Robust Artificial Intelligence Systems to Improve Security of Smartphone Users

现代化的广泛能力 智能手机重新定义了我们工作和娱乐的方式。不幸的是， 与此同时， 对个人和企业数据的威胁。一些基于AI的解决方案已经 提供防御这些威胁的方法。比如说， 非所有者未经授权使用智能手机是一种威胁， 基于AI的持续身份验证解决方案。连续认证 产品依赖于智能手机所有者的设备使用行为（例如，打字 或滑动行为）。同样，基于AI的欺诈检测 这些方法解决了恶意软件在 智能手机 虽然这些解决方案提高了 在某些情况下，他们不认为攻击者试图积极击败 他们因此，这些解决方案可能无法提供所需水平的抗氧化性。 安全拟议研究的长期目标是评估基于人工智能的安全解决方案的安全特性，以对抗具有不同攻击能力的人类对手，对现有系统提出改进建议， 它们对人类对手具有弹性，并确定将这些方法的属性传达给用户的最有效方式，以便他们可以选择最适合的配置。 同时最大限度地减少由于误解和配置错误而导致的事故。这项研究的近期目标是加强两个基于人工智能的系统的安全性，这两个系统目前正用于提高移动的用户、连续身份验证系统和设备指纹识别的安全性，以抵御来自人类对手的基于模仿的攻击（“模仿攻击”）。 激动人心的时刻是 未来：企业越来越多地采用基于AI的持续身份验证 三星BioCatch和IBM Trusteer等解决方案。金融机构广泛 使用基于人工智能的欺诈检测方法来标记潜在的欺诈 交易虽然这些努力充满希望，但仔细评估 这些系统针对足智多谋的对手提供的安全性。我们的研究将确保 安全从业者和产品设计师不仅意识到目前 基于人工智能的安全系统的局限性，但也意识到他们的措施， 使这些解决方案在对抗活跃对手时更加强大。最后， 通过向最终用户提供控制，我们将解决经常被忽视的 这些系统的人性化方面。

The wide-ranging capabilities of modern smartphones have redefined how we work and entertain ourselves. Unfortunately, this is accompanied with an increase in the number and sophistication of threats to personal and corporate data. Several AI-based solutions have been put forth that provide defences against these threats. For instance, unauthorized usage of smartphones by non-owners is a threat that is addressed by AI-based continuous authentication solutions. Continuous authentication products rely on the device usage behaviour of smartphone owners (e.g., typing or swiping behaviour). Similarly, AI-based fraud detection methods address the threat of fraudulent transactions by malware on smartphones. While these solutions improve security under some circumstances, they do not consider attackers that attempt to actively defeat them. As a result, these solutions may not provide the desired level of security. The long-term goal of the proposed research is to evaluate the security properties of AI-based security solutions against human adversaries who will assume different attack capabilities, propose improvements to the existing systems so that they are resilient against human adversaries, and the identification of the most effective way to communicate properties of these methods to users so that they can choose the configuration that works best for them while minimizing incidents due to miscomprehension and misconfiguration. The near-term goal of this research is to bolster the security of two AI-based systems that are currently being used to improve the security of mobile users, continuous authentication systems and device fingerprinting, against imitation-based attacks ("mimicry attacks") from human adversaries. Exciting times are ahead: enterprises are increasingly adopting AI-based continuous authentication solutions like Samsung BioCatch and IBM Trusteer. Financial institutions are widely using AI-based fraud detection methods to flag potentially fraudulent transactions. While these efforts hold great promise, it is critical to carefully evaluate the security offered by these systems against resourceful adversaries. Our research will ensure that security practitioners and product designers are not only aware of the present limitations of the AI-based security systems but also aware of the measures they can take to make these solutions more robust against active adversaries. Finally, by providing controls to the end users, we will address the often neglected human side of these systems.