Authors:
Gerardo Canfora
1
;
Giovanni Cappabianca
1
;
Pasquale Carangelo
1
;
Fabio Martinelli
2
;
Francesco Mercaldo
2
;
Ernesto Rosario Russo
1
and
Corrado Aaron Visaggio
1
Affiliations:
1
University of Sannio, Italy
;
2
National Research Council of Italy (CNR), Italy
Keyword(s):
Continuous Authentication, Silent Authentication, Security, Behavioral Models, Android.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Security and Privacy in Mobile Systems
;
Security in Information Systems
;
Security Metrics and Measurement
Abstract:
The last years have seen a growing explosion of the use of mobile devices. As matter of fact “smart” devices
are used for a plethora of activities: from spending leisure time on social networks to e-banking. For these
reasons smart devices hold huge volumes of private and sensitive user data and allow the access to critical
applications in terms of privacy and security. Currently mobile devices provide an authentication mechanism
based on the login: they do not continuously verify the identity of the user while sensitive activities are
performed. This mechanism may allow an adversary to access sensitive information about users and to replace
them during sensitive tasks, once they have obtained the user’s credentials. To mitigate this risk, in this paper
we propose a method for the silent and continuous authentication. Considering that each user typically runs
recurrently a certain set of applications in every-day life, our method extracts this characterizing sequences
of apps for pro
filing the user and recognizing the user of the device that is not the owner. Using machine
learning techniques several classifiers have been trained and the effectiveness of the proposed method has
been evaluated by modeling the user behavior of 15 volunteer participants. Encouraging results have been
obtained, i.e. a precision in distinguishing an impostor from the owner equal to 99%. The main benefit of this
method is that is does not use sensitive data, nor biometrics, which, if compromised, cannot be replaced.
(More)