## 3 Data Collection and Preprocessing  
As illustrated in Figure 1, we collected the experimental data based on the developed Android-based data collector. The experiment involved 40 participants, each of whom, in a sitting position, drew 13 predefined patterns 20 times with both hands by using the Samsung Galaxy S8 smartphone. The parameters of the experimental environment are listed in Table 1. As presented in Table 2, the experimented drawing patterns comprised five English, five freestyle, and three Korean patterns. We set one of the most unfavorable experimental environments possible, for the authorized users during the authentication process, wherein all potential intruders know the authenticated user's drawing pattern (e.g., shape, direction, and number of strokes), as illustrated in Figure 2 (for complete information of the patterns used this study, refer to Appendix A). Consequently, we assumed threat scenarios, such as SSA and SA, for our experimental design. The seven variables in the collected raw data are described in Table 3. \(Timestamp_{t}\) denotes the absolute time at which data were collected at time at which data were collected at time \(t\). The unit of \(Timestamp_{t}\) is nanosecond (\(ns\)). \(Act_{t}\) denotes the touch state at time \(t\) and takes values of D (down), M (move), and U (up). D and U represent the states of contact \begin{table}
\begin{tabular}{c c} \hline \hline
**Experimental Factor** & **Value** \\ \hline Total number of participants & 40 \\ Number of drawing patterns & 13 \\ Repetition of each drawing pattern & 20 \\ Smartphone device & Samsung Galaxy S8 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Experimental environment. Figure 1: Android application-based data collector. Menus in the guideline in Korean is some supportive information when collecting keystroke data from each participant. Figure 2: Details of English, Freestyle, and Korean patterns. and detachment, respectively, of the touch screen with the fingertip. If the fingertip moves on the touchscreen at time \(t\), \(Act_{t}\) is represented as M. \(X_{t}\) and \(Y_{t}\) denote the coordinates of the x- and y-axes at time \(t\), respectively. \(Ax_{t}\), \(Ay_{t}\), and \(Az_{t}\) denote the angular velocity for the x-, y-, and z-axes at time \(t\), derived from the accelerometer sensor. Figure 3 illustrates a single line drawn by the participants on the touchscreen using a fingertip. The collected sequential raw data from the single line example are listed in Table 4. D and U are both collected once because of the action of drawing the line once. Table 5 lists the data that transform two consecutive records from Table 4. \(T\_Diff_{(t,t-1)}\) is computed using Equation (1), and it refers to the time difference between \(t\) and \(t+1\). We used the transformed data for building a user-authentication model. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Timestamp** & \(Act\) & \(X\) & \(Y\) & \(Ax\) & \(Ay\) & \(Az\) \\ \hline
0 & D & 55.12 & 65.48 & \(-\)0.25 & \(-\)0.21 & \(-\)0.01 \\
10 & M & 67.15 & 63.58 & \(-\)0.63 & 0.06 & 0.02 \\
20 & M & 83.11 & 63.58 & \(-\)0.16 & \(-\)0.06 & \(-\)0.02 \\
30 & M & 95.54 & 65.48 & 0.18 & \(-\)0.21 & \(-\)0.01 \\
40 & M & 115.6 & 66.12 & \(-\)0.14 & 0.08 & 0.02 \\
50 & M & 128.4 & 67.25 & \(-\)0.16 & \(-\)0.05 & \(-\)0.02 \\
56 & U & 130.4 & 69.25 & 0.18 & \(-\)0.10 & \(-\)0.01 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Sample of the collected raw data. Figure 3: Example of data collection (\(TS\) denotes timestamp).