The graphs of variance and bias are showed in Figs. 2 and 3. Ten curves GPS(Ada), Com(Ada), GPS(Gra), Com(Gra), GPs(Ext), Com(Ext), GPS(Ran), Com(Ran), GPS(Bag), and Com(Bag) represent the GPS approach or the combination approach using the five algorithms with the first 3 letters as the abbreviations.

In Fig. 2, the variances are separated into two different groups. The first group that has higher variance score includes only the combination approach regardless of which algorithm is used. The other group includes the remaining curves which are only the GPS approach regardless of which algorithm is used. This indicates that the text features make the data samples spread out from the mean and from one another rather than the GPS. In both the groups, the averaging algorithms give a higher variance than the boosting algorithms for the first estimator. After a number of estimators, the variances become convergent and constant in each group. Considering the bias in Fig. 3, there is no separation like the variance.
<figure><img src="image_3.png" /><figcaption>Fig. 2. Variance</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 3. Bias</figcaption></figure>

Also, the boosting algorithms give higher bias than the averaging algorithms for both the GPS and combination approaches. After a number of estimators, the bias becomes convergent to zero. It is reasonable when there is a trade-off between the variance and bias. In summary, while the GPS approach give low bias and lower variance, the combination approach gives low bias and higher variance since text features may contain more noise. Higher variance does not mean lower accuracy or F1. It just explains how the data samples spread out from the mean and from one another.

# 5 Discussion

In this section, we present our plans for future work and the threat model.

**Feature Improvement.** First, the addresses were extracted in English. Since most of the collected GPS records are in Japan, applying semantic text mining on Japanese addresses may have some other meanings. For example, “Minato-ku” means the name of a ward in Tokyo, but in Japanese Kanji, it also means a port; and in fact, Minato ward is near to a port. It is possible since the Google reverse geocoding supports the Japanese language. Second, we used ($tf-idf$) as the text features in the current experiment. $tf-idf$ is used when the lengths of every text are too different, so it is possible that a word may occur much more times in long texts than shorter texts. However, the addresses have almost the same length, the word occurrence count or $tf$ may be enough for the text features. Third, the standard scaling was used for normalizing the features. Combining it with other feature scalings (e.g., Robust scaling) may give some extra information. Four, the number of features extracted from the addresses is large, e.g., 3,805 features for 50 users. To improve the accuracy, the number of features can be reduced by selecting only the most important features. A threshold $\phi$ can be determined, then only the top features with $tf-idf \ge \phi$ are chosen. A large $\phi$ is not necessary since all the algorithms are compared in the same dataset and parameter setting, so it is fair.
**Threat Model and Other Behavioral Data.** In such authentication system, the threat model deals with insider attack in which an authorized user tries to obtain the authentication from the other authorized users. Collusion attack (the authorized users in the system share their data together) and outsider attack (i.e., network eavesdropping, device hacking, etc.) are assumed in the model. Mitigating the attack can be done via improving the authentication accuracy. Proposing new approaches to achieve a high accuracy with a low false positive rate is the main goal in such authentication system. Besides extending the GPS collection, we launched a project to collect other behavioral data, i.e., calorie burning, distance, heart rate, ladders, sleep, speed, steps using wearable devices like smartwatch. A first result from this project can be found in [24]. Integrating different behavioral data for authentication is a future work.

## 6 Conclusion

In this paper, we proved that the GPS-based authentication can improve itself using its metadata. The address can be inferred from the GPS without the need to extract any other information. We collected 14,655 GPS records from 50 users. We extracted the address using the reverse geocoding. We applied text mining on the addresses and selected 3,803 text features using the tf-idf. Ensemble boosting and averaging algorithms are applied to the multi-class classification. The result showed that the combining approach outperforms the GPS approach using AdaBoost and GradientBoost.

## References

1. Cabinet Office, the Government of Japan, Society 5.0. https://www8.cao.go.jp/cstp/english/society5.0/index.html

2. George, D., Mallery, P.: SPSS for Windows Step by Step: A Simple Guide and Reference (17.0 Update). Allyn and Bacon, Boston (2010)

3. Google Geocoding and Reverse Geocoding. https://developers.google.com/maps/documentation/geocoding/intro

4. Thao, T.P., et al.: Influences of human demographics, brand familiarity and security backgrounds on homograph recognition. arXiv:1904.10595 (2020)

5. Thao, T., et al.: Human factors in homograph attack recognition. In: 18th International Conference on Applied Cryptography and Network Security (ACNS 2020) (2020)

6. Zhu, J., Hui, Z., Saharon, R., Thevor, H.: Multi-class AdaBoost. Stat. Interface 2, 349–360 (2009)

7. Friedman, J.: Greedy function approximation: a gradient boosting machine. Ann. Stat. 29(5), 1189–1232 (2001)

8. Geurts, P., Damien, E., Wehenkel, L.: Extremely randomized trees. Mach. Learn. 63(1), 3–42 (2006)

9. Louppe, G., Geurts, P.: Ensembles on random patches. In: Flach, P.A., De Bie, T., Cristianini, N. (eds.) ECML PKDD 2012. LNCS (LNAI), vol. 7523, pp. 346–361. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-33460-3_28
10. Breiman, L.: Random forests. Mach. Learn. 45(1), 5–32 (2001)

11. Thao, T., Yamada, A., Murakami, K., Urakawa, J., Sawaya, Y., Kubota, A.: Classification of landing and distribution domains using Whois's text mining. In: 16th IEEE Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom-17), pp. 1–8 (2017)

12. Fridman, L., Steven, W., Rachel, G., Moshe, K.: Active authentication on mobile devices via stylometry, application usage, web browsing, and GPS location. IEEE Syst. J. 11(2), 513–521 (2016)

13. Scikit-learn. scikit-learn.org

14. Shi, W., Yang, J., Jiang, Y., Yang, F., Xiong, Y.: SenGuard: passive user identification on smartphones using multiple sensors. In: IEEE 7th Conference on Wireless and Mobile Computing, Networking and Communications (WiMob 2011), pp. 141–148 (2011)

15. Alejandro, A., Aythami, M., Vera-Rodriguez, R., Julian, F., Ruben, T.: MultiLock: mobile active authentication based on multiple biometric and behavioral patterns. In: Multimodal Understanding and Learning for Embodied Applications (MULEA 2019), pp. 53–59 (2019)

16. Aaron, B., Christopher, D., Barry, G., David, K.: System and method for real world biometric analytics through the use of a multimodal biometric analytic wallet. US patent, US20180276362A1 (2018)

17. Radu, V., et al.: Multimodal deep learning for activity and context recognition. In: Interactive, Mobile, Wearable and Ubiquitous Technologies (IMWUT 2018), Article no. 157 (2018)

18. Castiglione, A., Santis, A., Soriente, C.: Taking advantages of a disadvantage: digital forensics and steganography using document metadata. J. Syst. Softw. 80(5), 750–764 (2007)

19. Duy, B., Guilherme, F., Siddhartha, J.: PDF text classification to leverage information extraction from publication reports. J. Biomed. Inform. 61, 141–148 (2016)

20. Dirk, B., Shu, L., Mitch, K., Aaron, S., Charles, C., John, D.: Modifying smartphone user locking behavior. In: 9th SOUPS 2013 Symposium, article no. 10, pp. 1–14 (2013)

21. Egelman, S., Jain, S., Portnoff, R., Liao, K., Consolvo, S., Wagner, D.: Are you ready to lock? In: ACM Conference on Computer and Communications Security (CCS 2014), pp. 750–761 (2014)

22. Harbach, M., Zezschwitz, E., Fichtner, A., Luca, A., Smith, M.: It's a hard lock life: a field study of smartphone (un)locking behavior and risk perception. In: 10th USENIX Conference on Usable Privacy and Security (SOUP 2014), pp. 213–230 (2014)

23. Thao, T., Sawaya, Y., Nguyen-Son, H., Yamada, A., Omote, K., Kubota, A.: Hunting brand domain forgery: a scalable classification for homograph attack. In: 34th International Information Security and Privacy Conference (IFIP Sec 2019), pp. 3–18 (2019)

24. Thao, T., Takahashi, M., Shigeta, N., Irvan, M., Nakata, T., Yamaguchi, R.: Human factors in exhaustion and stress of Japanese nursery teachers: evidence from regression model on a novel dataset. In: 13th International Conference on Advances in Computer-Human Interactions (ACHI 2020) (2020)