Analysing Shoulder Surfing Attacks on Biometrics Continuous Authentication

人工智能方法-这些天来，肩膀冲浪攻击是非常常见的。有时这些攻击是无意的，没有任何恶意窃取任何敏感信息。然而，它们是致命的，无论是否有任何恶意获取任何敏感数据。有研究中，这些攻击的解决和相关的建议，提供强大的对策。然而，随着智能设备的使用越来越多，肩部冲浪攻击正在成为一个具有挑战性的安全问题。该项目旨在解决这一问题，并结合快速发展的AI/ML技术，研究并提出一种有效且安全的生物特征连续认证框架，该框架可以在智能设备上实现，以保护用户敏感信息免受这些攻击。本研究将使用机器学习和基于人工智能的算法，如kNN，K-Means和随机森林，对现有的基于生物特征的连续认证方案进行详细的安全性和隐私分析。安全风险分析采用多准则决策分析（MCDA）系统。通过提出和开发一个更健壮和隐私保护的生物特征连续认证框架，进一步利用所提供的风险分析来对抗肩击攻击和其他相关的安全攻击。BAN或SVO逻辑分析将用于提供逻辑安全分析，该框架将使用Scyther或Tamarin Prover实现，以提供自动化安全分析。

AI Approach - These days, shoulder surfing attacks are very common. Sometimes these attacks are unintentional and without any adverseintention to steal any sensitive information. Yet, they are lethal with or without any ill intentions to obtain any sensitive data. Thereare studies in which these attacks are addressed and relevant proposals are present to provide robust countermeasures. However,with the increase use of smart devices, shoulder surfing attacks are becoming a challenging security concern. This project is toaddress this issue and to integrate the fast growing AI/ML techniques to examine and propose an effective and secure biometriccontinuous authentication framework that can be implemented on smart devices to protect the user sensitive information fromthese attacks. This study is going to perform a detailed security and privacy analysis of the existing biometrics-based continuousauthentication schemes using machine learning and AI based algorithms, such as, kNN, K-Means and Random Forest. Thesecurity risk analysis is investigated using Multi-Criteria Decision Analysis (MCDA) system. The offered risk analysis is furtherutilized to countermeasure the shoulder surfing attacks and other relevant security attacks by proposing and developing a morerobust and privacy preserving biometric continuous authentication framework. The BAN or SVO logical analysis is going to be usedto provide a logical security analysis and the framework is going to be implemented using Scyther or Tamarin Prover to provide anautomated security analysis.