ISA 419: Data-Driven Security

class: center, middle, inverse, title-slide

.title[
# ISA 419: Data-Driven Security
]
.subtitle[
## 19: Authentication Using Behavioral Biometrics
]
.author[
### <br>Fadel M. Megahed, PhD <br><br> Professor <br> Farmer School of Business<br> Miami University<br><br> <a href="https://twitter.com/FadelMegahed"><svg viewBox="0 0 512 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253z" /></svg> <span class="citation">@FadelMegahed</span></a> <br> <a href="https://github.com/fmegahed/"><svg viewBox="0 0 496 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6zm-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3zm44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9zM244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8zM97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1zm-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7zm32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1zm-11.4-14.7c-1.6 1-1.6 3.6 0 5.9 1.6 2.3 4.3 3.3 5.6 2.3 1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2z" /></svg> fmegahed</a> <br> <a href="mailto:fmegahed@miamioh.edu"><svg viewBox="0 0 512 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M476 3.2L12.5 270.6c-18.1 10.4-15.8 35.6 2.2 43.2L121 358.4l287.3-253.2c5.5-4.9 13.3 2.6 8.6 8.3L176 407v80.5c0 23.6 28.5 32.9 42.5 15.8L282 426l124.6 52.2c14.2 6 30.4-2.9 33-18.2l72-432C515 7.8 493.3-6.8 476 3.2z" /></svg> fmegahed@miamioh.edu</a><br> <a href="https://calendly.com/fmegahed"><svg viewBox="0 0 384 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M202.021 0C122.202 0 70.503 32.703 29.914 91.026c-7.363 10.58-5.093 25.086 5.178 32.874l43.138 32.709c10.373 7.865 25.132 6.026 33.253-4.148 25.049-31.381 43.63-49.449 82.757-49.449 30.764 0 68.816 19.799 68.816 49.631 0 22.552-18.617 34.134-48.993 51.164-35.423 19.86-82.299 44.576-82.299 106.405V320c0 13.255 10.745 24 24 24h72.471c13.255 0 24-10.745 24-24v-5.773c0-42.86 125.268-44.645 125.268-160.627C377.504 66.256 286.902 0 202.021 0zM192 373.459c-38.196 0-69.271 31.075-69.271 69.271 0 38.195 31.075 69.27 69.271 69.27s69.271-31.075 69.271-69.271-31.075-69.27-69.271-69.27z" /></svg> Automated Scheduler for Office Hours</a><br><br>
]
.date[
### Spring 2025
]

---

## Learning Objectives for Today's Class

- Motivating the use of behavioral biometrics for authentication purposes

- Explain possible sources of data and application for behavioral biometrics

- Model behavioral biometrics data using machine learning techniques

---

class: inverse, center, middle

# Motivating the Use of Behavioral Biometrics for Authentication Purposes

---

## Authentication

- **Authentication** is the process of verifying the identity of a user or system.

.center[.bold[How do you prove to someone that you are who you claim to be?]]

---

## Information Traditionally Used for Authentication

.bold[.center[User authentication is the most common and best studied human security
task.]]

**Something you know** Passwords, PINs, security questions

**Something you have:** Smart cards, tokens, mobile phones

**Something you are:** Biometrics (fingerprint, face, iris, etc.)

---

## Lifecycle for Authentication Information

**Issuance:** User enrolls in the system and provides authentication information

**Usage:** User logs in and provides authentication information

**Maintenance/Revocation:** User's authentication information is revised or retired

---

## Lifecycle: Something You Know

.font90[
**Issuance:**  
  - User "has" to memorize a new password or (unfortunately) reuse an existing one.  
  - Should follow password guidelines (length, complexity, uniqueness)  
  - Needs to be sufficiently secure and memorable
  
**Usage:**
  - Can I remember my password?  
  - If so, which one is it (out of the many I have or the updates I have made)?

**Maintenance:**  
  - Subject to loss/expiration   
  - Re-issuance may require secondary mechanism    
  - Rules on freshness/variation for re-issued data

]

---

## Lifecycle: Something You Have

**Issuance:**  
  - User "has" to carry a new token or smart card.  
  - Should be kept secure and not shared with others.  
  - Needs to be sufficiently secure and portable.
  
**Usage:**  
  - Requirements on human memory: Where did I leave my card? Which card is it?  
  - Requirements on physical presence: Do I have it with me?  
  
**Maintenance:**
  - Subject to loss/theft   
  - Requires periodic replacements

---

## Lifecycle: Something You Are

**Issuance:**  
  - “Reverse issuance” required to submit biometrics  
  - Accessibility: not all humans have readable fingerprints, irises, etc.  
  
**Usage:**  
  - Minimal requirements placed upon human memory, e.g., “Which finger did I use?”, though may be specified at authentication  
  - Human-machine interface issues, e.g., what to do with a cut finger?
  
**Maintenance:**  
  - May possibly change with aging, injury, etc.  
  - In general, there are limited options for renewal due to finite set of biometrics. 
  
  
---

## Lifecycle: General Guidelines

- **Issuance:**  
  - Limit amount of physical interaction  
  - Limit human processing and learning requirements  
  - Limit number of seemingly artificial constraints

- **Usage:**
  - Limit human memory requirements  
  - Limit requirements for perfect accuracy

- **Maintenance:**
  - See Issuance guidelines  
  - Limit excessive update requirements

---

## Password Lifecycle

---

## The "Traditional" Approach to Replacing Passwords <svg aria-hidden="true" role="img" viewBox="0 0 512 512" style="height:1em;width:1em;vertical-align:-0.125em;margin-left:auto;margin-right:auto;font-size:inherit;fill:#C3142D;overflow:visible;position:relative;"><path d="M256 48a208 208 0 1 1 0 416 208 208 0 1 1 0-416zm0 464A256 256 0 1 0 256 0a256 256 0 1 0 0 512zM175 175c-9.4 9.4-9.4 24.6 0 33.9l47 47-47 47c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l47-47 47 47c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-47-47 47-47c9.4-9.4 9.4-24.6 0-33.9s-24.6-9.4-33.9 0l-47 47-47-47c-9.4-9.4-24.6-9.4-33.9 0z"/></svg>

---

---
class: inverse, center, middle

# Behavioral Biometrics for Authentication

---

## The Keystroke Dynamics - Benchmark Data Set

Based on [Killourhy and Maxion (2009)](https://www.cs.cmu.edu/~keystroke/), the authors set up their experiment as follows:

- **Password:** .tie5Roanl  
  - **Feature sets:** 
    + The **Enter** key was considered to be a part of their password  
    + **Keydown-Keydown:** time between the key presses of consecutive keys is used as a feature;  
    + **Keyup-Keydown:** time between the release of one key and the press of the next is used;  
    + **Hold:** time between the press and release of each key is used  
  - Note that their features are linearly dependent; for example, `\(Keydown.Keydown = Hold + Keyup − Keydown\)`.  
  - Additionally, their features are all recorded in seconds.

---

## Choice of Features

---

## Subject `\(\times\)` Sessions

---

## Non-Graded Class Activity

- Use the following [link](https://www.cs.cmu.edu/~keystroke/) to access the data set.

- Download the data set and explore the features.

- In plain English, define three different approaches for modeling this dataset and write them below.

.font80[
.can-edit.key-activity15[
- Edit me to answer the question above.

- Edit me to answer the question above.

- Edit me to answer the question above.
]
]

---

## In-Class Demo

Starting with the following code, let us create a model to predict whether a user is `s002` or not.

``` python
# !pip install pycaret
import pandas as pd
from pycaret.classification import *

df = pd.read_csv("https://www.cs.cmu.edu/~keystroke/DSL-StrongPasswordData.csv")

sub2 = df[df['subject'] == 's002']
sub2 = sub2.drop(columns = ['sessionIndex', 'rep'])
```

---
class: inverse, center, middle

# Recap

---

## Summary of Main Points

By now, you should be able to do the following:

- Motivating the use of behavioral biometrics for authentication purposes

- Explain possible sources of data and application for behavioral biometrics

- Model behavioral biometrics data using machine learning techniques

---

## 📝 Review and Clarification 📝

1. **Class Notes**: Take some time to revisit your class notes for key insights and concepts.
2. **Zoom Recording**: The recording of today's class will be made available on Canvas approximately 3-4 hours after the end of class.
3. **Questions**: Please don't hesitate to ask for clarification on any topics discussed in class. It's crucial not to let questions accumulate.