Analysing Shoulder Surfing Attacks on Biometrics Continuous Authentication

AI方法--如今，肩部冲浪攻击非常常见。有时这些攻击是无意的，没有任何对手意图窃取任何敏感信息。然而，无论有没有恶意获取任何敏感数据，它们都是致命的。对这些攻击进行了研究，并提出了相关建议，以提供强有力的对策。然而，随着智能设备使用的增加，肩部冲浪攻击正成为一个具有挑战性的安全问题。本项目旨在解决这一问题，并结合快速发展的AI/ML技术来研究和提出一个有效和安全的生物特征连续认证框架，该框架可以在智能设备上实现，以保护用户的敏感信息免受这些攻击。本研究将使用机器学习和基于人工智能的算法，如KNN、K-Means和随机森林算法，对现有的基于生物特征的连续认证方案进行详细的安全和隐私分析。安全风险分析采用多准则决策分析(MCDA)系统进行。在风险分析的基础上，提出并实现了一种防盗用和保护隐私的生物特征连续认证框架，用于对抗肩部冲浪攻击和其他相关的安全攻击。BAN或SVO逻辑分析将用于提供逻辑安全分析，框架将使用Scyther或Tamarin Prover实现，以提供自动化安全分析。

AI Approach - These days, shoulder surfing attacks are very common. Sometimes these attacks are unintentional and without any adverseintention to steal any sensitive information. Yet, they are lethal with or without any ill intentions to obtain any sensitive data. Thereare studies in which these attacks are addressed and relevant proposals are present to provide robust countermeasures. However,with the increase use of smart devices, shoulder surfing attacks are becoming a challenging security concern. This project is toaddress this issue and to integrate the fast growing AI/ML techniques to examine and propose an effective and secure biometriccontinuous authentication framework that can be implemented on smart devices to protect the user sensitive information fromthese attacks. This study is going to perform a detailed security and privacy analysis of the existing biometrics-based continuousauthentication schemes using machine learning and AI based algorithms, such as, kNN, K-Means and Random Forest. Thesecurity risk analysis is investigated using Multi-Criteria Decision Analysis (MCDA) system. The offered risk analysis is furtherutilized to countermeasure the shoulder surfing attacks and other relevant security attacks by proposing and developing a morerobust and privacy preserving biometric continuous authentication framework. The BAN or SVO logical analysis is going to be usedto provide a logical security analysis and the framework is going to be implemented using Scyther or Tamarin Prover to provide anautomated security analysis.