A Siamese Neural Network for Behavioral Biometrics Authentication

1 INTRODUCTION . Biometric authentication has emerged as a complement to traditional authentication systems . The main advantage of such systems is that they rely on user ’ s information that can not easily be stolen or crafted . Most active fields of biometric authentication in academia and industry are related to face authentication or fingerprint authentication , with a recent increase in interest on behavioral biometrics . Behavioral Biometrics authentication refers to the use of human-device interaction features to grant access to a specific service . This interaction could include , but is not limited to , typing patterns , mouse dynamics , smartphone holding patterns , voice recognition , gait recognition etc . Machine learning algorithms have been proposed to verify users identity using behavioral biometrics features . Regarding behavioral biometrics in web environments ( Human-Computer interaction ) , most of the work has focused on the use of Support Vector Machine and Random Forest classifiers to analyze mouse and keyboard interaction ( Khan et al. , 2018 ; Solano et al. , 2020 ) . Alternatively , some works have proposed to use built-in sensors available in mobile devices ( i.e sensors information , touch interaction etc . ) for authentication purposes ( Rauen et al. , 2018 ; Rocha et al. , 2019 ; Zhang et al. , 2016 ; Amini et al. , 2018 ; Abuhamad et al. , 2020 ) . However , previous works in behavioral biometrics usually have three main drawbacks : ( 1 ) they need long interactions ( minutes ) in order to learn accurately the user behavior ; ( 2 ) they require ad-hoc interaction challenges ; or ( 3 ) they need a model per user to improve model accuracy . In this paper , we present a Siamese One-Shot Neural Network ( SOS-NN ) which is able to assess a risk score after only one observation ( i.e . enrollment behavior ) of a given user . To achieve this , we propose a Siamese Neural Network architecture that assesses whether two behaviors belong to the same user . We present a similar architecture to user verification for both , web and mobile environments . In web environments , we create a set of features from raw mouse movements and keyboard strokes . On the other hand , for the mobile environment our SOS-NN analyses features created from touch interaction and motion sensors on the smartphone . In sum , the contributions of our work are : ( 1 ) An approach to user authentication using behavioral biometrics information in an accurate few-shot learning fashion after only 5 seconds of user interaction ; ( 2 ) A unified neural network architecture to authenticate user ’ s behavior for both mobile and web environments that is able to achieve an accuracy of up to 99.8 % and 90.8 % respectively ; ( 3 ) A framework which is able to accurately authenticate users in a large scale without requiring to retrain the model for new users ; ( 4 ) A systematic measurement study to understand the impact of the parameters to SOS-NN based on the authentication time window length and the n number in the n-shot test ; and ( 5 ) A comprehensive in the wild evaluation of our approach in web environments which test SOS-NN over thousands of users from real financial services . 2 BACKGROUND . In the field of biometric-based authentication , many sources of information have been proposed . These could be physical ( facial recognition , fingerprint scanning , retina scan , etc ) or behavioral patterns ( signature verification , mouse dynamics , gait analysis , voice recognition , etc. ) . Behavioral biometrics has gained increased attention since reproducing the behavior of a legitimate user constitutes an unconventional challenge for attackers . Moreover , many behavioral biometric methods do not require specialized hardware , which makes a scalable deployment easier . While substantial advances have been achieved , there is still a gap to make such systems widely adopted in practice . We define as ‘ practical ’ methods that demand short periods of interaction per user ( both for model training and for authentication ) , and simple architectures that ease deployment and maintenance . This paper proposes a novel approach , which complements traditional authentication in web and mobile environments , considering practical implementation characteristics and scalability constraints . Web Environment . Multiple previous studies have employed multimodal biometrics in desktop environments to identify user ’ s behaviour ( Traore et al. , 2012 ; Bailey et al. , 2014 ; Fridman et al. , 2015 ; Neha & Chatterjee , 2019 ; Solano et al. , 2020 ) . These studies propose to integrate , either at the feature or decision level , information from keyboard interaction , mouse dynamics and others . Most of these studies have evaluated classic ML classification models ( e.g . SVM , Naive Bayes , Random forest and J48 algorithms ) . Few others ( Jagadeesan & Hsiao , 2009 ; Khan et al. , 2018 ) , have explored the use of shallow neural networks . Remarkably , we found that siamese neural architectures had not been studied before in this field . Therefore , in this study , we explore the effectiveness , generalization and applicability of such architectures for behavioral biometrics . Regarding user interaction , we highlight that , in multiple real-world applications there is a practical limit to the length of the interaction and amount of data that can be collected before deploying an authentication model , particularly when enrolling new users to the system . Therefore , we compared previous approaches on the amount of interaction required , per user , to train the model . We are comparable to few studies ( 4 ) , that require between 2min . to approximately 30min . of user interaction to train the model . As an illustration , Khan et al . ( 2018 ) reported an accuracy of 97.3 % using an SVM model per user , however , their approach would require recording at least 30 previous login attempts ( ≈15 minutes ) to train each user ’ s model . A more recent approach proposed by Neha & Chatterjee ( 2019 ) achieves an accuracy of 95.6 % after training a MLP for each user but they required 50 logins ( ≈ 25 minutes ) for training phase . On the scalability perspective , previous studies use authentication paradigms that involve one model per user or multiclass classification , these methods translate into large infrastructure , deployment , monitoring and maintenance challenges . In contrast , our SOS-NN model generates a measure of similarity between two behaviors in a latent feature space . In this case , the question is not whether the sample belongs to a particular user , but rather if the samples are similar enough to conclude that the user is the same . This one-model-for-all ( OfA ) paradigm facilitates deployment and avoids further training for every new user registered in the system . To the best of our knowledge the SOSNN model and OfA paradigm have not been applied in desktop/web behavioral biometrics before . On Appendix A , we compare with further detail , previous approaches with respect to the classification methods used , the authentication paradigm and user interaction required . Mobile Environment . Likewise , behavioral biometrics for authentication has also been implemented for mobile environments . Such models complement traditional authentication by taking advantage of the multiple built-in sensors available in mobile devices , being able to capture user behavior through several modalities . Some modalities rely on the use of mobile keyboard dynamics ( Cilia & Inguanez , 2018 ) ; touchscreen interaction ( Rauen et al. , 2018 ; Rocha et al. , 2019 ) ; or embedded motion sensors data ( Abuhamad et al. , 2020 ) to authenticate users . In order to strengthen security , especially against ad-hoc adversarial attacks , multimodal authentication frameworks have been proposed by researchers ( Stanciu et al. , 2016 ; Sitová et al. , 2015 ; Lamiche et al. , 2019 ; Acien et al. , 2019 ; Lin et al. , 2018 ; Volaka et al. , 2019 ; Shen et al. , 2016 ; Centeno et al. , 2018 ) . Those methods rely on the fusion of multiple modalities of behavioral information ( i.e . keyboard , sensors , touch , etc . ) with the goal of having a better performance . Previous works , have achieved low False Aceptance Rate ( FAR ) and False Rejection Rates ( FRR ) . However , they require a one-model-peruser paradigm ( OpU ) and long user interaction times ( > 10min . ) , which makes them challenging to use in real world scenarios . In our review , the best comparable performance was reported by Stanciu et al . ( 2016 ) , with FAR and FRR equal to 0.14 % , nonetheless , the system would require one K-Nearest Neighbors model per user and 20 previous logins for training each model . Appendix A presents a detailed comparison between the main state-of-the-art studies developed in mobile behavioral biometrics in terms of the type of model requirements and performance characteristics . To the best of our knowledge we are the first study that uses Siamese Networks for mobile multimodal behavioral biometrics , with high resulting performance compared to existing solutions and capable of assessing a score after 5sec . of user ’ s interaction . Siamese Networks . Siamese Neural Networks were first introduced by Bromley et al . ( 1994 ) to verify hand-written signatures . In general , Siamese Networks are composed of two twin sub-networks and a similarity module which compares the outputs of both sub-networks . Consequently , Siamese Networks are trained by feeding a pair of inputs which are processed by each twin in the network . Siamese networks have been used for verification tasks because of their capabilities to create embedding representations which minimizes similarity between samples from different classes ( Melekhov et al. , 2016 ; Boenninghoff et al. , 2019 ) . In the field of behavioral biometrics , Siamese Networks have been implemented to approach different behavioral modalities , like face recognition ( Schroff et al. , 2015 ; Taigman et al. , 2014 ) , signature recognition ( Dey et al. , 2017 ) , gait recognition ( Zhang et al. , 2016 ) , among others . Regarding the use of Siamese Networks for behavioral biometrics authentication in web and mobile environments , Centeno et al . ( 2018 ) used Siamese Networks along with CNNs as a tool to create embeddings from motion sensors plots , and then feed them into a oneclass SVM classifier . More recently , Giot & Rocha ( 2019 ) proposed the use of Siamese Networks to approach static authentication model using keyboard dynamics in web environments . Furthermore , Siamese Networks have been extensively used to approach classification problems in which the few samples of each class are available to learn from ( i.e . Few-shot Learning ) ( Hindy et al. , 2020 ) . Particularly , it is possible to go as far as to limit the number of available samples to only one ( one-shot learning ) . In one-shot learning literature , Siamese Networks have shown promising results in tackling classification tasks , under the restriction of observing only one sample before making a prediction over a test instance ( Koch et al. , 2015 ; Triantafillou et al. , 2017 ) . To the best of our knowledge there are no previous works on the use of Siamese Networks to approach multimodal behavioral biometrics authentication in web or mobile environments . Specifically , our approach differs from others in that it ( 1 ) focuses on one-shot learning , ( 2 ) implements semi-hard pair selection , and ( 3 ) learns from different behavioral sources in both web and mobile environment .

Summary: This paper proposes the use of siamese neural networks for the task of user verification by learning to identify their behavioral patterns of interaction with mobile phones or web browsers. Notably, the behavioral characteristics of users when engaging with these devices, measured in the form of mouse movements or keyboard typing patterns on browsers or touch patterns on mobile phones, serve as a proxy for more direct biomarkers such as face recognition, eye scans, etc. The authors argue that the latter requires more specialised hardware and is thus not easily scalable. Instead, they architect the first NN based solution that serves both modalities, web and mobile phones, while trying to be more accurate and responsive.