Forgery-Resistant Touch-based Authentication on Mobile Devices
\alignauthor Neil Zhenqiang Gong
\affaddr{ECE
Iowa State University
Mobile devices store a diverse set of private user data and have gradually become a hub to control users' other personal Internet-of-Things devices. Access control on mobile devices is therefore highly important. The widely accepted solution is to protect access by asking for a password. However, password authentication is tedious, e.g., a user needs to input a password every time she wants to use the device. Moreover, existing biometrics such as face, fingerprint, and touch behaviors are vulnerable to forgery attacks. We propose a new touch-based biometric authentication system that is passive and secure against forgery attacks. In our touch-based authentication, a user's touch behaviors are a function of some random ``secret''. The user can subconsciously know the secret while touching the device's screen. However, an attacker cannot know the secret at the time of attack, which makes it challenging to perform forgery attacks even if the attacker has already obtained the user's touch behaviors. We evaluate our touch-based authentication system by collecting data from 25 subjects. Results are promising: the random secrets do not influence user experience and, for targeted forgery attacks, our system achieves 0.18 smaller Equal Error Rates (EERs) than previous touch-based authentication.
touchalytics.tex
\documentclass{sig-alternate-05-2015}
%\documentclass{sig-alternate}
\usepackage{graphicx,color,url,footmisc}
%\usepackage[square]{natbib}
\usepackage{booktabs}
\usepackage{synttree}
\usepackage{multirow}
\usepackage{amsmath} 
\usepackage{caption}
\newcounter{copyrightbox}
\usepackage{subfig}
\usepackage{balance}
%\usepackage[%
%    breaklinks=true,colorlinks=true,linkcolor=black,%
%     citecolor=black,urlcolor=black,bookmarks=true,bookmarksopen=false,%
%    pdfauthor={},
%    pdftitle={}
%    ,pdftex]{hyperref}  
 
\newcommand{\mf}[1]{{\small\color{red}[Mario: #1]}}
\newcommand{\neil}[1]{{\small\color{green}[Neil: #1]}}
\newcommand{\mat}[1]{{\small\color{blue}[Mathias: #1]}}

\newcommand{\ie}{{\em i.e.}}
\newcommand{\eg}{{\em e.g.}}

 \newcommand{\myparatight}[1]{\smallskip\noindent{\bf {#1}:}~}

\newenvironment{packeditemize}{\begin{list}{$\bullet$}{\setlength{\itemsep}{2pt}\addtolength{\labelwidth}{4pt}\setlength{\leftmargin}{20pt}\setlength{\listparindent}{\parindent}\setlength{\parsep}{0pt}\setlength{\topsep}{0pt}}}{\end{list}}


\begin{document}

 \CopyrightYear{2016} 
\setcopyright{acmcopyright}
\conferenceinfo{ASIA CCS '16,}{May 30-June 03, 2016, Xi'an, China}
\isbn{978-1-4503-4233-9/16/05}\acmPrice{\$15.00}
\doi{http://dx.doi.org/10.1145/2897845.2897908}

%\title{Defending against Forgery Attacks in Touch-based Continuous Authentications on Mobile Devices}
\title{Forgery-Resistant Touch-based  Authentication on Mobile Devices}

\numberofauthors{4}

\author{
\alignauthor Neil Zhenqiang Gong\\
       \affaddr{ECE, Iowa State University}\\
       \email{neilgong@iastate.edu}
\alignauthor Mathias Payer\\
       \affaddr{CS, Purdue University}
       \email{mathias.payer@nebelwelt.net}
\and
\alignauthor Reza Moazzezi\\
       \affaddr{EECS, UC Berkeley}\\
       \email{rezamoazzezi@berkeley.edu}
\alignauthor  Mario Frank\\
       \affaddr{EECS, UC Berkeley}
       \email{mail2mf@gmx.de}
}
\maketitle

%\input{abs}
\begin{abstract}
Mobile devices store a diverse set of private user data and have gradually
become a hub to control users' other personal Internet-of-Things devices.
Access control on mobile devices is therefore highly important.  The widely
accepted solution is to protect access by asking for a password.  However,
password authentication is tedious, e.g., a user needs to input a password every
time she wants to use the device. Moreover, existing biometrics such as face,
fingerprint, and touch behaviors are vulnerable to forgery attacks. 

We propose a new touch-based biometric authentication system that is passive and
secure against forgery attacks.  In our touch-based authentication, a user's
touch behaviors are a function of some random ``secret''.  The user can
subconsciously know the secret while touching the device's screen. However, an
attacker cannot know the secret at the time of attack, which makes it
challenging to perform forgery attacks even if the attacker has already obtained
the user's touch behaviors.  We evaluate our touch-based authentication system
by collecting data from 25 subjects.  Results are promising: the random secrets
do not influence user experience and, for targeted forgery attacks, our system
achieves 0.18 smaller Equal Error Rates (EERs) than previous touch-based
authentication.  

\end{abstract}



\ccsdesc[500]{Security and privacy~Authentication}
\ccsdesc[300]{Security and privacy~Biometrics}


%
% End generated code
%

%
%  Use this command to print the description
%
\printccsdesc

% We no longer use \terms command
%\terms{Theory}

\keywords{touch biometrics; mobile authentication; forgery-resistant biometrics}



%\input{intro}
\section{Introduction}

%mobile devices are getting popular
Since the introduction of the first iPhone by Apple in June 2007, touch based
mobile devices have become ubiquitous. For instance,  the volume of the
smartphone market has already surpassed that of the PC market in
2011~\cite{smartphoneMorethanPC}. Users often store a large amount of sensitive
data on mobile devices. Moreover, with the advent of Internet-of-Things (IoT)
devices such as smartwatches, fitness trackers, the Nest Thermostat~\cite{Nest},
and medical devices like Bee~\cite{Bee}, smartphones have gradually become the
hub of IoT. Specifically, a user could use a smartphone to control her
smartwatch, adjust home temperature via remotely controlling the Nest
Thermostat, and view the user's insulin injection data and glucose levels from
Bee. Access control on mobile devices is important because having access to a
user's mobile device allows an attacker to 1) access the user's personal data,
and 2) control the user's other connected IoT devices and access sensitive data
on them. For instance, an attacker that obtains access to a smartphone can
access the user's sensitive SMS messages, emails, and apps, %that the user didn't
%log out, 
as well as manipulate the user's home temperature by remotely
controlling the connected Nest Thermostat.  
 
 
 The most popular method to address such threats is to authenticate a user via
\emph{password} before allowing her to use the device, i.e., the user logs in
the device with a correct password. However,  users might turn off password
authentication because it is tedious and
inconvenient~\cite{NolockSOUPS13,whylockCCS14,sophos}. For instance,  Egelman et
al.~\cite{whylockCCS14} showed that 42\% of users do not lock their smartphones,
and 34\% of them do so because locking is ``too much of a hassle". Moreover, it
is well known that  conventional biometrics such as face, fingerprint, and voice
are  vulnerable to forgery
attacks~\cite{AttackingAndroidFaceAuthentication,AttackingAndroidFaceAuthenticationLiveness,fingerprintForgeryAttack}.
For instance, fingerprint readers can be tricked by taking an image of the
fingerprint, forming a mold, and using wood glue to make a fake
finger~\cite{fingerprintForgeryAttack}. Therefore, it is urgent to design secure
and usable authentication methods. 
 
%Thereafter, the smartphone market has continued to increase dramatically, e.g.,
%the smartphones shipped in the third quarter of 2013 increased 44\% year on
%year~\cite{smartphoneSales}.



%Touch based devices
%like smartphones or tablets are dominating the market and tablet sales 
%are predicted to pass PC sales in the near
%future~\cite{Tabletsales}.

%Mobile devices are becoming more and more popular in the past few years.  

%\footnote{Tablet sales grew with a rate of 78.4\% in 2012 and are
%predicted to pass PC sales in 2014:
%\url{http://techcrunch.com/2013/03/27/idc-tablet-growth-2012-2017/}.}.

%New authentication challenges

%These touch based devices introduce a set of novel challenges, regarding
%programming models, application distribution, user interfaces, security, and
%authentication. 

%Due to the large amount of personal data on these mobile devices, 
%authentication and access control are very important. However, a recent study~\cite{sophos} shows
%that 70\% of all users have turned off PIN authentication on their smartphones. 
%Therefore, it is urgent to develop novel authentication mechanisms that are both usable and secure. 
%A topic of particular interest is to develop 
%authentication systems that continuously authenticate the user while using the
%device, without the authentication system interrupting the user's work flow.

%touch-based authentication is a possible solution
A number of recent studies have raised the possibility of using low level
interactions such as how a user touches the screen  as a biometric signature for authentication in
mobile devices~\cite{bo2013silentsense, munichGuys, frank2013touchalytics,
li2013unobservable, sae2012investigating}.  The key idea for such authentication
mechanisms is that users produce touch data all the time when using the device so
that authentication can be \emph{passive}, i.e., without requiring  the user to
carry out any action dedicated to authentication. 
%The first papers on
%touch-based authentication (for instance~\cite{frank2013touchalytics,
%li2013unobservable}) have shown that low-level interactions between users and
%smartphones can quickly and reliably detect possible intrusions. A consequential
%aspect of low-level interactions is that they potentially provide a significant
%amount of evidence within short time windows, which is critical for fast
%detection of any malicious activity.


%A significant drawback of biometric authentication solutions (compared to
%non-biometric solutions like passwords) is that biometric information cannot be
%revoked or changed. If an attacker possesses the biometric information (or
%recorded traces thereof) then replay attacks become possible. The attacker can
%use the leaked information to impersonate an existing user and bypass the
%authentication. 

%problems of existing work
However, this touch-based authentication mechanism, like conventional
biometrics, is also vulnerable to forgery attacks. For instance, an attacker
(e.g., a `friend' or the spouse of the targeted user) can collect the targeted
user's touch data via convincing her to use the attacker's mobile devices and
recording her touch data. Later, the attacker can program a Lego robot to replay
the collected touch data on the targeted mobile device, which can compromise the
authentication system with  a high probability~\cite{attack-CCS13}.  
%Therefore, it is well known that biometrics are fundamentally vulnerable to
%forgery attacks and defending against them is very challenging.  replay the
%collected touch data and compromise the authentication system with a high
%probability. 

%A second problem that remains open is how a user's touch signature is 
%influenced by the defining settings of the touch screen. Intuitively,
% a screen setting transforms a user's raw touch data registered by the sensors,
% and an application on the mobile device interprets the transformed data. 
%For instance, one transformation is to distort the X or Y axis; a zoom-in
% distortion  makes the actual movement sent to an application 
% larger than the movement registered by the sensors. 

 
\myparatight{Our work} In this work, we demonstrate a defense against forgery
attacks to touch-based biometrics. 
%Our proposal represents the first forgery-resistant biometric authentication. 
In particular, we  defend against forgery attacks by leveraging the impact of
screen settings (serving as a random ``secret") on a user's touch behavior. The
sensors on the screen of a mobile device record where, when, how fast, and how
heavily a user's finger touches the screen.  Before the recorded raw data is
sent to applications on the mobile device, our approach transforms the data as
it passes through the operating system according to a \emph{screen setting}.
For instance, a screen setting of 0.8 horizontal distortion means that a 1.0cm
long horizontal line starting at a certain location  on the screen is received
by the application as a 0.8cm long horizontal line starting at the same
location. Due to such modifications, the running applications react differently
to the actions of the user. As a consequence, the user will adapt her touch
behavior (i.e., raw touch data recorded by screen sensors) in order to achieve
the desired application behavior.  Ideally, the adaptation is performed
subconsciously, i.e., the user does not explicitly notice that the screen
settings have changed but still adapts the touch behavior to compensate for this
change. We investigate the impact of screen settings on a user's touch behavior
and their applications to defend against forgery attacks. 
%We investigate the impact the raw touch patterns are altered by screen
%settings. In particular i)  Can the user still be recognized based on the
%altered touch patterns, i.e. are the patterns \emph{stable}? ii) Can a
%classifier distinguish between original touch behavior and altered touch
%behavior, i.e. are the patterns \emph{sensitive} to screen modifications? and
%iii) does the user notice that screen settings vary?.  Does the user
%subconsciously adapt her touch behavior without noticing that screen settings
%vary? What is the impact of screen settings on a user's behavior? And can we
%leverage multiple screen settings to defend againt forgery attacks? Our work
%aims to answer these questions. 

\begin{figure}[!t]
%\vspace{-4mm}
\centering
%\vspace{-2mm}
{\includegraphics[width=0.40\textwidth]{sta-sen.pdf}}
\vspace{-5mm}
\caption{Concepts of stability and sensitivity.}
\label{sta-sen}
\vspace{-3mm}
\end{figure}

First, we find that, when screen settings are discretized properly,
  a user's touch behavior  in two different screen settings is \emph{stable},
 meaning that the behavior difference between two different users in the same setting 
is larger than that between two different settings for the same user. 
Stability guarantees that we can distinguish 
a user's touch behavior from other users'. % for different screen settings. 
Unfortunately, stability implies that if we learn a model to distinguish
 a user's touch behavior from other users' using only a single setting, 
then forgery attacks that replay the targeted user's data collected
 in other settings succeed with a high probability.  
Extending stability, we find that a user's touch behavior in different screen
 settings is also \emph{sensitive}, meaning that they have a high 
degree of separability in the feature space.
 Sensitivity guarantees that one can learn a model to distinguish
 touch behavior of a user in two different screen settings,
 serving as a basis for a sufficient defense against forgery attacks. Figure~\ref{sta-sen}
 shows the concepts of stability and sensitivity.
%Third, users do not recognize moderate changes in screen settings.

%This model will not accept the touch data of the user
% collected in the settings other than $s$. 



Second, based on our findings, we propose a novel  continuous authentication
mechanism called \emph{adaptive touch-based continuous authentication}. Our
system consists of a \emph{registration phase} and an \emph{authentication
phase}. In the registration phase, we sample a set of screen settings in which a
user's touch behavior is both stable and sensitive. Then we train a model for
each setting $s$ to distinguish the behavior of the user in $s$  from the
behavior of the same user in other settings and those of other users in all
considered settings.  In the authentication phase, we randomly sample a
predefined setting and use the corresponding model to continuously authenticate
the user in each time interval. Our authentication system can significantly
decrease the success rate of an attacker who knows the targeted user's touch
data in \emph{all} settings. This is because the attacker cannot know the
setting used by our system at the time of attacks and replaying touch data
collected in a different setting fails to pass the authentication with high
probability.  
%Note that the robot that is programmed to replay touch data cannot
%automatically adapt itself to an unknown/random setting.    


Third, we evaluate our system via collecting data from 25 subjects in five
different settings along the X axis and five different settings along the Y
axis.  We find that users can subconsciously adapt their touch behavior to
different screen settings, i.e., the transitions between two settings do not
interrupt  users nor affect user experiences. 
%Moreover, we find that a user's touch behavior has a \emph{non-Markovian
%property}. Specifically, a user's touch behavior only depends on the current
%setting, not on the previous setting used by the authentication system. 
Moreover, our system achieves 0.02 to 0.09 smaller  mean Equal Error Rates
(EER) than previous work
for random forgery attacks and 0.17 to 0.18 smaller mean EERs than previous work
for targeted forgery attacks; the  registration phase of our authentication
system takes a short period of time, i.e., touch data collected within two
minutes  are enough to train a model for a setting; and our system achieves
smaller EERs with more screen settings.

In summary, our key contributions are as follows:
\begin{packeditemize}
  \item We demonstrate the stability and sensitivity of touch behavior to screen
settings.
	\item We propose a new touch-based continuous authentication mechanism, which
builds on the stability and sensitivity properties of behavioral touch patterns
to achieve forgery-resistant touch signatures. 
	\item We evaluate our authentication system via collecting touch data from
 25 subjects in five  screen settings along the X axis and five screen settings
along the Y axis. We demonstrate that our system significantly outperforms
previous work at defending against forgery attacks. 
\end{packeditemize}


%Therefore, forging the biometric signature is a strong possibility for the
%attacker to overcome this new touch based continuous authentication system. In
%particular, every application on the device has access to the users touch
%patterns while the user runs the application such that these biometric
%signatures cannot be considered secret. Given the users touch signatures the
%problem remains to reproduce them. Two \mf{what's the second one? I only know
%\cite{attack-CCS13}} recent studies have reported that such attacks are indeed
%viable~\cite{attack-CCS13}. Here we address this possibility and suggest a novel
%defense paradigm that effectively blocks such replay attacks.

%Our defense is based on the insight that the touch signatures do not
%authenticate a user as such but rather authenticate a user-device pair. In other
%words, if the hardware of the device changes (for instance, the screen
%sensitivity or stickiness), or if the software on the device motivates the user
%to carry out touch data in a different way, then the touch signature changes,
%alongside.  A touch screen sensor records touch interactions and usually these
%interactions and directly forwarded to the running application.  In our defense
%system we interpose a programmable layer of indirection between the sensor and
%the running application. Our indirection layer implements a coordinate
%transformation between the ``real'' coordinate system as seen by the hardware
%and the ``virtual'' coordinate system as seen by the running application.  To
%protect against replay attacks we exploit the fact that the signature depends on
%the device to add a secret component to the signature.
%
%Our authentication system carries out random subliminal changes in the
%coordinate transformation. Currently our system supports changes along several
%axes: fixed X/Y displacement, distortion along the X/Y axis (i.e., the actual
%movement of the pointer is larger/smaller than the movement registered by the
%sensor), tilt, jitter, and slob. The authentication system uses the raw, real
%data to authenticate the user, while the application interprets with the
%virtual, interposed interactions.  The changes in the parameters are small
%enough to not to be noticed by the user but still affect individual biometric
%signatures. 
%
%Our authentication system learns a predetermined set of classifiers (for
%different coordinate transformations) per user and randomly switches between the
%different settings. Due to the random changes an attacker can only guess which
%setting is currently in use by the device and attacks are reduced to
%probabilistic guessing.
%
%In a user study we show the stability and sensitivity of our authentication
%system and the classifiers. The study shows that our authentication system is
%(i) stable: two classifier outcomes of a user are closer to each other than to
%classifier outcomes of other users and that it is (ii) sensitive: two classifier
%outcomes of a user are distinguishable from each other for different coordinate
%transformations.
%
%Our proposed continuous authentication system mitigates the severe limitation
%of biometric authentication: even an attacker that knows the biometric information
%cannot attack the authentication system. The authenticated biometric signature
%is continuously changed at random intervals.
%
%In this paper we demonstrate that the key assumptions of our proposed defense
%system hold: (i) a subliminal change in defining parameters results in modified
%biometric signature that is clearly different from the old one; (ii) learning the
%new parameters is quick; and (iii) this defense indeed stops any attack based on
%forging outdated touch signatures.
%
%Although we are exploiting the sensitivity of the touch-based biometric
%signature to prevent forge-based attacks, we show that the signature is also
%stable in the sense that old and new signatures of the same user are more
%similar to each other than to other users' prior signatures. The performance of
%a classifier trained on old signatures does not change if tested on the modified
%signatures.
%
%We also examine the performance of the classifier and verify that two distinct
%populations of features mediate the sensitivity and the stability discussed
%above. Interestingly, these populations are different for different users. Such
%diversity dramatically decreases the chances to predict the modified
%signature and therefore improves the effectiveness of our proposed defense
%strategy.


%we cannot write this (should stay anonymous):
%To the best of our knowledge, our team was the first to study the possibility of

%4\% error rate when the authentication test was carried out a week later. We aim
%to improve our previous results in two ways: (i) to improve the accuracy of
%detecting intruders, (ii) to increase the speed of detection. To this end, we plan
%to expand the feature space. In our previous work, we handcrafted the features
%that seemed to be behaviorally relevant and informative (using mutual
%information). However, our method was limited to the features that we used. 

%First, we will expand the feature space to include dynamic (temporal) features.
%Our previous method used static features, for instance, mid-stroke pressure or
%average direction of strokes. We will study dynamic features, for example, how
%pressure or speed changes during a stroke and how much information they carry
%about the identity of the user. This will also provide more information within
%the same time period, which results in faster identification. 
%
%Second, we will employ automatic feature learning techniques to extract the
%informative features. We will then train classifiers on these features. This
%will open the way towards more systematic search for informative features.
%Rather than handcrafting them, we will have a more normative way to learn
%features that can be used as biometric signatures. This will also make it
%possible to extend our method to broader range of tasks that might benefit from
%features that carry biometric information.
%
%Third, we will extract smart phones' acceleration and orientation information
%and learn and include the corresponding informative features. We did not have
%this class of features in our previous work but recent studies have shown that
%they can be a rich source of information. We will combine this with touch-based
%information to extract dimensions that are invariant to phone
%orientation/acceleration.  
%
%Finally, we will implement and train a change detection algorithm that monitors
%the statistics associated with different features associated with the
%acceleration/orientation information and detects any statistically significant
%deviation from the baseline. This might allow us to identify the user even
%before they start interacting with touchscreen.
%
%Given our previous results (0\% error rate for intra-session authentication) with
%a limited number of handcrafted features, we are expecting the above-mentioned
%improvements to increase the accuracy and speed of our classifiers. In addition,
%this study will advance our understanding of the features that can be reliably
%used as biometric signatures. 


%\input{related}
\section{Background and Related Work} \myparatight{Screen settings}
Users  interact with a mobile device via swiping, clicking, or zooming on the
screen. For instance, users often slide over the screen horizontally (e.g.,
navigate to the next page of icons in the main screen or browse through photos)
and vertically (e.g., read webpages, social media updates, or emails), which
result in horizontal swipes and vertical swipes, respectively. A swipe is also
called a \emph{stroke}, and we will use them interchangeably in the paper. 
%A vertical stroke is further categorized to an \emph{up stroke} or a \emph{down
%stroke} if it is scrolling up %or scrolling down. Similarly, a horizontal
%stroke could be a \emph{left stroke} or a \emph{right stroke}. 

The sensors on the screen record the location, timing, pressure, and covering
area of interactions.  More specifically, an interaction is a sequence of touch
points ($t_i$,$x_i$,$y_i$,$p_i$,$a_i$), where $t_i$ is the timestamp, $x_i$ is
the horizontal location, $y_i$ is the vertical location,  $p_i$ is the pressure,
and $a_i$ is the covering area  of the $i$th touch point.   Then these touch
points are transformed by the operating system to higher-level primitives such
as clicks, swipes, and zooms.  Applications on the mobile device access the
transformed primitives through the operating system.  In the following,
\emph{touch behavior} refers to the raw touch data recorded by the screen
sensors. 

A \emph{screen setting}  controls how the sensed raw data is transformed to the
primitives that are used by applications. For instance, screen settings can
independently distort the X (i.e., horizontal) axis or the Y (i.e., vertical)
axis. 
%change sloppiness (i.e., how far the user has to move the finger on the screen
%to send a movement to the applications), and jitter (i.e., what distortions
%from a straight line on the screen are still considered as a movement by the
%applications). 
Note that  transformation is only applied to a sequence of touch points and the
first touch point of any interaction is not transformed. Therefore, one-touch
operations like clicking a button on an application will not be affected by
different screen settings.  Moreover, since screen settings are transparent to
applications, application developers do not need to change their applications
when the screen settings are modified.

Suppose a user draws a line from position (10,10) to position (110,110) on the
screen.  Under a screen setting of 0.8 Y-distortion the application would see a
line from position (10,10) to position (110,90). Under a screen setting of 1.2
X-distortion the application would see a line from position (10, 10) to position
(130, 110). To account for such transformations, the user will adapt her touch
behavior  to achieve the desired application behavior.


\myparatight{Touch-based continuous authentication}  Touch-based authentication
has been proposed first in \cite{munichGuys} and
\cite{Sae-Bae:2012:BGN:2207676.2208543}. However, both methods require the user
to carry out a specific secret gesture at a defined point of time (unlock
challenge) and then analyze \emph{how} the gesture is carried out. More
recently,  leveraging  a user's  touch interactions obtained when the user
interacts with the device to continuously and implicitly monitor the user has
attracted increasing attentions. 
%In \cite{bo2013silentsense, frank2013touchalytics, li2013unobservable,
%sae2012investigating} purely implicit touch-based authentication methods have
%been proposed. The device is unlocked at the beginning of a session and while
%the user interacts with the touch-screen she is continuously authenticated; the
%device locks and presents a hard explicit challenge (e.g., asks for a password)
%if in doubt. 
Complex interactions such as zooming are too infrequently used to be appropriate
for continuous monitoring and clicks exhibit too few  features to be
discriminative for users. 
 %Moreover, zoomings and clicks mostly keep the user staying in the same user
 %interface, and thus they have limited privacy concerns for the user if the
 %attacker only performs these operations.   
 Therefore, most previous work focus on  swiping interactions (i.e., strokes),
which were demonstrated to contain a behavioral biometric signature that may be
used to continuously authenticate the user~\cite{bo2013silentsense,
frank2013touchalytics, li2013unobservable, sae2012investigating,
sherman2014user}. 

For instance, Frank et al.~\cite{frank2013touchalytics} extracted 31 features
from each stroke and trained a classifier for a user to distinguish her touch
behavior from other users'. These features include the direction of the
end-to-end line, average velocity, start locations, and end locations of  a
stroke. For a complete list of the features, please refer to Frank et
al.~\cite{frank2013touchalytics}.
%Frank et al. showed that their classifier achieves very low EERs, e.g., the
%median EER for intra-session is 0\% for 41 subjects. 
More recently, Sae-Bae et al.~\cite{sae2014multitouch} studied a canonical set
of 22 multitouch gestures for authentication on mobile devices, and they found a
desirable alignment of usability and security, i.e., gestures that are more
secure are rated by users as more usable. Sherman et al.~\cite{sherman2014user}
proposed to use free gestures as a static authenticator to unlock  mobile
devices and they further studied the memorability of user generated gestures.
Xu et al.~\cite{Xu2014soups}  verified that touch-based authentication is a
promising  authenticator  via conducting experiments with around 30 users for
one month in the wild. 


%
%Authenticating users based on touch traces is a behavioral biometric
%authentication problem, i.e., the user is authenticated based on the way how the
%user \emph{does} something. There are other such techniques that are related to
%touch-based authentication.
 
%In the field of on-line signature verification, analyzing behavioral biometrics
%of user-generated traces has a long-standing history even before the
%omnipresence of smart phones \cite{Lee:1996:ROH:232678.232685, Jain20022963}. In
%this field traces are analyzed based on geometry and
%timing~\cite{Lee:1996:ROH:232678.232685,
%Fierrez-Aguilar:2005:OSV:2134859.2134923}.  For on-line signature verification
%traces are usually recorded by a special dedicated device. In contrast, touch
%screen traces are recorded by the personal device that is controlled and used by
%the user all day. In essence, touch based authentication authenticates a
%device--user pair while the problem of signature authentication is usually device
%independent.  Also, touch traces emerge implicitly while using the device and
%need not be carried out for authentication as such.


However, all these touch-based authentication mechanisms consider a \emph{single} 
universal screen setting (e.g., the default screen setting) for all users, 
making them vulnerable to \emph{forgery attacks} which collect a 
user's touch strokes in the screen setting and program a robot to 
replay them to attack the authentication system 
(please see more details in Section~\ref{sec:exp}). 
Our work also focuses on users' strokes, but we leverage multiple, randomly
chosen screen settings.

  
%classifiers are trained for each user on enrollment data
%that has been collected in a single system setting (i.e., same screen sensitivity
%etc.) and these classifiers have been tested under the same setting.

%\myparatight{Forgery attacks}
% As a consequence, all above cited methods are vulnerable to forging attacks as
%it is difficult to prevent that a user's touch signature (or written signature
%including timing data) is leaked and therefore gets in the wrong hands.  




\myparatight{Common-behavior attacks} Serwadda and Phoha~\cite{attack-CCS13}
showed that a Lego robot can be programmed to swipe the screen of a mobile
device, and the stroke recorded by the screen sensors is as desired. 
The attacker needs to
know the defining parameters (e.g., start and stop
locations) of the stroke that is to be forged. 
%in order to forge a desired stroke
%Please note
%that to forge a desired stroke via programming the robot, the attacker needs to
%know the defining parameters of the stroke, such as the start and stop
%locations. 

Moreover,  they proposed that the attacker can simply program the robot to
replay the common touch behavior of a large population onto the targeted user's
mobile device, and they showed that such \emph{common-behavior attacks} can
significantly increase the EERs. However, they also showed that their
common-behavior attacks have limited success rates for users whose behaviors are
relatively far from the common, and there are about 20-40\% of such users. This
means that touch-based authentication is appropriate to these users. In
practice,  touch-based authentication systems can compare a user's touch
behavior to those of a large population and recommend if the behavior is far
enough from the common behaviors so that it is resilient to common-behavior
attacks. 

In this work, we consider stronger forgery attacks in which the attacker
 could obtain the targeted user's touch data.
 % and program a robot to 
%replay them. 
 
% Moreover, for users whose touch traces are not available to
%attackers but close to the common behaviors of a large population, the attacker
%can simply replay these common behaviors, which can compromise the users with
%high success rates. However, they also showed that users whose behaviors are
%relatively far from the common are resilient to their \emph{common-behavior
%attacks}. This means that touch-based authentication is appropriate to those
%``abnormal'' users. In practice,  touch-based authentication systems can
%compare a user's traces to those of a large population and recommend if the
%behavior is far enough from the common behaviors so that it is resilient to
%common-behavior attacks. In our work, we focus on general forgery attacks that
%could be applied to any user and their defenses.
 
%In our work, we aim to explore attacks to these ``abnormal" users and their
%defenses.   



%\input{threat-model}
\section{Threat Model}
\label{sec:threat}

The authentication system is available to the attacker. The attacker can
read and analyze the implementation details of the authentication system
offline. Therefore, if the authentication system uses a universal screen setting
(e.g., the default screen setting) for all users,
the attacker can obtain this setting via offline code analysis. However, we
assume that the attacker cannot obtain the dynamic behaviors of the
authentication system that runs on the targeted user's mobile device. For instance, 
the attacker cannot know the
current setting used by the authentication system if it is randomly sampled  in
random time intervals. This is because 
%The settings that are currently in use are not available to
%running applications on  and 
reading out the current settings at runtime requires high
privileges (e.g., root access to the operating system) and an attacker that has
already obtained such high privileges already compromised the system.

 We assume the attacker has a commercialized programmable 
 robot (e.g., a Lego robot), 
 which can be used to forge touch strokes and play them on mobile devices. 
 For instance, Serwadda and Phoha~\cite{attack-CCS13} showed 
 how to program a Lego robot to forge  touch strokes  to have desired  features. 
 %Moreover, we consider that the attacker cannot infer the randomly sampled screen settings 
 %using state-of-the-art commercialized robots. 
 We note that an intelligent robot which is equipped with specialized sensors could potentially detect the current screen setting used by our authentication system using advanced computer vision algorithms. However, the attacker might not have such a specialized robot, and thus, in this work, we consider  \emph{state-of-the-art commercialized} robots, with which the attacker cannot infer the current screen setting.
 %For instance, a robot with a camera could possibly detect the screen settings via using computer vision algorithms to compare its raw touch data (collected via the camera) on the screen and the movements (again, collected via the camera) of the running application. However, the robot still needs to generate a few touch strokes (these strokes may be from a screen setting that is different from the one used by our authentication system) before the screen setting is detected, during which our authentication scheme might already successfully reject the attacker. Moreover,  it might not be easy for the attacker to get such a specialized robot, which is true at least for now, given the current state of AI. Therefore, we focus on robots that are commercialized and easy to get.  


\begin{figure*}[!t]
%\vspace{2mm}
\centering
\subfloat[User A, 0.8 Y-distortion]{\includegraphics[width=0.16\textwidth, height=1.6in]{user-1-13.pdf}}
\hspace{8mm}
\subfloat[User B, 0.8 Y-distortion]{\includegraphics[width=0.16\textwidth, height=1.6in]{user-3-13.pdf}}
\hspace{8mm}
\subfloat[User C, 0.8 Y-distortion]{\includegraphics[width=0.16\textwidth, height=1.6in]{user-12-13.pdf}}

\subfloat[User A,  1.2 Y-distortion]{\includegraphics[width=0.16\textwidth, height=1.6in]{user-1-15.pdf}}
\hspace{8mm}
\subfloat[User B,  1.2 Y-distortion]{\includegraphics[width=0.16\textwidth, height=1.6in]{user-3-15.pdf}}
\hspace{8mm}
\subfloat[User C, 1.2 Y-distortion]{\includegraphics[width=0.16\textwidth, height=1.6in]{user-12-15.pdf}}
\caption{Vertical strokes of three users A, B, and C in two screen settings, which we obtained in our experiments. 
The black background simulates the mobile device's screen while the lines are users' touch strokes.  We observe that users' touch
 behaviors are \emph{stable}, i.e., the touch behaviors of a user in one setting
are closer to those of the user in another setting than those of other users.}
%\vspace{2mm}
\label{stroke} 
\end{figure*}

%\subsection{Attacks}
We consider two general forgery attacks depending on whether the attacker obtains touch
strokes of the targeted user or not. 
 We will discuss more advanced targeted attacks such as training a human attacker in Section~\ref{discussion}.


\myparatight{Random attacks} In this scenario, the attacker does not obtain
touch strokes of the targeted user. For instance, this could be the case in
which the targeted user lost the device and it is found by a random
attacker, who does not know the targeted user and does not have its touch
strokes.  However, the attacker could obtain touch strokes of a set of other
users. This is reasonable because 1) the attacker can retrieve touch strokes
from publicly accessible data sets~\cite{frank2013touchalytics,attack-CCS13},
and 2) it is possible that users (intentionally or unintentionally) install  an
application (e.g., this application is a fun game application and  does not
appear to be malicious) that is developed by the attacker on their mobile devices 
and the application records users' touch strokes.  

After obtaining touch strokes from a set of users in different screen settings,
the attacker randomly selects touch strokes, programs a Lego robot 
to forge them~\cite{attack-CCS13}, and uses the programmed robot to 
touch the mobile device.
 

\myparatight{Targeted attacks} In this case, the attacker obtains touch strokes
of the targeted user. For instance, the attacker could be  a ``friend'' of the
targeted user or the targeted user's curious spouse, who wants to access the
messages sent by the targeted user or know whom the targeted user has called,
and the attacker   convinces the targeted user to use his/her mobile devices to
record the targeted user's  touch strokes. 

Again, the attacker programs a  robot using the collected strokes to attack the targeted user.
Intuitively, if the authentication system uses an universal screen setting, the attacker 
can obtain the targeted user's strokes in this universal setting, which results in attacks 
with very high success rates (see Section~\ref{sec:exp}). Our new authentication mechanism uses multiple screen settings 
in which a user's touch behavior is different, and we randomly sample one of the screen settings 
in each time interval. 
Given enough settings, our system can significantly decrease the success rates of targeted attacks even if the attacker 
obtains the targeted user's  touch strokes 
in \emph{all} screen settings. This is because the attacker cannot know the screen setting used by our
 authentication system at the time of attack, and thus the attacker does not know which strokes should be used to
program the robot. Therefore, the attack is reduced to randomly guessing a setting $s$, but replaying strokes collected in $s$  
 passes the authentication with much lower probabilities if $s$ is not the current setting used by
 our authentication system. 
 We note that we do not consider attacks with advanced robots to automatically infer the screen setting in this work. 




%\myparatight{Same-setting attacks and diff-setting attacks} We call an attack a
%\emph{same-setting attack} if the attack touch strokes are collected in the
%same setting with the one used by the authentication system. Otherwise, we call
%an attack \emph{diff-setting attack}. For instance, random attacks using
%strokes collected in a setting to an authentication system that uses the same
%setting are same-setting random attacks.
%
%When the attacker knows the setting used by the authentication system (e.g.,
%the authentication system uses an universal setting), the attacker can perform
%better attacks. For instance, if the user knows  the setting used 
%



%\input{defense}





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\section{Stability and Sensitivity across different settings}
\section{Stability and Sensitivity}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


\begin{figure*}[!t]
%\vspace{-4mm}
\centering
\subfloat[User A]{\includegraphics[width=0.33\textwidth]{user-1-sensitive.pdf}}
\subfloat[User B]{\includegraphics[width=0.33\textwidth]{user-3-sensitive.pdf}}
\subfloat[User C]{\includegraphics[width=0.33\textwidth]{user-12-sensitive.pdf}}
\caption{Start locations vs. stop locations in the vertical direction of  up strokes 
in  two screen settings of the three users. We find that their touch behaviors
are also \emph{sensitive}, i.e.,  a user's touch
strokes in different settings have a high degree of separability in the feature space.}
\label{sensitive} 
%\vspace{-4mm}
\end{figure*}

Before introducing our adaptive touch-based continuous authentication system, we
introduce two key observations that inspire the design of our authentication
system. 

%\myparatight{Screen settings} The sensors on the screen of a smartphone or a
%tablet register touch interactions according to the granularity of the touch
%sensors and translate these interactions to the coordinates (X:horizontal,
%Y:vertical) of the screen. 
%%Our system interposes the already existing
%%translation between the touch sensor and the screen and transforms t
%The sensed
%data is transformed according to a \emph{screen setting}. Then the transformed 
%data is sent to applications on the mobile device. 
%The transformation is implemented as a
% part of the operating system and the applications remain unchanged. In the following, 'touch
%behavior' refers to the raw touch data registered by the screen sensors. 
%%Applications only have access to transformed data and cannot read the raw data
%%of the touch sensor. 
%
%The screen settings can independently distort the X axis or the Y axis (i.e., a
%distortion is a transformation between the raw touch data on the screen and the
%data interpreted by applications), change sloppiness (i.e., how far the user has
%to move the finger on the screen to send a movement to the applications), and
%jitter (i.e., what distortions from a straight line on the screen are still
%considered as a movement by the applications). Note that we only transform
%sequences of touch interactions and any first touch is not transformed. Therefore, 
%one-touch operations like clicking a button on an application will not be affected
% by different screen settings.  
%
%%For example, a screen setting of 0.8 Y distortion results in ``shortening'' touch
%%interactions by 0.8 in the Y direction. 
%
%%For simplicity we assume that the X/Y resolutions of the touch screen and the
%%display are equivalent. 
%For example, a user interacts with the touch sensor and
%drags a line from position (-10,-10) to position (-110,-110). Under a screen setting of 0.8
%Y distortion the application would see a line from position (-10,-10) to position
%(-110,-90). Under a screen setting of 1.2 X distortion the application would see a
%line from position (-10, -10) to position (-130, -110). 


\myparatight{Stability and sensitivity} A user's touch behaviors in two screen
settings are said to be \emph{stable} if the touch behaviors of the user in one
setting are closer to those of the user in the other setting than those of other
users in both settings. Moreover, a user's touch behaviors in two settings are
said to be \emph{sensitive} if they have a high degree of separability in the
feature space. Figure~\ref{sta-sen} illustrates the possible outcomes for two
settings $s_a$ and $s_b$. Intuitively,  a user's touch behaviors in two settings become more
stable and less sensitive when the two settings are closer. 

We find that there exists screen settings across which a user's touch behaviors
are both stable and sensitive.   For instance, in our experiments (see
Section~\ref{sec:exp}), two of the screen settings we consider are 
0.8 Y-distortion and 1.2 Y-distortion,
respectively.  Figure~\ref{stroke} shows vertical touch strokes of three users
in the two settings; it is visually noticeable that their behaviors are stable. 

Note that a vertical stroke could be an \emph{up} stroke or a \emph{down} stroke, 
which corresponds to  scrolling up or scrolling down, respectively. 
Figure~\ref{sensitive} contrasts the start locations (i.e., start $y$)
and stop locations (i.e., stop $y$) in the vertical direction (i.e., Y axis)
of up strokes. We find that
their touch behavior are also sensitive. User A (or B) starts touch strokes at
similarly low $y$ locations in both settings. However, in the screen setting of 0.8
Y-distortion, the strokes interpreted by the application
are shorter than the strokes inputed by the user on the screen, and
thus the user automatically stops the touch strokes at higher (i.e., larger) $y$
locations, which makes the strokes on the screen longer. User C might subliminally notice the 
different screen settings, and
she tends to start and  stop the touch strokes at higher $y$ locations with 0.8 Y-distortion.     




\myparatight{Implications} On one hand, stability implies that models trained in
any setting of one user will always be distinguishable from models trained for
other users, clearly separating individual users with high probabilities. This
property is needed to successfully authenticate a specific user. On the other
hand,  if we learn a model to distinguish a user's touch behaviors from other
users' in a single setting, then forgery attacks that replay the targeted user's
strokes collected in other settings can still succeed with high probabilities.



Sensitivity implies that we can train a model to distinguish a single user's touch behaviors
in one setting from those in  other settings, which makes it possible to defend against targeted attacks. 
Specifically, when our authentication system uses a setting $s$,  the attacker would fail to pass the authentication
with much higher probability if the attacker forges attacks using the targeted user's strokes collected in settings other than $s$.
%would have low probability
%of success. 

%This property protects an
%authentication system from targeted attacks. Assuming an attacker forges strokes using the targeted user's  
%strokes of the targeted users in setting $s_a$ and replays these touch interactions while the
%authentication system enforces setting $s_b$ the attack would have low probability
%of success. 


%There is a range of usable system settings for touch
%screen interactions, in which users can use the smartphones normally (or more
%precisely without noticing any abnormal behavior). Typically, all devices of the
%same model with the same software version use the same settings (as
%preconfigured by the manufacturer). 
%
%In our system we leverage this coordinate transformation between the sensor and
%the screen to implement an authentication system. We use the raw interactions as
%registered by the sensor to authenticate but randomly change the settings used
%in the coordinate transformation to change the enforce subliminal changes in how
%the user interacts with the application.
%
%We evenly divide the range of usable settings into $m$ bins. For
%instance, suppose the authentication system uses vertical swipes and the usable
%vertical system setting is in the range  [$a_v$, $b_v$], an even discretization
%means that the $i$th bin corresponds to the range [$a_v$ +
%$(i-1)\frac{b_v-a_v}{m}$, $a_v$ + $i\frac{b_v-a_v}{m}$], where $i\in S$. 
%
%%show a figure to illustrate the similarity and differences
%%In experiments, show that they are distinguishable. 
%
%\myparatight{Stability} We find that a user's touch behaviors are \emph{stable}
%across different settings, i.e., the touch behaviors of a user in one setting
%are closer to those of the same user in another setting than those of other users.
%For instance, Figure~\ref{stroke} shows touch strokes of three users in two
%settings $s_a$ and $s_b$ from two different bins (see Section~\ref{sec:exp} for
%details).
%
%Stability implies that models trained in any setting of one user will always be
%distinguishable from models trained for other users, clearly separating
%individual users with high probabilities. This property is needed to
%successfully authenticate a specific user.
%
%\myparatight{Sensitivity} We find that the touch behaviors of a user are also
%\emph{sensitive} across different settings, i.e., a user's touch strokes in
%different settings are separable in the feature space. For instance,
%Figure~\ref{sensitive} contrasts the start locations (i.e., start $y$) and stop
%locations (i.e., stop $y$) in the vertical direction (i.e., $y$ axis) of
%strokes collected in the two settings of the same three users. 
%
%This implies that we can train a model to distinguish a single user's touch behaviors
%in one setting from those in any other setting. This property protects an
%authentication system from replay attacks. Assuming an attacker collected touch
%behavior in setting A and replays these touch interactions while the
%authentication system enforces setting B the attack would have low probability
%of success.

%This is the key observation that inspires our design of adaptive continuous authentication mechanism. 


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Adaptive Authentication}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Our touch-based authentication system consists of two phases: the
\emph{registration phase} and the \emph{authentication phase}. The
authentication system learns user characteristics during the registration phase
and enforces these learned characteristics during the authentication phase.



\begin{figure}[!t]
%\vspace{4mm}
\centering
\includegraphics[width=0.45\textwidth]{registration.pdf}
\caption{Registration phase.  }
\label{registration}
%\vspace{-4mm}
\end{figure}


%\begin{figure}[!t]
%%\vspace{-4mm}
%\centering
%{\includegraphics[width=0.3\textwidth]{ver-hor.pdf}}
%\caption{.}
%\label{ver-hor}
%\end{figure}


\subsection{Registration phase}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Figure~\ref{registration} illustrates the registration phase.  Suppose $u$ is a new user.  
First, we sample $n$ screen settings across which $u$'s touch behaviors are both stable and sensitive. In
 practice, we can evenly divide the range of possible screen settings into $m$ bins, and choose the centers of
 the $n$ bins that are randomly sampled.
%  from the $m$ possible bins uniformly at random and then sample
%a setting from each selected bin.  
 We denote the set of sampled settings as
$S(u)$.  

We distinguish two types of strokes: \emph{horizontal} and \emph{vertical}, 
which correspond to scrolling  horizontally and scrolling vertically, respectively. 
The two types of strokes have different features, e.g., the directions of the end-to-end lines corresponding to the strokes. This categorization could enable us to enhance the performance of the system.
%\footnote{We also tried to further categorize strokes into \emph{up}, \emph{down}, \emph{left}, and \emph{right} strokes. However, we found that the four-type categorization and the two-type categorization achieve similar EERs for forgery attacks. However, the four-type categorization requires to train more classifiers, which makes the registration phase longer. Therefore, we adopt the two-type categorization.} 
 For each setting $s\in S(u)$, we collect a set of touch strokes for each type $t$
(denoted as $T(u, s, t)$) from $u$ via fixing the screen setting to be $s$. Then we
extract a set of features from each stroke. We adopt the features that are
proposed by Frank et al.~\cite{frank2013touchalytics}. The extracted features
are subsequently sent to the server.  We send features to the server instead of
the raw strokes to mitigate the loss from a server compromise. In particular, if we send
raw strokes to the server and it is compromised, the raw strokes are easily
available to attackers. This is similar to the scenario where passwords are
available to attackers when a password database is
compromised~\cite{rockyou, CSDN}. However, even if the server is compromised and
the features are available to attackers, it is unclear how to forge touch
strokes that have these features. 

Second, we leverage machine learning techniques to train a classifier for each
setting and each stroke type. Specifically, for each setting $s\in S(u)$ and a stroke type $t$, we take the features
of the corresponding strokes collected in the setting $s$ (i.e.,  $T(u, s, t)$) as positive
examples, and features of type-$t$ strokes collected in all other settings (i.e., 
$T(u,s', t)$ for all $s'\in S(u)-\{s\}$) and features of type-$t$ strokes of all users that have already adopted the system as
negative examples. Then we learn a classifier $c(u,s,t)$ to distinguish these
positive and negative examples. Therefore, we obtain $2n$ classifiers for
the user. The model parameters of these classifiers are then sent back to
the user. 
%We note that previous work~\cite{frank2013touchalytics, li2013unobservable} only
%considers a single setting and categorizes strokes into vertical and horizontal strokes. They train a  classifier for each of the two types of strokes for a user to separate its
%touch behaviors from other users. 

\subsection{Authentication phase}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Our adaptive continuous authentication method works on discrete time intervals. 
In each time interval,  we sample a setting $s$ from $S(u)$
uniformly at random and change the screen setting to be $s$. If the user inputs a stroke with type $t$, we  authenticate the stroke using the classifier $c(u, s, t)$.   

%For the first time interval,   we sample a setting $s$ from $S_d(u)$ uniformly
%at random and adapt the system setting to be $s$.   For inputed touch strokes,
%we first calculate their features and evaluate them against the classifier
%$c(u,s)$.  In subsequent time intervals, we sample a setting $s'$ from
%$S_d(u)-\{s\}$ uniformly at random and adapt the system to be $s'$, where $s$
%is the setting in the previous time interval.




Intuitively, our authentication method can significantly decrease the success rates 
of 
targeted attacks.  In the worst case, the attacker obtains a set of touch
strokes of the user in \emph{all} settings in $S(u)$ and can replay these touch
strokes via programming a robot. However, the attacker cannot know which setting is randomly sampled in
a given time interval, and thus the attack is reduced to randomly guess a setting and 
program a robot to replay strokes collected in the setting. 
Due to the sensitivity of users' touch behaviors,  these forged  
strokes will be rejected with high probabilities.
% if $s$ is not the currect setting of our authentication system. 
%by the classifier trained for another setting due to the sensitivity of users' touch behaviors.

Note that previous work~\cite{frank2013touchalytics,li2013unobservable} uses a fixed universal setting for
 all users, and thus their authentication systems can be breached if the
attacker obtains the targeted user's touch strokes in this hard-coded setting. Moreover, we
show (in Section~\ref{sec:exp}) that even replaying the touch strokes of
the targeted user collected in a different setting can still breach their
authentication system with high success rates because of the stability of users' touch behaviors.
% while our authentication system
%protects against such attacks using the sensitivity of users' touch behaviors.

A user's behavior is relatively stable  over time. For instance, Frank et
al.~\cite{frank2013touchalytics} showed that the median EER increases by only
4\% when their classifiers are used  one week after the registration phase.
However, in practice, to account for behavior variety in a longer period of
time,  we could periodically (e.g., each month or quarter) execute a
registration phase to update classifiers.  This is feasible since the
registration phase takes a short period of time as we will show in our
experiments.


%\subsection{Security analysis}


%\input{data}

%\input{exp}





%%%%%%%%%%%%%%%%%%%%%
\section{Experiments}
\label{sec:exp}
%%%%%%%%%%%%%%%%%%%%%

We evaluate the security of our new touch-based authentication system against forgery attacks 
and compare it with previous touch-based authentication systems. 



\subsection{Data collection}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%



\begin{table}[!t]\renewcommand{\arraystretch}{1}
%\vspace{-4mm}
\centering
\caption{Notations of the five screen settings, which are distortions along either the X axis or the Y axis.}
%\addtolength{\tabcolsep}{-2pt}
\begin{tabular}{|c|c|c|c|c|} \hline
{\small $s_a$}&{\small $s_b$}&{\small $s_c$}&{\small $s_d$}&{\small $s_e$} \\ \hline
{\small 0.8}&{\small 0.9}&{\small 1.0}&{\small 1.1}&{\small 1.2} \\ \hline
\end{tabular}
\label{notation}
%\vspace{-2mm}
\end{table}



We consider five screen settings: 0.8, 0.9, 1.0, 1.1, and 1.2 distortions along either
the X or Y axis, and we denote them as $s_a$, $s_b$, $s_c$, $s_d$, and $s_e$, respectively. 
Table~\ref{notation} shows the notations of the five screen settings. 
We choose these settings because they  are reasonably separable from each other so that 
a user's touch behaviors are sensitive, yet transitions between them are still
unnoticeable to users.  
%large space of settings where our authentication system can randomly select a
%specific setting.


We aim to collect horizontal strokes and vertical strokes in the five screen settings.
Moreover, we want to study if transitions between screen settings can be 
performed without users noticing them.   
To achieve these goals, we implemented an Android application with two games to 
record users' raw touch data.  
Our application uses an Android API  to configure screen settings.
Moreover, we implemented a library to intercept the raw touch data. 
Considering user fatigue, the ordering of the two games  is shuffled uniformly at random.


\myparatight{Task 1, horizontal strokes} In the first game the user must identify differences between two images. The
application shows two versions of one image in a horizontal gallery with a black
image in between. The user must swipe  horizontally between the images. 
Figure~\ref{fig:horizontal-game} shows a screenshot of this game. 
We shuffle the five screen settings along the X axis at the beginning of the game, and change a setting every 30s. 

\begin{figure}[!t]
%\vspace{-2mm}
\centering
\subfloat[Task 1]{\includegraphics[width=0.45\columnwidth]{game2.pdf}
\label{fig:horizontal-game}}
\subfloat[Task 2]{\includegraphics[width=0.45\columnwidth]{game1.pdf}
\label{fig:vertical-game}}
\caption{(a) The game used in the task 1; the user must swipe
horizontally. The image itself is available under the Creative Commons
Attribution-Share Alike 3.0 license from the Wikipedia website. 
(b) The game used in the task 2; the user must swipe vertically.
We produced this image and release it under the Creative Commons Attribution
Share-Alike 3.0 license.}
\vspace{6mm}
\end{figure}

 \begin{table}[!t]\renewcommand{\arraystretch}{1}
%\vspace{-4mm}
\centering
\caption{ The number of strokes per subject and per second in the five screen settings for the 25 subjects.}
\addtolength{\tabcolsep}{-2pt}
\begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|} \hline
& \multicolumn{5}{|c|}{{\small Strokes per subject}} & \multicolumn{5}{|c|}{{\small Strokes per second}} \\ \cline{2-11}
&{\small $s_a$}&{\small $s_b$}&{\small $s_c$}&{\small $s_d$}&{\small $s_e$}&{\small $s_a$}&{\small $s_b$}&{\small $s_c$}&{\small $s_d$}&{\small $s_e$} \\ \hline
{\small Horizontal}&{\small 51}&{\small 52}&{\small 48}&{\small 49}&{\small 52}&{\small 0.35}&{\small 0.30}&{\small 0.19}&{\small 0.17}&{\small 0.17}\\ \hline
{\small Vertical}&{\small 83}&{\small 77}&{\small 74}&{\small 78}&{\small 75}&{\small 0.71}&{\small 0.47}&{\small 0.31}&{\small 0.30}&{\small 0.27}\\ \hline
\end{tabular}
\label{dataset}
\vspace{3mm}
\end{table}

\myparatight{Task 2, vertical strokes}
In the second game the user must identify pairs of images. The application shows
five (statically pre-shuffled) pairs of vertically aligned images of different
patterns, shapes, and colors. At one given time only one image is visible and
the user must move the screen to other images along the Y axis. The static shuffling
allows us to compare the same task across different users.
Figure~\ref{fig:vertical-game}  shows a screenshot of this game. 
We shuffle the five screen settings along the Y axis at the beginning of the game, 
and change a setting every 30s. 



We used a HTC One smartphone to collect data from 25 subjects. 
These subjects age between 25 and 35; and 11 of them are female.  
%Our study was approved by our local IRB. 
Table~\ref{dataset} summarizes our
dataset.


\myparatight{Smooth transition between screen settings}
Our authentication system automatically transits from one
setting to another in different time intervals. One natural question is that if
users notice such transitions. To answer this question, we ask each subject
the question ``Did you notice anything abnormal?" 
when he/she  finishes the tasks.
%: \begin{quote}
%\emph{Did you notice anything abnormal?} \end{quote}

We find that \emph{no} subject noticed these transitions, which means that 
users  subconsciously adapt their behavior to different screen settings and 
transitions between settings do not interrupt users nor influence user
experiences. 







\begin{table*}[!t]\renewcommand{\arraystretch}{1.1}
%\vspace{-4mm}
\centering
\caption{Approaches we compare.}
\addtolength{\tabcolsep}{-5pt}
\begin{tabular}{|c|c|} \hline
{\small Notation} & {\small Description} \\ \hline
{\small C-Baseline-$x$} & {\small Baseline classifier only using touch strokes in the setting $s_x$, where $x\in \{a,b,c,d,e\}$} \\ \hline
{\small C-ATCA-$x$} & {\small Our classifier for the setting $s_x$, where $x\in \{a,b,c,d,e\}$; strokes in other settings are also used} \\ \hline
{\small S-Baseline-$x$} & {\small Baseline authentication system using C-Baseline-$x$ with the fixed universal setting $s_x$, where $x\in \{a,b,c,d,e\}$ }\\ \hline
{\small S-Baseline-improved} & {\small Our improved Baseline authentication system whose setting is randomly selected} \\ \hline
\multirow{2}{*}{{\small S-ATCA}} &{\small  Our authentication system using C-ATCA-$x$, where $x\in \{a,b,c,d,e\}$;}\\ 
&{\small  settings are randomly selected in each time interval} \\ \hline
\end{tabular}
\label{approach}
%\vspace{-2mm}
\end{table*}




%A problem with previous experiments (including our previous study) is the use of
%different types of phones at different sites where the experiments were carried
%out. Therefore user discrimination could have been partly due to different
%smartphones used by different users during the experiments. There we analyzed
%the phone influence on discrimination and found that it improves the error rate
%by about 2\%. However, in this project, we will use the same phone for all users
%to rule out any role played by smartphone differences. 
%
%We will start with the application that we used in our previous study to collect
%data. In that application, either the user is reading a text (vertical strokes)
%or browsing pictures (horizontal strokes). Upon the start of the project, we can
%immediately start collecting data to measure the information carried by dynamic
%features and how informative they are when combined with static features. Our
%application allows us to isolate vertical and horizontal strokes to address
%dynamic/static feature combination in a controlled way. Our application already
%collects acceleration/orientation information.
%
%Experiment 1: Users will be asked to read simple English texts and answer
%questions. This will require vertical strokes. They will also be asked to browse
%a set of pictures and then answer a number of questions about those images.
%During this experiment we will collect information about both vertical and
%horizontal strokes alongside the acceleration information.
%
%We are also planning to modify an open source browser that allows us to
%incorporate accelerometer/gyroscope information. This new application will allow
%the user to alternate between vertical/horizontal strokes while collecting
%acceleration/orientation information. 
%
%Experiment 2: users will be asked to study a text that contains a number of
%images and reading the text and browsing the images will require a number of
%interleaved horizontal and vertical strokes. Unlike experiment 1, here the
%vertical and horizontal strokes are interleaved. Comparing experiments 1 and 2,
%we can see if interleaved strokes carry more information than isolated ones. 
%
%In all our experiments, we will ask the subjects to work with phone for couple
%minutes, then put it back on the table, wait for a while and then pick it up and
%continue working on the phone. This way we will have episodes that are
%completely separated and are either allocated to one user or different users. 



%\subsection{Different settings for the experiments}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%Users might work on their phones at different positions, standing, sitting or
%lying. They might be in rush to quickly check something or they might be
%completely relaxed. Each of these conditions might have an impact on the way
%they touch the screen and the way they hold the smartphone, which in turn
%affects the temporal structure of acceleration/orientation data. Differences are
%also possible between morning and afternoon as users are normally more tired
%later during a day. 
%
%To control for all these factors, we are planning to run our experiments under
%different conditions and measure how a single user's strokes are affected by
%these conditions. The result of this experiment will give us a better intuition
%about how touchscreen data gets affected by orthogonal dimensions. In addition,
%these experiments are necessary to minimize the False Alarm Rate (FAR). The
%learning algorithm will learn the most informative features for different
%conditions separately and will use different set of informative features at
%different positions/conditions. 
%
%Inter-session or intra-session?
%
%In our previous work, we showed 0\% error rate for intra-session tests and less
%than 4\% error rate for inter-session tests. Subjects were instructed to put the
%phone on the table in between sessions and perform another task on the paper. We
%realized that the task affected their touchscreen data when they started a new
%session, although, the inter-session intervals were just 3 minutes. Given that
%the error rate remains less than 4\% after a week, it seems that this change in
%behavioral pattern can be statistically modeled as a fast mechanism that
%operates within couple minutes after a session is finished. We can measure this
%difference in a systematic way to see how the users behavioral pattern changes
%after a few minutes of break (or performing a task on paper). This is important,
%because, once we extract the change in the pattern, we can always verify that
%the change during the test phase is the same as the change we recorded during
%the training phase. This will help us to minimize the FAR again. 
%
%To test this, we will try different inter-session intervals and measure how that
%affects the change in behavioral pattern. Our results suggest that the main
%change happens within the first couple minutes after the end of a session as the
%error rate for one week after a session is not different from the error rate
%after 3 minutes after a session. However, we aim to address this directly, both
%to verify the effect and also model the change in behavioral pattern.
%
%Directly addressing the problem of forging:
%
%We will use local dynamic features as well as more global static features. As we
%mentioned above, local dynamic features are shown to be extremely difficult to
%be forged. However, we can directly address this claim here. In this experiment,
%we will record one users touch-screen data and extract all the features. We will
%then record a second user's touch-screen data and verify that it is different
%from the first user. We will then design a paradigm that will aim to help the
%second user to change his behavioral pattern to mimic the first user's pattern.
%Every time the second user makes a stroke, we will give him feedback about the
%features. For example, we might ask him to increase the pressure or decrease the
%speed. This way, we will try to train the second user to adapt to the behavioral
%pattern of the first user. We will also provide feedback about local dynamic
%features, for example, to decrease the pressure quickly at the beginning of a
%stroke or to suddenly increase the speed at the middle of the stroke, etc. We
%will first verify if the performance improves as a result of the feedback and
%compare this for local dynamic features and global static features. We will then
%test the performance of the second user after a variable time interval to
%measure how reliable the adaptive process is (assuming performance improvement
%is observed). 
%
%In our previous work, we mostly focused on the mutual information between
%features and user identity. Another important aspect of features is how easy
%they can be forged. A highly informative feature that can be forged easily is
%not desirable. Therefore experiments that measure how easy it is to forge a
%feature are quite informative and necessary to provide a complete picture. 






\subsection{Experimental setups} 
We evaluate both random attacks (RA) and targeted attacks (TA) against previous
approaches~\cite{frank2013touchalytics,li2013unobservable,attack-CCS13} and
ours; we explore the impact of the number of screen settings on the performance of our approach; 
and  we study the time required to collect training strokes in the registration phase.

 
%For targeted attacks, we further distinguish replaying touch strokes collected
%in the settings $s_a$ and $s_b$, and we denote them as TA-a and TA-b,
%respectively. 


\subsubsection{Compared approaches} 
We distinguish classifiers and authentication systems. Classifiers are key
components of a touch-based authentication system, but an authentication system
also requires to consider screen settings. We name  approaches to train
classifiers with a prefix 'C' and approaches to implement authentication systems
with a prefix 'S'. Table~\ref{approach} summarizes the approaches we compare.

\myparatight{Classifiers} We compare the following classifiers:
\begin{packeditemize}
\item {\bf
C-Baseline~\cite{frank2013touchalytics,li2013unobservable,attack-CCS13}:} This
approach considers one setting.  To train a classifier for a user $u$, they take
the touch strokes of $u$ in a setting as positive examples and those of all other
users in the same setting as negative examples. We use C-Baseline-$x$ to denote 
their approach in the setting $s_x$, where $x\in\{a, b, c,d,e\}$.

\item {\bf C-ATCA:} Our adaptive touch-based continuous authentication (ATCA)
considers multiple settings when training classifiers. Specifically, for a user
$u$, we train  classifiers for all the five screen settings. We denote them as C-ATCA-a, 
C-ATCA-b, C-ATCA-c, C-ATCA-d, and C-ATCA-e, respectively. 
To train C-ATCA-$x$, we take  strokes of
$u$ in the setting $s_x$  as positive examples, and strokes of $u$ in
the other four settings and strokes of other users in all the five settings
as negative examples, where $x\in\{a, b, c,d,e\}$.
\end{packeditemize}

We adopt Support Vector Machine (SVM)~\cite{svm2} as the classifier~\cite{svm2}
in all compared approaches since it was shown to perform well by previous
work~\cite{frank2013touchalytics,li2013unobservable}. 

\myparatight{Authentication systems} Other than using different classifiers,
authentication systems might also have different ways to use screen settings.

\begin{packeditemize}

\item {\bf S-Baseline~\cite{frank2013touchalytics, li2013unobservable,
attack-CCS13}:}  Their approach uses an universal setting (e.g., the default
setting of the smartphone system) for all users. In this case, the attacker can
obtain the universal setting, e.g., via reading the code of the authentication
system. We further use \emph{S-Baseline-$x$} to denote the
authentication system with the universal setting $s_x$, where $x\in\{a, b, c,d,e\}$.
Note that S-Baseline-$x$ uses the classifier C-Baseline-$x$.  

\item {\bf S-Baseline-improved:} We improve S-Baseline via selecting a setting
from $\{s_a,s_b,s_c,s_d,s_e\}$ uniformly at random in the registration phase and fixing it
in the authentication phase for each user. The S-Baseline-improved
 system makes the attacker unaware of the setting used for a
targeted user. 
%Moreover, we denote by \emph{S-Baseline-improved-a} and
%\emph{S-Baseline-improved-b} the authentication systems whose randomly selected
%settings are $s_a$ and $s_b$, respectively. Again, S-Baseline-improved-$x$ uses
%the classifier C-Baseline-$x$, where $x\in\{a,b\}$.

\item {\bf S-ATCA:} Our adaptive touch-based continuous authentication (ATCA)
selects a setting $s_x$ from the considered five settings uniformly at random in each time
interval and uses the classifier  C-ATCA-$x$ to authenticate users, where
$x\in\{a,b,c,d,e\}$.  

\end{packeditemize}


%\begin{table*}[!t]\renewcommand{\arraystretch}{1.1}
%\centering
%\caption{Attacks to the 4 considered authentication systems in 6 scenarios in which the attacker has collected different set of touch strokes. The sympol '|' means \emph{or}.}
%\addtolength{\tabcolsep}{-3pt}
%\begin{tabular}{|c|c|c|c|c|c|c|} \hline
% & Other-a & Other-b & Other-both & Target-a & Target-b & Target-both \\ \hline
%S-Baseline-a & RA-aa & RA-ab & RA-ab & TA-aa & TA-ab & TA-aa \\ \hline
%S-Baseline-b & RA-ba & RA-bb & RA-ba & TA-ba & TA-bb & TA-bb \\ \hline
%\multirow{2}{*}{S-Baseline-improved} &\multirow{2}{*}{RA-aa|RA-ba} & \multirow{2}{*}{RA-ab|RA-bb} & RA-aa|RA-ba & \multirow{2}{*}{TA-aa|TA-ba} & \multirow{2}{*}{TA-ab|TA-bb} & TA-aa|TA-ba \\ 
%&&&|RA-ab|RA-bb &&&|TA-ab|TA-bb \\ \hline
%\multirow{2}{*}{S-ATCA} &\multirow{2}{*}{RA-aa|RA-ba} & \multirow{2}{*}{RA-ab|RA-bb} & RA-aa|RA-ba & \multirow{2}{*}{TA-aa|TA-ba} & \multirow{2}{*}{TA-ab|TA-bb} & TA-aa|TA-ba \\ 
%&&&|RA-ab|RA-bb &&&|TA-ab|TA-bb \\ \hline
%\end{tabular}
%\label{attacks}
%\end{table*}



%However, for our adaptive authentication system, the attacker still does not know  which setting is used in each time interval because it is randomly sampled.\footnote{Note that we assume the attacker cannot look into the authentication system to probe which setting is used at runtime, because such probing requires high privileges (e.g., root access to the smartphone system) and an attacker that has obtained these high privileges already compromises the smartphone system.} 


\begin{table*}[!t]\renewcommand{\arraystretch}{1}
%\vspace{-4mm}
\centering
\caption{Mean EERs over all subjects for each classifier and attack dataset for
horizontal strokes. Numbers in parentheses are standard deviations.}
%\addtolength{\tabcolsep}{-5pt}
\subfloat[Horizontal strokes, random attacks]{
%\addtolength{\tabcolsep}{-5pt}
\begin{tabular}{|c|c|c|c|c|c|} \hline
&{\small $s_a$} & {\small $s_b$} & {\small $s_c$} & {\small $s_d$} & {\small $s_e$} \\ \hline
{\small C-Baseline-a}&{\small 0.06(0.0543)}&{\small 0.06(0.0485)}&{\small 0.06(0.0472)}&{\small 0.07(0.0530)}&{\small 0.07(0.0547)}\\ \hline
{\small C-Baseline-b}&{\small 0.04(0.0461)}&{\small 0.04(0.0462)}&{\small 0.05(0.0423)}&{\small 0.05(0.0447)}&{\small 0.05(0.0472)}\\ \hline
{\small C-Baseline-c}&{\small 0.07(0.0590)}&{\small 0.07(0.0518)}&{\small 0.06(0.0498)}&{\small 0.06(0.0463)}&{\small 0.06(0.0541)}\\ \hline
{\small C-Baseline-d}&{\small 0.10(0.0817)}&{\small 0.09(0.0818)}&{\small 0.09(0.0742)}&{\small 0.09(0.0792)}&{\small 0.09(0.0757)}\\ \hline
{\small C-Baseline-e}&{\small 0.09(0.0891)}&{\small 0.10(0.0966)}&{\small 0.10(0.0942)}&{\small 0.10(0.0973)}&{\small 0.09(0.0991)}\\ \hline
{\small C-ATCA-a}&{\small 0.04(0.0736)}&{\small \bf 0.02(0.0534)}&{\small \bf 0.02(0.0437)}&{\small \bf 0.01(0.0355)}&{\small \bf 0.01(0.0291)}\\ \hline
{\small C-ATCA-b}&{\small \bf 0.02(0.0554)}&{\small 0.04(0.0681)}&{\small \bf 0.02(0.0572)}&{\small 0.02(0.0437)}&{\small 0.02(0.0544)}\\ \hline
{\small C-ATCA-c}&{\small 0.06(0.0782)}&{\small 0.07(0.0822)}&{\small 0.08(0.0778)}&{\small 0.06(0.0634)}&{\small 0.06(0.0675)}\\ \hline
{\small C-ATCA-d}&{\small 0.06(0.0771)}&{\small 0.06(0.0823)}&{\small 0.06(0.0787)}&{\small 0.09(0.0857)}&{\small 0.07(0.0811)}\\ \hline
{\small C-ATCA-e}&{\small 0.03(0.0719)}&{\small 0.04(0.0743)}&{\small 0.04(0.0703)}&{\small 0.05(0.0755)}&{\small 0.06(0.0864)}\\ \hline
\end{tabular}
\label{hor-ra}
%\vspace{-4mm}
}

\subfloat[Horizontal strokes, targeted attacks]{
\begin{tabular}{|c|c|c|c|c|c|} \hline
&{\small $s_a$} & {\small $s_b$} & {\small $s_c$} & {\small $s_d$} & {\small $s_e$} \\ \hline
{\small C-Baseline-a}&{\small 0.50(0.0000)}&{\small 0.49(0.1142)}&{\small 0.44(0.1586)}&{\small 0.38(0.2023)}&{\small 0.37(0.2051)}\\ \hline
{\small C-Baseline-b}&{\small 0.46(0.1142)}&{\small 0.50(0.0000)}&{\small 0.47(0.1388)}&{\small 0.35(0.1602)}&{\small 0.35(0.1710)}\\ \hline
{\small C-Baseline-c}&{\small 0.49(0.1442)}&{\small 0.49(0.1181)}&{\small 0.50(0.0000)}&{\small 0.46(0.1397)}&{\small 0.41(0.1876)}\\ \hline
{\small C-Baseline-d}&{\small 0.43(0.1926)}&{\small 0.44(0.1866)}&{\small 0.46(0.1376)}&{\small 0.50(0.0000)}&{\small 0.47(0.1129)}\\ \hline
{\small C-Baseline-e}&{\small 0.39(0.2480)}&{\small 0.40(0.2210)}&{\small 0.41(0.1852)}&{\small 0.42(0.1752)}&{\small 0.50(0.0000)}\\ \hline
{\small C-ATCA-a}&{\small 0.50(0.0000)}&{\small 0.27(0.1563)}&{\small \bf 0.23(0.1384)}&{\small \bf 0.16(0.1684)}&{\small \bf 0.16(0.1515)}\\ \hline
{\small C-ATCA-b}&{\small 0.33(0.1475)}&{\small 0.50(0.0000)}&{\small 0.30(0.1166)}&{\small 0.25(0.1185)}&{\small 0.23(0.1437)}\\ \hline
{\small C-ATCA-c}&{\small 0.37(0.1569)}&{\small 0.35(0.1340)}&{\small 0.50(0.0000)}&{\small 0.32(0.1100)}&{\small 0.35(0.1370)}\\ \hline
{\small C-ATCA-d}&{\small 0.27(0.1390)}&{\small 0.29(0.1353)}&{\small 0.33(0.1311)}&{\small 0.50(0.0000)}&{\small 0.35(0.1019)}\\ \hline
{\small C-ATCA-e}&{\small \bf 0.21(0.1780)}&{\small \bf 0.22(0.1729)}&{\small 0.24(0.1721)}&{\small 0.25(0.1516)}&{\small 0.50(0.0000)}\\ \hline
\end{tabular}
\label{hor-ta}
}
\label{hor}
\vspace{-4mm}
\end{table*}


\subsubsection{Training and testing} 
We evaluate the approaches via 5-fold cross-validation.
  Next, we take \emph{horizontal strokes} as an example to
illustrate the details. The vertical strokes are treated in the same way. The set of
our subjects is denoted as $U_d$.

We evenly split horizontal strokes of each user in each setting into 5
folds uniformly at random. Let $F=\{1,2,3,4,5\}$ denote the IDs of the 5 folds.
Moreover, we denote by $f(u,s,i)$ the $i$th fold of horizontal strokes of the user $u$ in
the setting $s$, where $i\in F$ and $s\in \{s_a,s_b,s_c,s_d,s_e\}$. 

For each user $u$, we iterate over $i$. For each $i$, we train classifiers as
follows:

\myparatight{Training C-Baseline classifiers} To train C-Baseline-$x$, we
use $u$'s horizontal strokes in the setting $s_x$ (i.e., $\cup_{j\in
F-\{i\}}$ $f(u,s_x,j)$ as positive examples and other users' horizontal strokes in the
setting $s_x$ (i.e., $\cup_{v\in U_d-\{u\}}\cup_{j\in F-\{i\}}f(u,s_x,j)$) as negative examples, where $x\in\{a,b,c,d,e\}$.  

\myparatight{Training C-ATCA classifiers} To train a C-ATCA-$x$ classifier,
we use $u$'s horizontal strokes in the setting $s_x$ (i.e., $\cup_{j\in
F-\{i\}}f(u,s_x,j)$) as positive examples. However, we treat $u$'s horizontal strokes
in the other four settings (i.e., $\cup_{j\in F-\{i\}}f(u,s_y,j)$, where $y\in \{a,b,c,d,e\}/$
$\{x\}$) and other users'
horizontal strokes in all the five settings (i.e., $\cup_{v\in U_d-\{u\}}\cup_{j\in
F-\{i\}}f(u,s_z,j)$, where $z\in\{a,b,c,d,e\}$)
as negative examples, where $x\in\{a,b,c,$ 
$d,e\}$. 

We adopt a Gaussian kernel for SVM and use the LibSVM
library~\cite{chang2011libsvm} to learn the corresponding hyper-parameters via
grid search. Each feature is re-scaled to be between -1 and 1. Note that
training features and testing features are normalized separately.


\myparatight{Testing} In the test phase, we use $u$'s horizontal strokes in a setting
(i.e., $f(u,s_x,i)$) as legitimate (or positive) examples for the classifiers
trained for the same setting (i.e., C-Baseline-$x$ and C-ATCA-$x$), where $x\in
\{a,b,c,d,e\}$. Moreover, we treat other users' horizontal strokes in all the five settings (i.e.,
$\cup_{v\in U_d-\{u\}} f(v,s_z,i)$, where $z\in\{a,b,c,d,e\}$) as
strokes to perform random attacks; and we treat the target user's horizontal strokes
in the five settings (i.e., $f(u,s_z,i)$, where $z\in\{a,b,c,d,$ 
$e\}$) as strokes to perform
targeted attacks. For each user, training and testing are performed with 5 \emph{trials} since
we have 5 folds, and the results are averaged over them.







\subsubsection{Evaluation metrics}
Our evaluation metric involves the false-acceptance rate (FAR), the false
rejection rate (FRR), and the mean time $T$ required to make the first
authentication decision in a session. FAR is the fraction of strokes of
imposters that are recognized as strokes of the legitimate user by the classifier.
FRR is the fraction of strokes of legitimate users that are rejected by the
classifier. FRR quantifies the empirical probability that the legitimate user must
resort to conventional authentication mechanisms. Put in a temporal context, if
$T_s$ is the average time between two strokes, then the expected time after
which the legitimate user must type in a password due to misclassification is
FRR$^{-1}T_s$.




 


The two error rates FRR and FAR can be traded off against each other via 
changing the decision threshold of the classifier. For instance, at the
cost of missing out some imposters one can reduce FRR by decreasing the threshold.
% the classifiers
%more conservative. 
%And at the cost of more false negatives one can increase the
%probability of detecting intruders. 
In order to account for this
usability-security trade-off, we report the equal error rate (EER) in all
experiments. This is the error rate at the threshold where
FAR equals FRR.

For a classifier and an attack dataset (e.g., random attacks using strokes
collected in $s_a$,  targeted attacks using strokes collected in $s_b$), we compute an EER using the dataset that consists of the
classifier's test positive examples (legitimate  strokes) and the attack
dataset. Intuitively, EER in our context measures the degree of separability
between  touch strokes of legitimate users and attack strokes. 



%\myparatight{EER of classifiers} For a classifier and an attack dataset (e.g.,,
%random attacks in the setting $s_a$,  targeted attacks in the setting $s_b$),
%we compute an EER for the dataset consisting of the classifier's test positive
%examples (legit touch strokes) and the attack dataset. Intuitively, EER in our
%context measures the degree of separability between  touch strokes of legit
%users and attack strokes. 
 
%\myparatight{EER of authentication systems} For each attack scenario, we have a
%set of possible attacks for each authentication system, which are shown in
%Table~\ref{attacks}. Moreover, the set of possible attacks are performed with
%an equal probability. Therefore, for an authentication system and an attack
%scenario, we compute an EER via averaging the EERs of the corresponding
%possible attacks, and this average EER is used to measure the resilience of the
%authentication system to the attacks.   






\subsection{Results for classifiers}

Table~\ref{hor} and Table~\ref{ver} show the mean EERs of our subjects for each classifier and
each attack dataset for horizontal strokes and vertical strokes, respectively.

%\myparatight{Stability} We find that a user's touch behaviors across the two
%settings are relatively stable. Using the targeted user's touch strokes
%collected in one setting to attack the targeted user in another setting (i.e.,
%diff-setting targeted attacks) achieves high EERs for the baseline classifiers.
%For instance, the EER of using the targeted user's touch strokes collected in
%the setting $s_b$ to attack the baseline classifier trained in the setting
%$s_a$ (i.e., C-Baseline-a) is as high as 35\% for horizontal strokes. Recall
%that the baseline classifiers are trained to distinguish touch behaviors of the
%targeted user between those of other users in a single setting. The high EERs
%of diff-setting targeted attacks indicate that a user's touch behaviors are
%stable, i.e., the touch behaviors of a user in one setting are closer to those
%of the user in another setting than  those of other users. 

%\myparatight{Sensitivity} We find that a user's touch behaviors across the two
%settings are also sensitive, i.e., a user's touch behaviors in two settings can
%be distinguished with high accuracies.  This is confirmed by the fact that
%diff-setting targeted attacks achieve low EERs for our classifiers. Moreover,
%for diff-setting targeted attacks, EERs of our classifiers C-ATCA for
%horizontal strokes are smaller than those for vertical strokes, which means
%that a user's behaviors are more sensitive for horizontal strokes than for
%vertical strokes. 

\myparatight{Diff-setting attacks vs. same-setting attacks} We call an attack as
a \emph{same-setting attack} if the attack strokes are collected in the same
setting with the one in which the classifier uses. Otherwise, we call an attack
\emph{diff-setting attack}. For instance, random attacks using strokes collected
in the setting $s_a$ to the classifier C-Baseline-a or C-ATCA-a are same-setting
attacks, while random attacks using strokes collected in the setting $s_a$ to
the classifier C-Baseline-b or C-ATCA-b are diff-setting attacks. Moreover, 
we denote by RA-$xy$ (or TA-$xy$) the random attacks (or targeted attacks) that use
strokes collected in the setting $s_y$ to the classifier that uses
the setting $s_x$, where $x,y\in\{a,b,c,d,e\}$.  


\begin{table*}[!t]\renewcommand{\arraystretch}{1}
\centering
\caption{Mean EERs over all subjects for each classifier and attack dataset for
vertical strokes. Numbers in parentheses are standard deviations.}
%\addtolength{\tabcolsep}{-5pt}
\subfloat[Vertical strokes, random attacks]{
%\addtolength{\tabcolsep}{-5pt}
\begin{tabular}{|c|c|c|c|c|c|} \hline
&{\small $s_a$} & {\small $s_b$} & {\small $s_c$} & {\small $s_d$} & {\small $s_e$} \\ \hline
{\small C-Baseline-a}&{\small 0.09(0.0873)}&{\small 0.10(0.0913)}&{\small 0.11(0.0986)}&{\small 0.11(0.1024)}&{\small 0.12(0.1089)}\\ \hline
{\small C-Baseline-b}&{\small 0.08(0.0641)}&{\small 0.08(0.0652)}&{\small 0.09(0.0697)}&{\small 0.10(0.0760)}&{\small 0.10(0.0867)}\\ \hline
{\small C-Baseline-c}&{\small 0.11(0.0992)}&{\small 0.12(0.1019)}&{\small 0.12(0.1032)}&{\small 0.12(0.1091)}&{\small 0.13(0.1161)}\\ \hline
{\small C-Baseline-d}&{\small 0.12(0.1019)}&{\small 0.12(0.0969)}&{\small 0.12(0.0980)}&{\small 0.11(0.0936)}&{\small 0.12(0.1022)}\\ \hline
{\small C-Baseline-e}&{\small 0.15(0.1100)}&{\small 0.14(0.1046)}&{\small 0.14(0.1065)}&{\small 0.14(0.1060)}&{\small 0.15(0.1158)}\\ \hline
{\small C-ATCA-a}&{\small \bf 0.07(0.0802)}&{\small \bf 0.05(0.0727)}&{\small \bf 0.05(0.0697)}&{\small \bf 0.05(0.0692)}&{\small \bf 0.07(0.0960)}\\ \hline
{\small C-ATCA-b}&{\small 0.08(0.0698)}&{\small 0.11(0.0742)}&{\small 0.09(0.0742)}&{\small 0.08(0.0766)}&{\small 0.09(0.0819)}\\ \hline
{\small C-ATCA-c}&{\small 0.08(0.0748)}&{\small 0.08(0.0785)}&{\small 0.12(0.0914)}&{\small 0.09(0.0799)}&{\small 0.11(0.0899)}\\ \hline
{\small C-ATCA-d}&{\small \bf 0.07(0.0688)}&{\small 0.08(0.0763)}&{\small 0.08(0.0759)}&{\small 0.11(0.0843)}&{\small 0.10(0.0846)}\\ \hline
{\small C-ATCA-e}&{\small \bf 0.07(0.0702)}&{\small 0.06(0.0644)}&{\small 0.07(0.0672)}&{\small 0.08(0.0728)}&{\small 0.12(0.0935)}\\ \hline
\end{tabular}
\label{ver-ra}
%\vspace{-4mm}
}

\subfloat[Vertical strokes, targeted attacks]{
\begin{tabular}{|c|c|c|c|c|c|} \hline
&{\small $s_a$} & {\small $s_b$} & {\small $s_c$} & {\small $s_d$} & {\small $s_e$} \\ \hline
{\small C-Baseline-a}&{\small 0.50(0.0000)}&{\small 0.44(0.0930)}&{\small 0.42(0.1322)}&{\small 0.41(0.1587)}&{\small 0.35(0.1651)}\\ \hline
{\small C-Baseline-b}&{\small 0.48(0.0747)}&{\small 0.50(0.0000)}&{\small 0.45(0.1198)}&{\small 0.42(0.1209)}&{\small 0.38(0.1289)}\\ \hline
{\small C-Baseline-c}&{\small 0.44(0.1189)}&{\small 0.44(0.0825)}&{\small 0.50(0.0000)}&{\small 0.46(0.1199)}&{\small 0.41(0.1614)}\\ \hline
{\small C-Baseline-d}&{\small 0.42(0.1345)}&{\small 0.43(0.0978)}&{\small 0.46(0.1154)}&{\small 0.50(0.0000)}&{\small 0.44(0.0811)}\\ \hline
{\small C-Baseline-e}&{\small 0.44(0.1018)}&{\small 0.44(0.1122)}&{\small 0.45(0.0820)}&{\small 0.47(0.1025)}&{\small 0.50(0.0000)}\\ \hline
{\small C-ATCA-a}&{\small 0.50(0.0000)}&{\small \bf 0.26(0.0956)}&{\small \bf 0.26(0.1264)}&{\small \bf 0.24(0.1304)}&{\small \bf 0.23(0.1405)}\\ \hline
{\small C-ATCA-b}&{\small 0.36(0.1200)}&{\small 0.50(0.0000)}&{\small 0.30(0.0940)}&{\small 0.31(0.1167)}&{\small 0.31(0.1324)}\\ \hline
{\small C-ATCA-c}&{\small 0.33(0.1093)}&{\small 0.32(0.1048)}&{\small 0.50(0.0000)}&{\small 0.31(0.1091)}&{\small 0.32(0.1282)}\\ \hline
{\small C-ATCA-d}&{\small 0.28(0.0949)}&{\small 0.31(0.0842)}&{\small 0.30(0.0986)}&{\small 0.50(0.0000)}&{\small 0.31(0.0803)}\\ \hline
{\small C-ATCA-e}&{\small \bf 0.25(0.1091)}&{\small 0.28(0.0988)}&{\small 0.30(0.0811)}&{\small 0.29(0.0914)}&{\small 0.50(0.0000)}\\ \hline
\end{tabular}
\label{ver-ta}
}
\label{ver}
%\vspace{-4mm}

\end{table*}


\begin{table*}[!t]\renewcommand{\arraystretch}{1}
%\vspace{-4mm}
\centering
\caption{Possible attacks to the 7  authentication systems.}
\addtolength{\tabcolsep}{-3pt}
\begin{tabular}{|c|c|c|} \hline
 & {\small Random attacks} & {\small Targeted attacks} \\ \hline
{\small S-Baseline-$a$} & {\small $\max\{\text{RA-}ay\}$ for $y\in \{a,b,c,d,e\}$} & {\small TA-$aa$} \\ \hline
{\small S-Baseline-$b$} & {\small $\max\{\text{RA-}by\}$ for $y\in \{a,b,c,d,e\}$} & {\small TA-$bb$} \\ \hline
{\small S-Baseline-$c$} & {\small $\max\{\text{RA-}cy\}$ for $y\in \{a,b,c,d,e\}$} & {\small TA-$cc$} \\ \hline
{\small S-Baseline-$d$} & {\small $\max\{\text{RA-}dy\}$ for $y\in \{a,b,c,d,e\}$} & {\small TA-$dd$} \\ \hline
{\small S-Baseline-$e$} & {\small $\max\{\text{RA-}ey\}$ for $y\in \{a,b,c,d,e\}$} & {\small TA-$ee$} \\ \hline
%\multirow{2}{*}{S-Baseline-improved} & RA-aa, RA-ba & TA-aa, TA-ba \\ 
%&RA-ab, RA-bb &TA-ab, TA-bb \\ \hline
{\small S-Baseline-improved} & {\small RA-$xy$, where $x,y\in \{a,b,c,d,e\}$} & {\small TA-$xy$, where $x,y\in \{a,b,c,d,e\}$} \\ \hline
{\small S-ATCA} & {\small RA-$xy$, where $x,y\in \{a,b,c,d,e\}$} & {\small TA-$xy$, where $x,y\in \{a,b,c,d,e\}$} \\ \hline
%\multirow{2}{*}{S-ATCA} & RA-aa, RA-ba & TA-aa, TA-ba \\ 
%&RA-ab, RA-bb &TA-ab, TA-bb \\ \hline
\end{tabular}
\label{attacks}
%\vspace{-4mm}
\end{table*}

As we expect, same-setting targeted attacks achieve
higher EERs than diff-setting targeted attacks for both C-Baseline classifiers
 and our C-ATCA classifiers. This is because  users' touch behaviors are sensitive.
 For instance, for horizontal strokes,
 EERs of diff-setting targeted attacks are 13\%-34\% smaller than those of  
same-setting targeted attacks for our C-ATCA classifiers depending on which setting
is used to collect the targeted attacks data. 

Moreover, when the difference between the screen setting used to collect 
the targeted attacks data and the screen setting of the classifier increases, 
the EER of the corresponding diff-setting attacks decreases. For instance, for horizontal
strokes,
 the EER of the diff-setting targeted attack TA-$ea$ is 12\% smaller than that of 
the diff-setting targeted attack TA-$ba$ for our C-ATCA classifiers. Our observations imply that users'
touch behaviors are more sensitive when the differences between screen settings are larger. 
  


\myparatight{C-Baseline vs. C-ATCA} Our classifiers
perform significantly better than C-Baseline classifiers at  defending
against diff-setting attacks. Specifically, EERs of diff-setting random attacks
to our classifiers are 1\% to 8\% smaller than those of the C-Baseline
classifiers. For instance, with horizontal strokes,  the EER of
the diff-setting random attacks RA-$ea$ is 9\% for the C-Baseline-$e$ classifier.
 However, the EER of RA-$ea$ is 3\% for 
our classifier C-ATCA-$e$, which is 6\% smaller than the C-Baseline-$e$ classifier.
 Moreover, EERs of diff-setting
targeted attacks to  our classifiers are 6\% to 22\% smaller than those of the
C-Baseline classifiers. For instance, with horizontal strokes, the
EER of the diff-setting targeted attacks TA-$ea$ is 39\% for the C-Baseline-$e$ classifier.
However, the EER of TA-$ea$ is 21\% for our classifier C-ATCA-$e$, which is 18\% smaller than the 
C-Baseline-$e$ classifier.
This is because a user's
touch behaviors in the five screen settings are both stable and sensitive, which results
in high EERs for the C-Baseline classifiers and explains the low EERs for our
classifiers, respectively.



For same-setting random attacks, the EERs of our classifiers are slightly larger
than those of the C-Baseline classifiers in some cases. This is because our classifiers in a
setting $s$ use more negative examples other than the strokes of other users
collected in $s$, which somehow makes their decision boundaries move towards the
strokes of other users collected in $s$, and thus same-setting random attacks
achieve slightly higher EERs. As we expect, same-setting targeted attacks
achieve high EERs for all classifiers. Specifically, EERs of our classifiers and
the C-Baseline classifiers are all close to 50\% for same-setting targeted
attacks. This means that, for each stroke, the classifier makes a
random decision, i.e., it accepts or rejects it with the same probability of
0.5.



%\myparatight{Horizontal strokes vs. vertical strokes} We observe that, for
%diff-setting targeted attacks, EERs of our classifiers for horizontal (left or right) strokes
%are smaller than those for vertical (up or down) strokes. This implies that a user's
%horizontal touch behaviors are more sensitive than its vertical touch behaviors
%to screen settings.

 


%First, both Baseline and our approach can effectively defend againt random
%attacks. Specifically, the median EERs for all classifiers and random attacks
%are at most 5\%.  Moreover, our approach ATCA performs significantly better
%than the Baseline approachs at  defending against diff-setting random attacks.
%For instance, EER of Baseline-a vs. RA-$s_a$ is 3\% for horizontal strokes
%while    





\subsection{Results for authentication systems}
We first introduce possible attacks to the considered authentication systems and then show comparison results.

\myparatight{Attacks} Suppose 
%we aim to defend against the \emph{worst-case
%attacks}. Specifically, we suppose 
the attacker already knows the set of
settings $\{s_a,s_b, s_c,s_d,s_e\}$ that \emph{could} be used by the authentication systems.
Moreover, for a targeted user, we assume the attacker obtains touch strokes of
the targeted user or other users in all the five settings. This means
that the attacker can perform targeted attacks or random attacks using strokes
collected in any of the five settings. 
 %We call an attack a \emph{same-setting (SS) attack} if the attack strokes are
 %collected in the same setting with the one used by the authentication system.
 %Otherwise, we call an attack \emph{diff-setting (DS) attack}. For instance,
 %random attacks using strokes collected in the setting $s_a$ to an
 %authentication system that also uses the setting $s_a$ are same-setting
 %attacks, while random attacks using strokes collected in the setting $s_a$ to
 %an authentication system that uses the setting $s_b$  are diff-setting
 %attacks. In total, we could have SS-RA-a, SS-TA-
 Recall that RA-$xy$ (or TA-$xy$) denotes the random attacks (or targeted attacks) that use
strokes collected in the setting $s_y$ to authentication systems that use
the setting  $s_x$, where $x,y\in\{a,b,c,d,e\}$.  
Note that the attacker does not know which setting (or classifier) is
currently used by our authentication system at a given time point.

%There are 6 possible scenarios depending on what  touch strokes the attacker
%has obtained. The 6  scenarios are as follows:
%
%\myparatight{Target-a, Target-b, and Target-both} The attacker obtains touch
%strokes of the target user in the setting $s_a$ (i.e., Target-a) or $s_b$
%(i.e., Target-b) or both (i.e., Target-both). 
%
%\myparatight{Other-a, Other-b, and Other-both} The attacker obtains touch
%strokes of other users in the setting $s_a$ (i.e., Other-a) or $s_b$ (i.e.,
%Other-b) or both (i.e., Other-both). 
%
%In the scenarios Other-a, Other-b, Target-a, and Target-b, the attacker
%randomly picks touch strokes from the collected and replays them to attack any
%authentication system. The situation is more complex for Other-both and
%Target-both. 

To attack the baseline authentication system that uses the setting $s_x$ (i.e.,
S-Baseline-$x$), the attacker can choose to perform the best random attacks
(i.e., $\max\{\text{RA}$
$\text{-}xy\}$ for $y\in\{a,b,c,d,e\}$) or 
same-setting targeted attacks (i.e., TA-$xx$) that achieve the highest EERs,
 where
$x\in\{a,b,c,d,e\}$. This is because the attacker can know the used screen setting.

%This is because we already showed, in
%Table~\ref{result}, that diff-setting random attacks achieve higher EERs than
%same-setting random attacks and that same-setting targeted attacks achieve
%higher EERs than diff-setting targeted attacks.

To attack S-Baseline-improved or S-ATCA, the attacker does not know the setting
of the authentication system\footnote{Note that we assume the attacker cannot
access the settings of the authentication system  at runtime, because such
access requires high privileges (e.g., root access to the operating system) and
an attacker that has already obtained these high privileges already compromised
the device.} and thus it randomly selects a setting and replays
strokes collected in the selected setting. As a result, the 25 possible
attacks RA-$xy$ for $x,y\in \{a,b,c,d,e\}$ are performed with an equal probability
of $\frac{1}{25}$ in the random attacks, and TA-$xy$ for $x,y\in \{a,b,c,d,e\}$ are
performed with an equal probability of $\frac{1}{25}$ in the targeted attacks. 
Table~\ref{attacks} summarizes the possible attacks to different authentication
systems.

%\begin{table}[!t]\renewcommand{\arraystretch}{1.1}
%\centering
%\caption{Mean EERs over all subjects for each authentication system and attack
%for up strokes and left strokes. Numbers in parentheses are standard deviations.
%Results for down strokes and right strokes are shown in the Appendix in
%Table~\ref{result-auth2}}
%\addtolength{\tabcolsep}{-2pt}
%\subfloat[Up strokes]{
%\addtolength{\tabcolsep}{-0.5pt}
%\begin{tabular}{|c|c|c|} \hline
%& Random attacks & Targeted attacks \\ \hline
%S-Baseline-a&0.06(0.0841)&0.50(0.0000)\\ \hline
%S-Baseline-b&0.05(0.0743)&0.50(0.0000)\\ \hline
%S-Baseline-improved&0.04(0.0408)&0.42(0.0731)\\ \hline
%S-ATCA&{\bf 0.03(0.0324)}&{\bf 0.30(0.0465)}\\ \hline
%\end{tabular}
%\label{vertical-auth}}

%\subfloat[Left strokes]{
%\begin{tabular}{|c|c|c|} \hline
%& Random attacks & Targeted attacks \\ \hline
%S-Baseline-a&0.06(0.0510)&0.50(0.0000)\\ \hline
%S-Baseline-b&0.07(0.0735)&0.50(0.0000)\\ \hline
%S-Baseline-improved&0.05(0.0410)&0.40(0.0779)\\ \hline
%S-ATCA&{\bf 0.02(0.0298)}&{\bf 0.27(0.0207)}\\ \hline
%\end{tabular}
%\label{horizontal-auth}}

%\label{result-auth}
%\end{table}


\begin{table}[!t]\renewcommand{\arraystretch}{1}
%\vspace{-4mm}
\centering
\caption{Mean EERs over all subjects for each authentication system and attack
for horizontal strokes and vertical strokes. Numbers in parentheses are standard deviations. 
We find that our authentication system achieves 
significantly smaller EERs than previous work for both random attacks and targeted attacks. }
\addtolength{\tabcolsep}{-2pt}

\subfloat[Horizontal strokes]{
\begin{tabular}{|c|c|c|} \hline
& {\small Random attacks} & {\small Targeted attacks} \\ \hline
{\small S-Baseline-a}&{\small 0.08(0.0577)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-b}&{\small 0.06(0.0516)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-c}&{\small 0.09(0.0616)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-d}&{\small 0.11(0.0817)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-e}&{\small 0.11(0.0969)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-improved}&{\small 0.07(0.0412)}&{\small 0.44(0.0512)}\\ \hline
{\small S-ATCA}&{\small \bf 0.04(0.0488)}&{\small \bf 0.32(0.0783)}\\ \hline
\end{tabular}
\label{horizontal-auth}}


\subfloat[Vertical strokes]{
\addtolength{\tabcolsep}{-0.5pt}
\begin{tabular}{|c|c|c|} \hline
& {\small Random attacks} & {\small Targeted attacks} \\ \hline
{\small S-Baseline-a}&{\small 0.12(0.1067)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-b}&{\small 0.11(0.0819)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-c}&{\small 0.14(0.1111)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-d}&{\small 0.14(0.1051)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-e}&{\small 0.17(0.1187)}&{\small 0.50(0.0000)}\\ \hline
{\small S-Baseline-improved}&{\small 0.12(0.0777)}&{\small 0.45(0.0364)}\\ \hline
{\small S-ATCA}&{\small \bf 0.08(0.0542)}&{\small \bf 0.33(0.0502)}\\ \hline
\end{tabular}
\label{vertical-auth}}
\label{result-auth}
\vspace{-4mm}
\end{table}



\begin{figure}[ht]
\vspace{-2mm}
\centering
{\includegraphics[width=0.8\columnwidth]{impact-settings-all.pdf}}

\caption{EERs of targeted attacks to our authentication system as a function of the number of screen settings for both scenarios and both horizontal and vertical strokes. We observe that our system can better defend against forgery attacks with more screen settings.} 
\label{impact-settings}
\vspace{-4mm}
 \end{figure}
 
 
 \myparatight{EER of authentication systems} For an authentication system and an
attack scenario (e.g., random attacks or targeted attacks), we compute an EER
via averaging the EERs of the  possible attacks to the authentication system,
 and this average EER is used to measure the resilience of
the authentication system to the attacks.   



\begin{figure*}[!t]
%\vspace{-4mm}
\centering
\subfloat[Random attacks]{\includegraphics[width=0.8\columnwidth]{learning-rate-ra.pdf}}
\subfloat[Targeted attacks]{\includegraphics[width=0.8\columnwidth]{learning-rate-ta.pdf}}

\caption{EERs of various attacks as a function of the time spent on collecting
training horizontal strokes. The classifier is C-ATCA-e. EERs of targeted attacks (TA) in the screen setting $s_e$ are always 0.5, and thus we do not show them in (b) to better contrast the differences of EERs in other screen settings. We find that learning our classifier is fast, i.e., the EERs are stable or slightly fluctuate after two minutes (around 30 strokes) spent on collecting training strokes.} 
\label{learning}
\vspace{-2mm}
 \end{figure*}
 
 
\myparatight{Results} Table~\ref{result-auth} shows the mean EERs over all
subjects for  each authentication system and attack scenario for horizontal strokes and vertical strokes.
 
Overall, we find that our adaptive authentication system achieves the smallest
EERs for both random attacks and targeted attacks. Specifically, the EER of adaptive authentication system 
is 2\% to 9\% smaller than those of the baseline and improved baseline authentication systems for random attacks. For targeted attacks, our improved baseline authentication system (i.e., S-Baseline-improved)  is 5\% to 6\% smaller than that of the
baseline authentication systems, and our adaptive authentication system
further decreases the EER  by 12\% for both horizontal and vertical strokes.  


\subsection{Impact of the number of screen settings} We show that the EERs of our authentication system decrease when we use more appropriate screen settings. 
Towards this goal, we vary the number of screen settings and compare the corresponding EERs.

Considering the influence of the difference between two screen settings, we consider two scenarios, in which the number of screen settings increases in different fashions. 
The two scenarios are:
\begin{packeditemize}
\item {\bf Scenario I:} The new screen settings are out of the range that is covered by the existing screen settings.
Specifically, we consider two screen settings consist of $\{s_a,s_b\}$, three settings consist of $\{s_a,s_b,s_c\}$, four settings consist of $\{s_a,s_b,s_c,s_d\}$, and five settings consist of $\{s_a,s_b,s_c,s_d,s_e\}$.
\item {\bf Scenario II:} The new screen settings are in the range that is covered by the existing screen settings.
Specifically, we consider that two screen settings consist of $\{s_a,s_e\}$,
three settings consist of $\{s_a,s_c,s_e\}$, four settings consist of
$\{s_a,s_b,s_c,s_e\}$,\footnote{We also tried the other four-screen-settings $\{s_a,s_c,s_d,
s_e\}$, and we found that the two four-screen-settings achieve similar EERs.} and five settings consist of $\{s_a,s_b,s_c,s_d,s_e\}$.
\end{packeditemize}  





Since EERs of random attacks are all small, we focus on targeted attacks. 
Figure~\ref{impact-settings} shows EERs of targeted attacks to our system for different number of screen settings. We observe that  our authentication system achieves smaller EERs as the number of settings increases for both horizontal strokes and vertical strokes and for both scenarios. This is because,  with less screen settings, the performance of our authentication system 
is dominated by the same-setting targeted attacks whose EERs are high. 
However, with more settings, the impact of same-setting targeted attacks is smaller,
 and the performance of our authentication system gets improved. In fact, the probability of same-setting targeted attacks
 is $\frac{1}{n}$, where $n$ is the number of
settings used.


 
\subsection{Learning our classifiers is fast}
To learn our classifiers for a user, we
need to collect his/her touch strokes. To study the effect of time spent on
collecting training strokes from a new user on the performance of our classifiers, 
we sample a
user and one of the five trials/folds. In the selected trial, we keep the test dataset
and attack datasets the same while increasing the positive training dataset 
(the negative training dataset is fixed).
Figure~\ref{learning} shows the EERs of various attacks as a function of time
spent on collecting positive training horizontal strokes. The classifier is C-ATCA-e. EERs
of the targeted attacks using strokes collected in the setting $s_e$ (i.e., `TA,
$s_e$') are all close to 50\%, and thus are ignored to better contrast the
differences of other EERs. 

We find that EERs converge very fast. In particular, after 2 minutes (around 30
strokes),  EERs are stable or slightly fluctuate. Moreover, after collecting
 strokes, training a classifier is finished within 1
second.





 
%Figure~\ref{impact-scenario} shows the EERs of targeted attacks to our authentication system as a function of the number of screen settings for the two scenarios. We find that Scenario II achieves significantly smaller EERs than Scenario I. This means that, to better defend against forgery attacks, we should add new screen settings from the range that is not already covered by the existing screen settings. Note that, in practice, we also need to constrain the new screen settings such that they will not affect the usability of the authentication system. 
 
  

%\subsection{Non-Markovian property}
%Our adaptive authentication system randomly picks a setting and uses the
%corresponding classifier in each time interval, and the classifiers are trained
%during the registration phase. Thus, our system requires that a user's touch
%behaviors in a setting do not depend on the previous setting of our system, i.e., the
%\emph{non-Markovian property}. Intuitively, the non-Markovian property holds
%since a user's touch behaviors are subconsciously driven by the current screen settings, not
%by the previous settings. Next,  we quantify if the non-Markovian property
%holds. Towards this goal,  we take $s_b$ as an example, and we compare a user's
%strokes collected in the setting $s_b$ (i.e., strokes collected in the Task 2 or
%Task 5)  with those collected after transiting from $s_a$ to $s_b$ (i.e.,
%strokes collected in the setting $s_b$ in the Task 3 or Task 6).
%
%For a user $u$,  we split its strokes in Task 2 or Task 5 into 5 folds. We
%randomly sample 4 folds as positive examples, and the user $u$'s touch strokes
%in the setting $s_a$ and other users' strokes in both settings as negative
%examples to train a classifier C-ATCA-b. Then this classifier is used to
%calculate the FRR of the fifth fold of strokes and the FRR of the strokes
%collected in the setting $s_b$ in the Task 3 or Task 6. We then use a
%\emph{binomial test}~\cite{binomialTest} to measure if the two FRRs are
%statistically equivalent. A binomial test takes two  binary  vectors as input and
%outputs a \emph{p-value}. The two binary vectors are said to be generated from
%the same underlying distribution (i.e., the non-Markovian property holds) at a
%\emph{significance level} $\alpha$ if the p-value is larger than $\alpha$. In
%practice, the significance level is often set to be 5\%.  
%
%We find that the non-Markovian property holds for 100\% of the subjects and 11
%out of the 12 subjects (i.e., 92\% of the subjects) for horizontal strokes and
%vertical strokes, respectively. The reason that one user fails the binomial test
%is because he/she has too few touch strokes in Task 6. 

\subsection{Summary}
Our observations can be summarized as follows:
\begin{packeditemize}
\item Users can subconsciously adapt their behavior to different screen settings, 
i.e., transitions between settings do  not affect user experiences.
\item Our authentication mechanism achieves 
much smaller EERs than previous work for both random attacks and targeted attacks.  
\item Our authentication system achieves smaller EERs with more screen settings.  
\item Learning our classifiers is fast, i.e., strokes collected within two minutes are enough to stabilize  EERs.
%\item A user's touch behavior has a non-Markovian property. Specifically, a user's touch 
%behavior only depends on the current setting, not on the previous setting used by the authentication system. 
\end{packeditemize}







%\input{discussion}
\section{Discussion}
\label{discussion}
\myparatight{Training human attackers} To mimic the targeted user's touch
behavior, a human attacker needs to be trained to produce touch strokes whose
features are close to those of the targeted user. We note that Meng et
al.~\cite{tey2013can} proposed an interactive system to train a human attacker
to reproduce  \emph{keystroke dynamics} of the targeted user for a \emph{given
short password}. Specifically, they consider  features of keystroke dynamics are
constructed from 2-grams, and thus changing the keystroke timing of a character
only influences features of the local two 2-grams. For instance, suppose we have
a password with three characters ABC, changing the keystroke timing of B only
influences the features of AB and BC. Thus,  it is possible to train a human
attacker to reproduce the keystroke dynamics of a given short password via
greedily changing the keystroke timings of characters one by one. 

However,  reproducing touch strokes could be much harder than reproducing
keystroke dynamics. This is because 1) we have around 30 touch features, 2)
changing one touch point could result in changes of a few features, and 3) the
human attacker needs to learn how the targeted user would adapt to different
screen settings. Nevertheless, it is an interesting future work to explore the
possibility/impossibility of training human attackers to mimic a targeted user.

\myparatight{Fixing one screen setting to perform targeted attacks} A robot can
keep replaying touch data collected in a fixed screen setting to attack our
authentication system. The expected number of tries until the robot is using the
correct screen setting would then be  the total number of
screen settings. Once the robot gets the correct setting, the robot can use the
mobile device for a time interval during which the setting is unchanged. 

However, this attack can be blocked with a high probability by combing our
touch-based authentication with PINs. Specifically, once we detect suspicious
touch data, we ask the user to type in the backup PIN. 
%In such a multi-factor scheme, the attacker can be blocked with a high
%probability. 

\myparatight{Detecting screen settings with specialized intelligent robots} An
intelligent robot that is equipped with specialized sensors could potentially
detect the screen settings using some Artificial Intelligence (AI) algorithms,
and detecting the screen settings could enable the attacker (e.g., a friend or
spouse of the targeted user) to perform better targeted attacks.  For instance,
a robot with a camera could possibly detect the screen settings by using
computer vision algorithms to compare its raw touch data (collected via the
camera) on the screen and the movements (again, collected via the camera) of the
running application. However, the robot still needs to generate a few touch
strokes (these strokes may be from a screen setting that is different from the
one used by our authentication system) before the screen setting is detected,
during which our authentication scheme might already successfully reject the
attacker. Moreover,  it might not be easy for the attacker to get such a
specialized robot, which is true at least for now, given the current state of
AI. Therefore, we focus on robots that are commercialized and easy to get.  


\myparatight{Leveraging sloppiness and jitter} Screen settings could also adjust
sloppiness and jitter other than the distortions along the X axis and the Y axis
studied in this paper.  Sloppiness controls how far the user has to move the
finger on the screen to send a movement to the applications and jitter controls
what distortions from a straight line on the screen are still considered as a
movement by the applications. It is an interesting future work to explore the
impact of sloppiness and jitter on the performance of defending against forgery
attacks in our authentication system.



%\input{conclusion}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Conclusion and Future Work}\label{sec:conclusion}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


In this work, we design a new touch-based continuous authentication system
 to defend against forgery attacks by leveraging the impact of screen 
settings on a user's touch behaviors.  First, we find that, when screen settings are discretized properly, a user's
touch behaviors in two different settings are both \emph{stable} and
\emph{sensitive}.  Second, based on these findings, we design a new authentication system called
\emph{adaptive touch-based continuous authentication}. The key idea is to randomly sample a predefined screen setting  in each time interval. The attacker cannot know the screen setting at the time of attacks. 
%Our authentication
%system selects multiple settings in which a user's touch behaviors are both stable and sensitive
%and trains a classifier for each setting during a registration phase.  In the
%authentication phase, we randomly sample a predefined setting and use the corresponding
%classifier to continuously authenticate the user in each time interval.
%Our authentication system can significantly decrease the success rates of  
%an attacker that even has full knowledge of the targeted user's touch strokes in \emph{all}
%settings, because the attacker cannot know which setting
%is currently used by our authentication system at the time of attack.
Third, we evaluate our system by collecting
data from 25 subjects in five screen settings. We find that  users can subconsciously 
adapt their touch behavior to different screen settings, 
i.e., transitions between settings do not interrupt users nor affect user experiences. 
 Moreover, we observe that our system
significantly outperforms previous work at defending against both random forgery
attacks and targeted forgery attacks, the registration phase of our system takes a short
period of time,  and our system can better defend  against forgery attacks with more 
screen settings.

Future work includes performing a large-scale study about our authentication system in the wild, investigating more types of screen settings,  and 
exploring more advanced attacks to touch-based authentication systems.

\balance
{
\bibliographystyle{abbrv}
%\bibliographystyle{acm}
%\bibliography{refs}
\begin{thebibliography}{10}

\bibitem{AttackingAndroidFaceAuthentication}
{Attacking Android Face Authentication}.
\newblock \url{https://www.youtube.com/watch?v=BwfYSR7HttA}.

\bibitem{AttackingAndroidFaceAuthenticationLiveness}
{Attacking Android Liveness Check}.
\newblock \url{https://www.youtube.com/watch?v=zYxphDK6s3I}.

\bibitem{Bee}
{Bee}.
\newblock \url{http://www.usvigilant.com/bee/}.

\bibitem{bo2013silentsense}
C.~Bo, L.~Zhang, X.-Y. Li, Q.~Huang, and Y.~Wang.
\newblock Silentsense: silent user identification via touch and movement
  behavioral biometrics.
\newblock In {\em MobiCom}, 2013.

\bibitem{NolockSOUPS13}
D.~V. Bruggen, S.~Liu, M.~Kajzer, A.~Striegel, C.~R. Crowell, and J.~D'Arcy.
\newblock Modifying smartphone user locking behavior.
\newblock In {\em SOUPS}, 2013.

\bibitem{chang2011libsvm}
C.-C. Chang and C.-J. Lin.
\newblock Libsvm: a library for support vector machines.
\newblock {\em ACM TIST}, 2(3), 2011.

\bibitem{svm2}
C.~Cortes and V.~Vapnik.
\newblock Support-vector networks.
\newblock In {\em Machine Learning}, volume~20, pages 273--297, 1995.

\bibitem{CSDN}
{CSDN passwork leak}.
\newblock \url{goo.gl/hn0Cr6}.

\bibitem{munichGuys}
A.~De~Luca, A.~Hang, F.~Brudy, C.~Lindner, and H.~Hussmann.
\newblock Touch me once and i know it's you!: Implicit authentication based on
  touch screen patterns.
\newblock In {\em CHI}, 2012.

\bibitem{whylockCCS14}
S.~Egelman, S.~Jain, R.~S. Portnoff, K.~Liao, S.~Consolvo, and D.~Wagner.
\newblock Are you ready to lock? understanding user motivations for smartphone
  locking behaviors.
\newblock In {\em CCS}, 2014.

\bibitem{fingerprintForgeryAttack}
{Fogery Attacks to Fingerprint}.
\newblock \url{http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid}.

\bibitem{frank2013touchalytics}
M.~Frank, R.~Biedert, E.~Ma, I.~Martinovic, and D.~Song.
\newblock Touchalytics: On the applicability of touchscreen input as a
  behavioral biometric for continuous authentication.
\newblock {\em IEEE Transactions on Information Forensics and Security},
  8(1):136--148, 2013.

\bibitem{li2013unobservable}
L.~Li, X.~Zhao, and G.~Xue.
\newblock Unobservable reauthentication for smart phones.
\newblock In {\em NDSS}, 2013.

\bibitem{Nest}
{Nest Thermostat}.
\newblock \url{https://nest.com/}.

\bibitem{rockyou}
{Rockyou password leak}.
\newblock \url{goo.gl/hGwU5k}.

\bibitem{Sae-Bae:2012:BGN:2207676.2208543}
N.~Sae-Bae, K.~Ahmed, K.~Isbister, and N.~Memon.
\newblock Biometric-rich gestures: a novel approach to authentication on
  multi-touch devices.
\newblock In {\em CHI}, 2012.

\bibitem{sae2012investigating}
N.~Sae-Bae, N.~Memon, and K.~Isbister.
\newblock Investigating multi-touch gestures as a novel biometric modality.
\newblock In {\em IEEE BTAS}, 2012.

\bibitem{sae2014multitouch}
N.~Sae-Bae, N.~Memon, K.~Isbister, and K.~Ahmed.
\newblock Multitouch gesture-based authentication.
\newblock {\em IEEE transactions on information forensics and security},
  9(3-4):568--582, 2014.

\bibitem{attack-CCS13}
A.~Serwadda and V.~V. Phoha.
\newblock When kids' toys breach mobile phone security.
\newblock In {\em CCS}, 2013.

\bibitem{sherman2014user}
M.~Sherman, G.~Clark, Y.~Yang, S.~Sugrim, A.~Modig, J.~Lindqvist,
  A.~Oulasvirta, and T.~Roos.
\newblock User-generated free-form gestures for authentication: security and
  memorability.
\newblock In {\em MobiSys}, 2014.

\bibitem{sophos}
{Sophos Naked Security blog}.
\newblock Survey says 70\% don't password-protect mobiles: download free
  {M}obile {T}oolkit.
\newblock
  \url{http://nakedsecurity.sophos.com/2011/08/09/free-sophos-mobile-security-toolkit/}.
\newblock Published Aug 9, 2011.

\bibitem{tey2013can}
C.~M. Tey, P.~Gupta, and D.~Gao.
\newblock I can be you: Questioning the use of keystroke dynamics as
  biometrics.
\newblock In {\em NDSS}, 2013.

\bibitem{smartphoneMorethanPC}
{The Smartphone Market is Bigger Than the PC Market}.
\newblock
  \url{http://www.businessinsider.com/smartphone-bigger-than-pc-market-2011-2}.

\bibitem{Xu2014soups}
H.~Xu, Y.~Zhou, and M.~R. Lyu.
\newblock Towards continuous and passive authentication via touch biometrics:
  An experimental study on smartphones.
\newblock In {\em SOUPS}, 2014.

\end{thebibliography}

}

%\input{appendix}


\end{document}


1506.02294.extracted_bib
{AttackingAndroidFaceAuthentication {Attacking Android Face Authentication. \newblock \url{https://www.youtube.com/watch?v=BwfYSR7HttA.
1506.02294.extracted_bib
{AttackingAndroidFaceAuthenticationLiveness {Attacking Android Liveness Check. \newblock \url{https://www.youtube.com/watch?v=zYxphDK6s3I.
1506.02294.extracted_bib
{Bee {Bee. \newblock \url{http://www.usvigilant.com/bee/.
1506.02294.extracted_bib
{bo2013silentsense C.~Bo, L.~Zhang, X.-Y. Li, Q.~Huang, and Y.~Wang. \newblock Silentsense: silent user identification via touch and movement behavioral biometrics. \newblock In {\em MobiCom, 2013.
1506.02294.extracted_bib
{NolockSOUPS13 D.~V. Bruggen, S.~Liu, M.~Kajzer, A.~Striegel, C.~R. Crowell, and J.~D'Arcy. \newblock Modifying smartphone user locking behavior. \newblock In {\em SOUPS, 2013.
1506.02294.extracted_bib
{chang2011libsvm C.-C. Chang and C.-J. Lin. \newblock Libsvm: a library for support vector machines. \newblock {\em ACM TIST, 2(3), 2011.
1506.02294.extracted_bib
{svm2 C.~Cortes and V.~Vapnik. \newblock Support-vector networks. \newblock In {\em Machine Learning, volume~20, pages 273--297, 1995.
1506.02294.extracted_bib
{CSDN {CSDN passwork leak. \newblock \url{goo.gl/hn0Cr6.
1506.02294.extracted_bib
{munichGuys A.~De~Luca, A.~Hang, F.~Brudy, C.~Lindner, and H.~Hussmann. \newblock Touch me once and i know it's you!: Implicit authentication based on touch screen patterns. \newblock In {\em CHI, 2012.
1506.02294.extracted_bib
{whylockCCS14 S.~Egelman, S.~Jain, R.~S. Portnoff, K.~Liao, S.~Consolvo, and D.~Wagner. \newblock Are you ready to lock? understanding user motivations for smartphone locking behaviors. \newblock In {\em CCS, 2014.
1506.02294.extracted_bib
{fingerprintForgeryAttack {Fogery Attacks to Fingerprint. \newblock \url{http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid.
1506.02294.extracted_bib
{frank2013touchalytics M.~Frank, R.~Biedert, E.~Ma, I.~Martinovic, and D.~Song. \newblock Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication. \newblock {\em IEEE Transactions on Information Forensics and Security, 8(1):136--148, 2013.
1506.02294.extracted_bib
{li2013unobservable L.~Li, X.~Zhao, and G.~Xue. \newblock Unobservable reauthentication for smart phones. \newblock In {\em NDSS, 2013.
1506.02294.extracted_bib
{Nest {Nest Thermostat. \newblock \url{https://nest.com/.
1506.02294.extracted_bib
{rockyou {Rockyou password leak. \newblock \url{goo.gl/hGwU5k.
1506.02294.extracted_bib
{Sae-Bae:2012:BGN:2207676.2208543 N.~Sae-Bae, K.~Ahmed, K.~Isbister, and N.~Memon. \newblock Biometric-rich gestures: a novel approach to authentication on multi-touch devices. \newblock In {\em CHI, 2012.
1506.02294.extracted_bib
{sae2012investigating N.~Sae-Bae, N.~Memon, and K.~Isbister. \newblock Investigating multi-touch gestures as a novel biometric modality. \newblock In {\em IEEE BTAS, 2012.
1506.02294.extracted_bib
{sae2014multitouch N.~Sae-Bae, N.~Memon, K.~Isbister, and K.~Ahmed. \newblock Multitouch gesture-based authentication. \newblock {\em IEEE transactions on information forensics and security, 9(3-4):568--582, 2014.
1506.02294.extracted_bib
{attack-CCS13 A.~Serwadda and V.~V. Phoha. \newblock When kids' toys breach mobile phone security. \newblock In {\em CCS, 2013.
1506.02294.extracted_bib
{sherman2014user M.~Sherman, G.~Clark, Y.~Yang, S.~Sugrim, A.~Modig, J.~Lindqvist, A.~Oulasvirta, and T.~Roos. \newblock User-generated free-form gestures for authentication: security and memorability. \newblock In {\em MobiSys, 2014.
1506.02294.extracted_bib
{sophos {Sophos Naked Security blog. \newblock Survey says 70\% don't password-protect mobiles: download free {Mobile {Toolkit. \newblock \url{http://nakedsecurity.sophos.com/2011/08/09/free-sophos-mobile-security-toolkit/. \newblock Published Aug 9, 2011.
1506.02294.extracted_bib
{tey2013can C.~M. Tey, P.~Gupta, and D.~Gao. \newblock I can be you: Questioning the use of keystroke dynamics as biometrics. \newblock In {\em NDSS, 2013.
1506.02294.extracted_bib
{smartphoneMorethanPC {The Smartphone Market is Bigger Than the PC Market. \newblock \url{http://www.businessinsider.com/smartphone-bigger-than-pc-market-2011-2.
1506.02294.extracted_bib
{Xu2014soups H.~Xu, Y.~Zhou, and M.~R. Lyu. \newblock Towards continuous and passive authentication via touch biometrics: An experimental study on smartphones. \newblock In {\em SOUPS, 2014.