Behavioural Biometrics for Authentication

该研究项目旨在调查在认证场景中使用各种行为生物识别技术的可行性。这一领域的研究重点是在人类活动中建立独特的识别模式，如击键、鼠标和触摸屏动力学，以及声音、步态和认知行为。这通常是一种非侵入性的身份验证方法，因为它不需要用户学习如何操作特定的系统或记住唯一的密码和短语。此外，身份验证不需要任何活动步骤，而是与系统的常规操作无缝集成。通常，基于行为生物识别技术的身份验证系统可以与其他更传统的网络安全措施结合使用，作为多因素保护。尽管这是一个研究领域，目前有一些明显成功的项目，但很少有成功的商业系统采用该技术。这项研究的目标是设计、开发和测试基于行为生物识别技术的新型身份验证系统，并缩小有希望的研究和实际应用之间的差距。例如，开发基于手机使用模式（如触摸屏手势和陀螺仪在空间中的微运动）的连续认证模型。该项目的另一个方面侧重于确定该领域过去研究中的问题，以及它往往不适合实际应用的一些原因。例如，在一些研究中报告的样本量可能不够大，无法准确代表使用这种系统的人口。最后，由于使用基于行为生物识别技术的高度精确的身份验证系统，存在独特的隐私挑战。恶意利用该技术的一种方法是为用户创建唯一的指纹，然后可以利用该指纹在多个非连接系统中跟踪用户的行为和身份。它还可能通过用户的行为模式揭示用户的个人信息。性别、年龄和文化群体可以发挥特定的特征，这些特征可能会被上述技术检测到。该项目属于ESPRC网络安全研究领域。

The research project aims at investigating the feasibility of using various behavioral biometrics in authentication scenarios. This field of study focuses on establishing uniquely identifying patterns in human activity such as keystroke, mouse and touchscreen dynamics as well as voice, gait and cognitive behaviour. This is typically a non-invasive method for authentication as it does not require users to learn how to operate a particular system or remember unique passcodes and phrases. Furthermore, there are no active steps required for authentication but rather it is a seamless integration with the regular operation of the system. Often authentication systems based on behavioural biometrics can be used as a multifactor safeguard in conjunction with other more traditional cybersecurity measures. Despite being a somewhat well research area with some apparently successful projects currently there are few successful commercial systems employing the technology. The goal of the research is to design, develop and test novel systems for authentication based on behavioural biometrics and close the gap between promising research and practical applications. For instance, developing a continuous authentication model based on phone usage patterns such as touchscreen gestures and gyroscope micro movements in space. Another aspect of the project focuses on identifying problems in past research in the area and some of the reasons it tends to be unsuitable for practical use. For example, the reported sample sizes in some of the studies might not be large enough to accurately represent the population using such systems. Finally, there are unique privacy challenges stemming from the use of highly accurate authentication systems based on behavioural biometrics. One way to maliciously employ this technology is to create unique fingerprints for users which can then be exploited for tracking behaviour and identity throughout multiple non-connected systems. It also might be possible to reveal personal information about users through their behaviour patterns. Gender, age and cultural groups could exert specific traits which might be detectable by the technology described above. This project falls within the ESPRC Cybersecurity research area.