臺灣博碩士論文加值系統

智慧型手機的出現使得手機不再只是單純的個人通信設備，伴隨著其功能越來越強大，手機能儲存的信息也越來越多，如照片、影像、檔案、個人資料...... 等等，尤其在近幾年移動銀行的盛行，使得移動裝置的安全問題更加至關重要，因此在手機上設計可靠且安全的用戶身分認證已成為保護用戶私人信息和數據的一項重要任務。然而傳統常見的身分驗證方法 (例如密碼、PIN、圖形解鎖) 無法提供足夠的安全性，在被偷窺或猜中的情況下，入侵者可以完全的搶占手機。即使出現了生物識別認證 (Fingerprint, Face Recognition, Voice Recognition)，移動設備的安全性也沒有得到明顯改善，因為用戶可以在生物識別或密碼之間選擇其一做為登入方式，所以漏洞依然存在。在動態鍵入認證的幫助下，上述問題有了解決的方法，在使用密碼或 PIN 碼認證的同時，還需要通過輸入風格來確認身份，這就為傳統的認證方式增加了很大的安全性。
在本論文中，我們主要關注少樣本的訓練數據是否還能有效區分合法使用者和入侵者，同時提出了一種動態更新模型的方法，使模型能夠不斷學習用戶新的擊鍵習慣，以提高準確性。我們在兩個公共數據集上分別實現了 4.2% 和 2.8% 的 FRR。

With the advent of smartphones, mobile phones are no longer just simple personal communication devices. With more and more powerful functions, mobile phones can store more and more information. Such as photos, images, files, private data, etc. Especially in recent years, the popularity of mobile banking has made the security of mobile devices even more important. Therefore, designing reliable and safe user authentication on mobile phones has become an important task to protect users’ private information and data. However, traditional common identity verification methods (PIN and password) cannot provide sufficient security. In the case of being peeped or guessed, an intruder can completely access the user’s data. Even with the advent of biometrics authentication (Fingerprint, Face Recognition, Voice Recognition), the security of mobile devices has not been significantly improved, because users can choose between biometrics or passwords to log into the devices. So the vulnerability remains. With the help of keystroke dynamic authentication, there is a solution to the above problem, which requires the identity to be confirmed by typing style while authenticating with password or PIN, which adds great security to the traditional authentication method.
In the thesis, we mainly focus on whether a small amount of training data can still be effectively distinguished between legitimate and impostor, and also propose a dynamic update model method so that the model can continue to learn the user’s new keystroke habits to improve accuracy. We achieved the FRR of 4.2% and 2.8% on two public datasets.

Contents
1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.1 Statistical Features Selection . . . . . . . . . . . . . . . . . . . . . . . 7 3.1.1 Raw Features . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.1.2 Common features . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.1.3 Novel features . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2 One-Class Classification . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.2.1 Isolation Forest . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2.2 One-class SVM . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.3 Scikit-learn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4 Datasets and Feature engineering . . . . . . . . . . . . . . . . . . . . 15
4.1 Dataset1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.1.1 Data collection . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.1.2 Feature extraction . . . . . . . . . . . . . . . . . . . . . . . . 17
4.2 Dataset2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 4.2.1 Data collection . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.2.2 Feature extraction . . . . . . . . . . . . . . . . . . . . . . . . 20
5 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 5.1 Data augmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 5.1.1 Gaussian noise . . . . . . . . . . . . . . . . . . . . . . . . . . 22 5.2 Overall architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
5.3 Model used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 5.3.1 One-class SVM(SVDD) . . . . . . . . . . . . . . . . . . . . . 25
5.3.2 Isolation forest . . . . . . . . . . . . . . . . . . . . . . . . . . 27
6 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
6.1 Evaluation metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
6.2 Performance analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 6.2.1 Classifier analysis . . . . . . . . . . . . . . . . . . . . . . . . . 29
6.2.2 Noise analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.2.3 Result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

[1] Hoang Minh Thang et al. “Gait identification using accelerometer on mobile phone”. In: 2012 International Conference on Control, Automation and Information Sciences (ICCAIS). IEEE. 2012, pp. 344–348 (cit. on p. 2).
[2] John T Wixted. “The psychology and neuroscience of forgetting”. In: Annu. Rev. Psychol. 55 (2004), pp. 235–269 (cit. on p. 2).
[3] Roger N Shepard. “Recognition memory for words, sentences, and pictures”. In: Journal of verbal Learning and verbal Behavior 6.1 (1967), pp. 156–163 (cit. on p. 2).
[4] Alan S Brown et al. “Generating and remembering passwords”. In: Applied Cognitive Psychology: The Official Journal of the Society for Applied Research in Memory and Cognition 18.6 (2004), pp. 641–651 (cit. on p. 2).
[5] Kevin Doel. “Password”unseated by “123456”on SplashData’s annual “Worst Passwords”list”. In: Pridobljeno (3.4. 2014) iz SplashData News: http://splashdata. com/press/worstpasswords2013. htm (2013) (cit. on p. 2).
[6] Salil P Banerjee and Damon L Woodard. “Biometric authentication and identification using keystroke dynamics: A survey”. In: Journal of Pattern Recognition Research 7.1 (2012), pp. 116–139 (cit. on p. 2).
[7] Nathan L Clarke and Steven M Furnell. “Authenticating mobile phone users using keystroke analysis”. In: International journal of information security 6.1 (2007), pp. 1–14 (cit. on p. 4).
[8] M Karnan and N Krishnaraj. “A model to secure mobile devices using keystroke dynamics through soft computing techniques”. In: International Journal of Soft Computing and Engineering (IJSCE) ISSN (2012), pp. 2231–2307 (cit.on p. 4).
[9] Patrick Bours and Elnaz Masoudian. “Applying keystroke dynamics on onetime pin codes”. In: 2nd International Workshop on Biometrics and Forensics. IEEE. 2014, pp. 1–6 (cit. on p. 5).
[10] Emanuele Maiorana et al. “Keystroke dynamics authentication for mobile phones”. In: Proceedings of the 2011 ACM Symposium on Applied Computing. 2011, pp. 21–26 (cit. on p. 5).
[11] Hataichanok Saevanee and P Bhattarakosol. “Authenticating user using keystroke dynamics and finger pressure”. In: 2009 6th IEEE Consumer Communications and Networking Conference. IEEE. 2009, pp. 1–2 (cit. on p. 5).
[12] Matthias Trojahn and Frank Ortmeier. “Toward mobile authentication with keystroke dynamics on mobile phones and tablets”. In: 2013 27th International Conference on Advanced Information Networking and Applications Workshops. IEEE. 2013, pp. 697–702 (cit. on p. 5).
[13] Margit Antal and Lehel Nemes. “The mobikey keystroke dynamics password database: Benchmark results”. In: Computer Science On-line Conference. Springer. 2016, pp. 35–46 (cit. on p. 8).
[14] Noor Mahmood Al-Obaidi and Mudhafar M Al-Jarrah. “Statistical keystroke dynamics system on mobile devices for experimental data collection and user authentication”. In: 2016 9th International Conference on Developments in eSystems Engineering (DeSE). IEEE. 2016, pp. 123–129 (cit. on p. 8).
[15] M. M. Al-Jarrah, G. M. Khalaf, and S. Amin. “PIN Authentication Using Multi-Model Anomaly Detection in Keystroke Dynamics”. In: 2019 2nd International Conference on Signal Processing and Information Security (ICSPIS). 2019, pp. 1–4 (cit. on p. 8).
[16] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. “Isolation forest”. In: 2008 Eighth IEEE International Conference on Data Mining. IEEE. 2008, pp. 413–422 (cit. on p. 9).
[17] David MJ Tax and Robert PW Duin. “Support vector data description”. In: Machine learning 54.1 (2004), pp. 45–66 (cit. on p. 12).
[18] M. Antal and L. Z. Szabó. “An Evaluation of One-Class and Two-Class Classification Algorithms for Keystroke Dynamics Authentication on Mobile Devices”. In: 2015 20th International Conference on Control Systems and Computer Science. 2015, pp. 343–350 (cit. on p. 15).
[19] Cheng-Jung Tasia et al. “Two novel biometric features in keystroke dynamics authentication systems for touch screen devices”. In: Security and Communication Networks 7.4 (2014), pp. 750–758 (cit. on p. 19).