We investigate whether a mobile application can continuously and unobtrusively authenticate and identify its users based on only their interactions with the User Interface of the application. A unique advantage that this modality provides over currently explored implicit modalities on mobile devices is that every user who uses the mobile application is automatically enrolled into the classification system. Every user must interact with the User Interface of an application in order to use it and therefore this modality is always guaranteed to have sufficient number of inputs for training and testing purposes. Using different types of input controls available on the Android platform, we collected interactions from 42 users in five different sessions. We created base classifiers from each type of input control and combine them into an ensemble classifier in order to authenticate and identify users. We find a Support Vector Machine based ensemble classifier achieves a mean equal error rate of 5% in case of authentication and a mean accuracy of 90% in case of identification. We find Support Vector Machine based ensemble classifiers outperform other techniques in both cases. While the ensemble classifier performance for authentication and identification is not found to be sufficient for it to replace current primary authentication mechanisms used in mobile applications, its truly continuous nature provides motivation for it to be used in combination with primary mechanisms.
Read
