  An empirical investigation of active/continuous authentication for
smartphones is presented in this paper by exploiting users' unique application
usage data, i.e., distinct patterns of use, modeled by a Markovian process.
Variations of Hidden Markov Models (HMMs) are evaluated for continuous user
verification, and challenges due to the sparsity of session-wise data, an
explosion of states, and handling unforeseen events in the test data are
tackled. Unlike traditional approaches, the proposed formulation does not
depend on the top N-apps, rather uses the complete app-usage information to
achieve low latency. Through experimentation, empirical assessment of the
impact of unforeseen events, i.e., unknown applications and unforeseen
observations, on user verification is done via a modified edit-distance
algorithm for simple sequence matching. It is found that for enhanced
verification performance, unforeseen events should be incorporated in the
models by adopting smoothing techniques with HMMs. For validation, extensive
experiments on two distinct datasets are performed. The marginal smoothing
technique is the most effective for user verification in terms of equal error
rate (EER) and with a sampling rate of 1/30s^{-1} and 30 minutes of historical
data, and the method is capable of detecting an intrusion within ~2.5 minutes
of application use.
