# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Inference-Based (Biometric) Authentication
#### 4.2.2 Behavioral Biometrics
[128] proposed and evaluated a continuous authentication system to deal with impersonation attacks from insider threats who have physical access to HMD devices. They based the system on Sparse Representation Classification (SRC) using eye movement data. First, they developed a prototype of SG that allows them to apply both implicit and explicit stimuli to the user and collect eye movement data from the user at the same time. Their longitudinal verification study supported the stability of the system and showed that a user can be identified with an EER of 6.9 for a one-day dataset vs. an EER of 9.7% for a two-week dataset. Furthermore, their comparative study results revealed that the SRC classifier outperformed SVMs and Nearest Neighbour (k-NN) classifiers. In addition, they carried out impersonation attack experiments where the attackers learned to imitate the users' eye movements. The results of the impersonation experiments show that a successful attack can be reached after an average of 5.67 attempts, and they argue that successful attempts can be prevented by using complex scenes. Lastly, they finalized their studies by evaluating the acceptance of the implicit stimuli among 50 participants through a questionnaire survey. A minimum of 60% of participants expressed satisfaction with the used stimuli. [PERSON] et al. [129] presented a system that uses minimal eye-gaze-based features to authenticate users. They designed an educational power production VR environment for the purpose of data collection and gathered eye gaze data from 34 subjects without applying any stimuli. A recursive feature elimination algorithm was used to minimize the number of needed features in order to reduce computation costs. They tested and compared many ML and deep DL, such as Random Forest (RF), k-NN, Long Short-Term Memory (LSTM), and CNNs, using different sets of features (12 and 6 feature sets); all models reached 98% accuracy. They additionally ran the same models using different data features and sessions; the overall results did not show a significant difference, meaning that using the smallest set of features (6 feature sets) would be an optimal cost-effective solution. At the end, participants in the study were surveyed about the usability of the VR tutorial. In [130], [PERSON] et al. investigated gaze-trajectory-based passwords as a replacement for fixation-gaze-based passwords. After enrolling, users authenticate by using the same free-form-gaze password saved during enrollment, which is then compared to the password they have previously saved, leading to a binary authentication decision. The gaze direction captured by the eye-facing cameras placed on the SG is obtained from pupil movements instead of gaze points; this represents a gaze password in the shape of a horizontal and vertical eye movement time series. They used Dynamic Time Warping (DTW) to match time series samples, and their authentication results reached an EER of 16. An interesting finding of the collected dataset with 19 participants was that most passwords can be partially described as well-known geometrical shapes instead of free-form passwords, but knowing the shape of the password is not sufficient information to reconstruct a password, and more details are needed, such as the end and start points of the password. Their spoofing attack evaluation resulted in a total failure to crack the password, and the user study results indicated that users believe it would be challenging for hackers to speculate on the password without seeing it at the enrollment stage. [PERSON] et al. [131] focused on incorporating linguistic features into eye movement-based authentication. They used an eye movement dataset collected from participants performing poem reading tasks in the Gazebase database used in [124,125]. After extracting fixation features and filtering short ones, they associated each eye movement fixation with its underlying token and added word features for each token from the open-source CELEX database.