  With the increased popularity of smartphones, various security threats and
privacy leakages targeting them are discovered and investigated. In this work,
we present \ourprotocoltight, a framework to authenticate users silently and
transparently by exploiting dynamics mined from the user touch behavior
biometrics and the micro-movement of the device caused by user's screen-touch
actions. We build a "touch-based biometrics" model of the owner by extracting
some principle features, and then verify whether the current user is the owner
or guest/attacker. When using the smartphone, the unique operating dynamics of
the user is detected and learnt by collecting the sensor data and touch events
silently. When users are mobile, the micro-movement of mobile devices caused by
touch is suppressed by that due to the large scale user-movement which will
render the touch-based biometrics ineffective. To address this, we integrate a
movement-based biometrics for each user with previous touch-based biometrics.
We conduct extensive evaluations of our approaches on the Android smartphone,
we show that the user identification accuracy is over 99%.
