Continuous Authentication for Mouse Dynamics: A Pattern-Growth Approach

Transcription

1 Continuous Authentication for Mouse Dynamics: A Pattern-Growth Approach Chao Shen 1 cshen@sei.xjtu.edu.cn Zhongmin Cai 1, * zmcai@sei.xjtu.edu.cn Xiaohong Guan 1, 2 xhguan@sei.xjtu.edu.cn l MOE KLNNIS Lab, Xi'an Jiaotong University, Xi'an, China 2 Center for Intelligent and Networked Systems and TNLIST Lab, Tsinghua University, Beijing, China Abstract-Mouse dynamics is the process of identifying individual users based on their mouse operating characteristics. Although previous work has reported some promising results, mouse dynamics is still a newly emerging technique and has not reached an acceptable level of performance. One of the major reasons is intrinsic behavioral variability. This study presents a novel approach by using pattern-growth-based mining method to extract frequentbehavior segments in obtaining stable mouse characteristics, employing one-class classification algorithms to perform the task of continuous user authentication. Experimental results show that mouse characteristics extracted from frequentbehavior segments are much more stable than those from holistic behavior, and the approach achieves a practically useful level of performance with FAR of 0.37% and FRR of 1.12%. These findings suggest that mouse dynamics suffice to be a significant enhancement for a traditional authentication system. Our dataset is publicly available to facilitate future research. Keywords- mouse dynamics; one-class learning; anomaly detection; pattern mining; human computer interaction I. INTRODUCTION External and internal attackers masquerading as legitimate users have always been a serious problem in cyber-security settings. The threats from these attackers, who misuse their privileges for malicious purposes, have overtaken viruses and malware as the most reported security incident according to a report from the US Computer Security Institute (CSI) [24]. Thanks to leaked or fabricated identity credentials, impostors can access computer systems easily, and then abuse any privileges available to the masquerading user. The most common approach to address this problem is the use of a user authentication mechanism. Unfortunately, most existing computer and network systems authenticate a user only at the initial login session. Since this authentication occurs only once, the attacker may still take control of the session and steal secret information. In contrast, continuous (re)authentication, which is done throughout the session, can prevent such an attack. Moreover, to achieve a timely and accurately response without active user involvement, continuous (re)authentication is passive and transparent to users. Of the various potential solutions to this problem, one promising direction is mouse dynamics. This approach *Corresponding author. utilizes inherent behavioral features in mouse operations to detect masqueraders. Compared with other biometric techniques such as fingerprints or voice, mouse dynamics does not require specialized hardware to collect the data. In addition, the detection process can be integrated seamlessly into users' normal computer operations, and thus provide a non-intrusive solution for identity monitoring or continuous authentication after the initial authentication by passwords or other credentials. Yampolskiy et at. provide a good review of mouse dynamics [23]. Mouse dynamics has attracted more and more research interests over the last decade. Although previous work has reported some promising results, mouse dynamics is still a newly emerging technique and has not reached an acceptable level of performance. One of the major reasons is intrinsic behavioral variability, in contrast with other physiological biometric characteristics, such as face [3] or fingerprint patterns [7]. Behavioral variability occurs between two immediately consecutive samplings, even if the subject providing the samples strives to maintain a uniform way of mouse operation. This variability often comes from intrinsic human factors or external environmental variables, such as changes in software environments, task or interaction modes; it sometimes relates to variations in biological or emotional status of the operators [10]. This may explain partially why accuracies of mouse dynamics are reported with mixed results, with the equal-error rate (ERR) ranging from 26.8% to 2.46% [1, 4-6, 8, 11-12, 16, 20, 21, 23, 25]. Although behavioral variability is an important issue in mouse dynamics, almost all previous approaches focus on the discriminative power of this technique, and the issue of behavioral variability has never been carefully considered. It should be also noted that, in most previous research, samples from both the impostors and the legitimate user are required for training the classification or detection model. This is not realistic in practice since it is impossible to collect enough data to represent all of the imposters. Besides, there is no public data set in mouse dynamics research, which makes it difficult for third-party verification of published work and precludes objective comparisons between different approaches. Faced with the above challenges, this study utilizes recurring behavior segments in mouse behavior to extract stable behavioral features, and employs one-class classification algorithms to perform the task of continuous /12/$ IEEE

2 user authentication. Specifically, the major contributions of this work include: 1. We address the problem of behavioral variability by proposing a novel approach using a pattern-growthbased mining method to extract frequent-behavior segments for obtaining stable mouse characteristics. This leads to a more accurate and fine-grained characterization of mouse behavior. 2. We employ one-class learning methods to perform the task of continuous user authentication, so that the detection model can be trained solely on the samples from the legitimate user; samples from impostors are no longer required. This is a more practical approach for real-world applications. 3. Using a newly established mouse behavioral data set, we develop a repeatable and objective evaluation procedure to investigate the efficacy of our proposed approach through a series of experiments, and we analyze the tradeoff between security and usability. To our knowledge, this study is the first to make a mouse behavioral data set publicly available. 4. In general, we develop a simple and efficient continuous user authentication method. Experimental results show that mouse characteristics extracted from frequentbehavior segments are much more stable than those from holistic behavior, and the approach achieves a practically useful level of performance with FAR of 0.37% and FRR of 1.12%. These results suggest that mouse dynamics suffice to be a significant enhancement for a traditional authentication system. The remainder of this paper is organized as follows: In Section 2, we review mouse dynamics research relevant to continuous authentication. In Section 3, we present our data collection process. In Section 4, we introduce the mouse dynamics behavior. In Section 5-7, we describe the behavior pattern mining method, and develop a repeatable evaluation procedure. Section 8 presents experimental results. In Section 9, we offer a discussion and possible extensions. Section 10 offers concluding remarks. II. BACKGROUND AND RELATED WORK In this section, we briefly review previous approaches in mouse dynamics research, and then focus on the issue of continuous user authentication. A. Review of Mouse Dynamics Mouse dynamics, a method of behavioral biometrics [23] using human interface devices (HIDs) to record data, such as keyboard and mouse, provides user authentication in an accessible and convenient manner. Since Everitt and McOwan [21] first investigated in 2003 whether users could be distinguished by the way of their mouse operating styles, several different techniques and usages of mouse dynamics biometric have been proposed. Pusara and Brodley [1] proposed a re-authentication scheme as a standalone biometric for user verification. Ahmed and Traore [6, 12] analyzed the feasibility of mouse dynamics by aggregating low-level mouse events, and proposed an approach combining keystroke dynamics with mouse dynamics. Gamboa and Fred [5, 11] studied the possibility of user authentication based on mouse dynamics in graphical interactions. Kaminsky et al. [20] investigated the use of mouse dynamics in identifying online game players. Aksari et al. [4] presented an active authentication frame for authenticating users based on their mouse movements. More recently, Jorgensen and Yu [16] tested this technique under different access scenarios, and also examined the impact of different device types. Nan et al. [25] presented a mouse dynamics based user verification system using newlydefined angle-based metrics, which is able to re-authenticate a user to a high accuracy. The interesting outcomes of previous research are that mouse dynamics can be used as a source of information to discriminate among users, whether the operating conditions and settings are fixed or different for the users. B. Continuous Authentication Based on Mouse Dynamics Among the investigations of user authentication based on the mouse dynamics biometric, there are really two tasks of interest. One task is static authentication, which checks the user only once, typically at login time. Another is continuous authentication, which checks the user continuously throughout the session. The main strength of mouse dynamics biometric technology is in its ability to constantly monitor the legitimate and illegitimate users based on their sessional usage of a computer system. In this study, we focus on continuous (re)authentication for mouse dynamics. Pusara and Brodley [1] proposed a re-authentication scheme in which raw mouse data was preprocessed and grouped into data points, each corresponding to a summary of mouse events over a window of configurable size. They set up a personalized model for each user using C5.0 decision trees. Using data from 11 users, collected on their own personal computers under a free environment, an average false-acceptance rate (FAR) of 1.75% and average false-rejection rate (FRR) of 0.43% were reported. The verification time ranged from 1 minute to 15 minutes because the parameters were chosen independently for each user. This result suggests mouse dynamics may reach a practically useful level, but a sample size of 11 users is relatively small and the issue of behavioral variability is not addressed. Ahmed and Traore [6, 12] aggregated low-level mouse events as higher-level actions such as point-and-clicks. They defined seven feature vectors. Biometric analysis was conducted by concatenating these feature vectors into a 39- dimensional global feature vector and using a neural network for model training and classification. The proposed method was assessed with 22 subjects, achieving an average equalerror rate of 2.46%. The length of data session used in the experiment was around 17 minutes (the session length was not explicitly stated; however, it stated that an average of 12 hours 55 minutes of data was captured from each subject, representing an average of 45 sessions). A supplementary experiment with 7 participants, each of whom was asked to provide three sessions with a period of 30 minutes for each session using the same hardware and software application, resulted in an FRR of 6.25% and FAR of 1.25%. Recently,

3 Nan et at. [25] presented a user verification system based on mouse dynamics using newly-defined angle-based metrics, which is able to re-authenticate a user with high accuracy. Note that in the approaches of Ahemd et at. and Nan et ai., both the impostors' and the legitimate users' mouse feature samples were used for training. This is not realistic since it might be impossible to collect a large amount of data from all potential impostors in practice. Gamboa and Fred [5, 11] presented a continuous authentication approach, in which every movement was considered as a 'stroke', to capture and extract the characteristics of mouse behavior. Each stroke was characterized by a 63-dimensional feature vector including spatial parameters such as angle and curvature, and temporal parameters such as velocity, and acceleration. This feature space was reduced to the best subset of features for each user through a greedy feature selection process. The authentication decisions were made based on the average classification outcome of a sequence of individual strokes using a statistical model. Experiments on data from 50 users collected under a free environment, found that sequences of 1 stroke, 50 strokes and 100 strokes yielded an equal error rate of 48.9%, 2% and 0.7% respectively (equivalent to verification time about 2 seconds, 50 seconds and 100 seconds respectively). However, in this approach the test data was also used for feature selection, which may lead to an overly optimistic result of the detector's performance. The key observation from the above survey is that the issue of behavioral variability of the mouse dynamics biometric has not been carefully considered. Additionally, we know that most previous research uses both the legitimate user's and impostors' samples to train their models, which are not practical in realistic applications; and no other groups that provide a shared data set. In this study, we addressed this problem by using a novel pattern-growth-based mining method and one-class learning algorithms, and obtained a practically useful level of authentication performance. III. A. Data Collection DATA COLLECTION A free experimental environment was established to collect mouse behavior data in this study. We developed data collection software that runs as a background job, starts monitoring the subject's actions when the subject's login occurs and stops running when the subject's logout occurs; the software is totally transparent and does not affect other applications. Mouse behavior data were collected during subjects' routine computing activities, which mainly cover the mouse actions under the applications of Internet surfing, word processing, online chatting, programming, and online games. This setting reflects a real computing environment. During the course of data collection, all subjects were asked to use a mouse to do their routine work for about thirty minutes, representing one data collection session. Whenever the subject moves or clicks the mouse, the data collection software records the event type (i.e., mouse move or mouse click), the position at which the event occurred, the timestamp when the event occurred, and the application information in which the event occurred. In this way, mouse activity data are collected in terms of sessions, and every session consists of about thirty minutes of a user's mouse activity data. B. Apparatus We set up several desktops to collect the data, and all of them were connected to a central server via the Internet. The server stores the collected data in an internal database, along with the subject ID. The desktops are HP workstations with a Core 2 Duo 3.0 GHz processor and 2.0GB of RAM; they are equipped with identical 17" HP LCD monitors (set at 1280x1024 resolution). We equipped the computers with a USB HP optical mouse, running the Windows XP operating system. The server configuration is a Dell PowerEdge server with an Intel Xeon X GHz Quad Core Processor and 12.0 GB of RAM, running the Windows Server 2003 operating system. C. Running Subjects Subjects were 28 volunteer students, all experienced computer users, many from within our lab, but some from the university at large. All subjects had been using the mouse for a minimum of two years. We required subjects to conduct the data collection one session at a time for about half an hour, and wait at least 24 hours between each of their 30 sessions, so each session was recorded on a separate day (ensuring that some day-to-day variation existed within our samples). All 28 subjects remained in the study, each contributing around 90,000 mouse operating actions over 30 sessions, and subjects took between 30 days and 60 days to complete all sessions. This data set will be published to foster future research on mouse dynamics l. IV. MOUSE BEHA VIOR ANALYSIS In this section, we provide the details of the main tasks performed by the behavior analysis process, and define the mouse behavior pattern as a basic concept to address the problem of behavioral variability. A. Atouse Event Mouse behavior is commonly described as the stream of mouse events received from the mouse input device for a specific user while interacting with a specific graphical user interface. Therefore, the first step to understand mouse behavior is to recognize mouse events from the collected raw data stream. Mouse events are usually viewed as system messages sending to some receiving applications to inform current cursor position and mouse button status. In general, the collected data is a list of events such as mouse movement, mouse button down, mouse button up, and so on. Table I shows relevant mouse events in mouse behavior. B. Atouse Operation While user-mouse interaction can be interpreted in an event-driven manner by the OS, such raw events do not provide meaningful information for analyzing behavior. I The mouse behavioral data set is available directly from:

4 Event Name Mouse Down Mouse Up Mouse Wheel Mouse Move TABLE I. MOUSE EVENTS Description This event occurs when a mouse left/right/middle button is pressed. This event occurs when a mouse left/right/middle button is released. This event occurs when the wheel has been moved, if the mouse has a wheel. This event occurs when the user moves the mouse. Consequently, it is necessary and reasonable to translate those events into meaningful actions. Table II lists common mouse actions and corresponding event-level interpretation. Each action corresponds to a set of continuous mouse events. In this study, we encoded mouse action into mouse operation, along with relevant application information. Each mouse operation is represented as a tuple of multi-attributes and timestamp, which is in the form of <action-type, application-type, screen-area, window-position, timestamp>. Detailed information of mouse operation defined in this study is shown in Table III; the third column is the encoding number used in this work. C. Mouse-Behavior Pattern Through a preliminary analysis of mouse operations, we discovered that some behavior segments, consisting of a series of consecutive operations, would recur frequently in users' routine mouse usage. In this paper, we refer to this recurring and fixed behavior segment as behavior pattern. This study divides behavior patterns into two categories: micro-habitual patterns and task-intended patterns. Microhabitual patterns characterize the subconscious and habitual constituents of mouse activities urging GUI interactions, such as some habitual mouse operations on the desktop. For instance, most subjects are accustomed to repeatedly refresh the computer screen, which means the subject would click the right mouse button on an empty area of the desktop, then select "Refresh" from the contextual menu, corresponding to a series of consecutive mouse operations: right single click - > mouse movement -> left single click. Task-intended patterns characterize the operating agility and habits of individual mouse activities under certain applications, such as regularly utilizing some certain functions in a particular application. Concretely, if the subject wants to create a new document in word processor, he/she would first click the left mouse button on the menu of the word processor, next select "New" from the contextual menu, and then select the "blank document" from the new contextual panel and double click it, which corresponds to a group of consecutive mouse operations: left single click -> movement -> left single click -> mouse movement -> left double click. More specifically, upon a closer examination of the behavior pattern, we found the relevant measurements extracted from these behavior patterns appeared much more stable than those from holistic behavior. We conjectured that the improved stability may be due to repeatedly recurring behavior segments providing more stable and habitual information about mouse behavior. Therefore, we made an Mouse Actions Single click Double click Common Movement Point and click movement Drag and drop movement Silence TABLE II. MOUSE ACTIONS Description Mouse down event followed by mouse up event of left/right/middle buttons A continuous operation of mouse down, up, down and up event of left/right/middle buttons General mouse movement involving no clicks A mouse movement followed by single or double clicks at the end. An action starting with mouse button down event, followed by a movement and ending with mouse button up event. The standstill of mouse cursor, i.e., a situation without any mouse operations TABLE III. MOUSE OPERATION INFORMATION Attribute Descriptions Encoding Mouse Corresponding to the actions defined in action type Table Application in which the action Application occurred, including surfing the Internet, Type word processing, online chatting, and 0-3 playing games. Screen area Area of the mouse cursor on the screen, which is evenly divided into 9 regions. 0-8 The position of window, including client Window area, close area, maximum area, position minimum area, menu, bar, title bar. 0-6 Timestamp The timestamp when the action occurred assumption that frequent behavior segments in mouse behavior could provide more stable and discriminative features or measurements, and allow one to more accurately characterize the discriminable components of mouse behavior. This assumption was later verified by a series of experiments in this work. V. MOUSE BEHA VIOR PATTERN MINING In this section, we define the problem of mouse behavior pattern mining, and then extract behavior patterns from holistic behavior. A. Problem of Mouse-Behavior Pattern Mining Because our overall goal is to extract frequent mouse behavior patterns from holistic behavior, we first defined the problem of mouse behavior pattern mining. Let I= {ij, ib..., in} be a set of all mouse operations. An operation-set is a subset of mouse operations. A sequence is an ordered list of operation-sets by User ID and timestamp, and is denoted as s by {SjS2"'S/}, where Sj is an operation-set, i.e., S j C I, for 1 :S j :S I. Sj is also called an element of the sequence, and denoted as {Xb X2,..., xm}, where Xk is a mouse operation. An operation can occur multiple times in an element of a sequence. The number of instances of mouse operations in a sequence is called the length of the sequence. A sequence with length I is called an I-sequence. A mouse operation sequence database S is a set of triples <ID, sid, s>, where ID is the user ID, sid is a sequence ID and S is a sequence. A

5 User ID TABLE IV. AN EXCERPT FROM SEQUENCE DATABASE Sequence ID Sequence 1 1 («1,3,4,0», <(1,3,4,0), (2,1,4,0), (3,1,4,0»,..., «2,1,2,1»} 1 2 {(2,1,4,0), (1,1,5,1),..., (3,1,4,0)} 1 3 ((2,3,4,0), (1,1,3,0),..., (1,2,2,5)} triple <ID, sid, s> is said to contain a sequence a, if a is a subsequence of s. The support of a sequence a in a database S is the number of tuples in the databases containing a. It can be denoted as support(a) if the sequence database is clear from the context. Given a positive integer :; as the support threshold, a sequence a is called a sequential pattern in sequence database S if the sequence is contained by at least:; tuples in the database, i.e., supports(a) :;. A sequential pattern with length I is called an I-pattern. In this study, we recorded all mouse operations in a sequence database, and each sequence is composed by some consecutive operations between two adjacent silence actions. An excerpt from our mouse operation sequence database is shown in Table IV, and the third column corresponds to the items defined in Table III. Taking the first entry in Table IV as an example, a sequence {<(1,3,4,0», «1,3,4,0), (2,1,4,0), (3,1,4,0», «2,1,2,1»} has elements: <(1,3,4,0», <(1,3,4,0), (2,1,4,0), (3,1,4,0»,..., where mouse operation (1,3,4,0) appears more than once respectively in different elements. Mouse operation (1,3,4,0) happens twice in this sequence, so it contributes 2 to the length of the sequence. Also, the sequence {<(1,3,4,0»} is a subsequence of <(1,3,4,0), (2,1,4,0), (3,1,4,0». Problem Statement. Given a mouse operation sequence database S and a minimum support threshold :;, the problem of sequential mouse behavior pattern mining is to find the complete set of frequent mouse behavior patterns in the database. B. Mouse Behavior Pattern Mining Method In this study, we employed PrefixSpan [19], a new pattern-growth based sequential mining method, as the basic engine for mining mouse behavior patterns from the observed mouse activities. Its basic idea is to examine only the prefix subsequences and project only their corresponding suffix subsequences into projected database. In each projected database, sequential patterns grow by exploring only local frequent patterns. It mines the complete set of sequential patterns and substantially reduces the efforts of candidate subsequence generation. Thus, we first introduced the basic concept of prefix, suffix and projected database. Prefix: Given a sequence a = (e,e2".en), a sequence f3 = (e, ' e2 ' em ')(m < n) is called a prefix of a if and only if (1) ej ' =ej for (i :OS:m-1) ; (2) em ' em ; and (3) all the items in (em - em ') are alphanumerically after those in em '. Suffix: Given a sequence a=(e,e2 en) (where each ei corresponds to a frequent element in S). Let Input: a mouse operation sequence database S, and a minimum support threshold.;. Output: Complete set of frequent mouse behavior patterns P. Method: MouseBehaviorPatternMiningO Call MouseBehaviorPatternMining «>, S, (J Begin (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (II) (12) Let a be a sequential mouse operation pattern; ifa;i<> Let Sin be the a-projected database; else Sla= S; end Let l be the length of a; for each mouse operation in Sia do begin Find the set of frequent item b; if the product of frequency of b in Sia and (1+ I) is larger than.; then begin if b can be assembled to the last element of form a new set B = B U (b) ; (13) end (14) end (15) end (16) for each frequent operation b in B do begin (17) a'=au(b}; (18) form a new a '-projected database Sla'; (19) Call MouseBehaviorPatternMining (a', Sin', (J; (20) end end Figure 1. Mouse Behavior Pattern Mining Algorithm j3= (e,'e2' em') (m<n) be the prefix of a. Sequence r = (e " e,'" e ) is called the suffix of a with regards to III 111+ II prefix (3, denoted as y=al(3, where e: = (em - em ' ). Note that if (3 is not a subsequence of a, the suffix of a with respect to (3 is empty. Projected database: Let a be a sequential pattern in sequence database S. The a-projected database, denoted as Sla. is the collection of suffixes of sequences in S W.r.t. prefix a. The behavior patterns are incrementally extracted from our mouse operation sequence database using the algorithm in Figure l. This procedure first scans the mouse operation database S once to find length- l sequential mouse behavior patterns, then divides the search space into prefixes, and finally constructs the corresponding set of projected databases, each of which would be mined recursively, to find subsets of sequential mouse behavior patterns. C. Reference-Behavior Pattern Generation and Matching When applying the proposed pattern mining method to extract behavior patterns from holistic mouse behavior, the first aim is to create "baseline" normal behavior patterns as a reference-behavior pattern set for each legitimate subject. We first mined behavior patterns from each training data session, and then incrementally merged these patterns to form an aggregate pattern set. This aggregate set, generated from these initial mouse behavior operations, would be viewed as the reference-behavior pattern set for each subject. Then given the reference-behavior patterns and new coming mouse operation sequences from a new data session, we can easily identify the matching patterns using the following procedure:

6 TABLE V. AVERAGE RATIO OF THE NUMBER OF OPERATIONS IN BEHA VIOR OF DIFFERENT LENGTHS OF BEHA VIOR PATTERNS TO TOTAL NUMBER OF OPERATIONS IN HOLISTIC BEHAVIOR Minimum Length-! Lenth-2 Other All support pattern Pattern Patterns Patterns 2% 23.64% 32.15% 25.22% % 5% 16.08% 22.06% 24.90% 63.04% 8% 12.29% 17.65% 17.34% 47.19% 20% 0.95% 1.26% 0% 2.21% Step1: For each operation sequence in the new data session, sequentially search matches given reference-behavior patterns. Step2: Output all matching patterns to represent the new data samples. This procedure considers a behavior segment from a new coming data sample as a behavior pattern as long as it has a matching with one of the reference-behavior patterns. D. Behavior Pattern Analysis The collected data for mining the mouse behavior patterns and generating the reference-behavior patterns consisted of 15 sessions for each of 28 subjects, and based on these results, we can then construct the feature vectors and build the profile of an individual user's mouse behavior. Table V shows the average ratio of the number of operations in different lengths of behavior patterns to total number of operations in holistic behavior over 420 sessions of 28 subjects. Within this table, we observe that the ratios for different lengths of behavior patterns all decreased as the minimum support increases. When the minimum support comes to 20%, the ratio for all patterns is just 2.21 %. This may make the mined patterns provide no meaningful information for analyzing the behavior. While, in contrast, if we set the minimum support as a smaller value, for example, 2% in our study, it will generate more behavior patterns, but this may induce increasingly unstable and inconsistent mouse behavior, which may lead to lower authentication performance. Therefore, to obtain stable and applicable mouse behavior patterns, a balance should be obtained between minimum support and true effectiveness of behavior patterns. In this study, we set the minimum support to be a trade-off value of 8% for usage, under which the corresponding ratio value for mined length- I, length-2 and length-n (n 2: 3) behavior pattern are 12.29%, 17.65% and 17.34% respectively. Note that for easy presentation, we only present the ratio value in Table V at an average level. However, a similar observation holds for every subject. VI. FEATURE CONSTRUCTION A. Feature Construction from Mined Patterns The mined frequent-behavior patterns cannot be used directly by a detector or classifier. Instead, dynamic features are extracted from these patterns. These features are typically organized into a vector to represent behavior patterns from each data session. To construct the feature vectors determining users' mouse behavior and validating hislher identity, we first characterized mouse operations based on two basic physical properties: space and time. Each property was then analyzed individually, and converted into several features, to form the feature vector. This study defined four fine-grained, space and time based feature metrics to depict mouse behavior patterns, which can accurately and stably characterize a user's unique mouse behavior. Click Elapsed Time. The click elapsed time is the time spent by the user to perform a click action, including left/right single clicks and left/right double clicks. For single click, mean and standard deviation of overall time are extracted' and for double click, mean and standard deviation of on overall time and three interval times are used in this study. Movement speed. The average movement speed for different types of mouse movements. This study divided mouse movements into 24 types, depending on 8 different movement directions and 3 different movement distances which covers most common and discriminative mous actions in users' daily use of mouse operations [6, 8]. Movement acceleration. The average movement acceleration for different types of mouse movements. Those features are extracted in a similar way as movement speed. Relative-Position of Extreme Speed. For further characterizing the mouse movement, we calculated the relative position of the maximum speed value over the movement speed curve. Concretely, if the maximum speed value locates at the middle position of the movement speed curve, the relative position has the value of 0.5. As stated in Section IV, mouse activity data are collected in terms of sessions. Therefore, a set of features is extracted from the mined behavior patterns in each data session. In this paper, there are 20 click-related features, 24 movementrelated features, 24 acceleration-related features, and 24 extreme-speed-related features, which would be taken together to form a 92-dimentional feature vector for representing each data session for subjects, and ' thus validating their identity. It should be noted that there are three types of mouse movement considered in this study, as shown in Table II. However, all movement-related features are extracted from common movement and point-and-c1ick movement, and we chose to omit the drag-and-drop. The reason is that this type of movement is rare for most subjects in our study, and has a strong variability over time even in behavior patterns. B. Empirical Feature Study In this section, we made a systematic exploration to see how well, and to what degree behavioral variability can be lessened or reduced in behavior patterns compared with those in holistic behavior. 1) Stability of Features in Behavior Pattern One problem we came cross in analyzing original mouse behavioral data is that the stability of mouse dynamics may be subject to behavioral variability. The data might be affected by inconsistent environmental variables or intrinsic human factors. Thus, the features extracted directly from original behavioral data are usually poor choices for determining an individual user's mouse behavior. The reason is that these features can be skewed by differences in environmental variables or human factors. More specifically,

7 Subject 1 (Behavior pattern) ----A- Subjectt (General behavior) Subject 1 (Behavior pattern) ----A- Subjectt (General behavior) Subject2(Behavior pattern) ---B- Subject2(General behavior) Subject2(Behavior pattern) ---B- Subject2(General behavior) LL 0 Il Q15 LL 0 Il.. 0.Q Movement distance: 524 pixels Left sjngle click time (milliseconds) (a) Average movement speed (pixels/milliseconds) (b) Subjectl (Behavior pattern) ----A- Subjectl (General behavior) --+- Subject2(Behavior pattern) ---B- Subject2(General behavior) Subject 1 (Behavior pattern) ----A- Subject 1 (General behavior) --+- Subject2(Behavior pattern) B- Subject2(General behavior) LL 0 Il Movement direction: diagonal Movement distance: 524 pixels LL 0 Il Movement direction: diagonal Movement distance: 524 pixels o o Average movement acceleration (pixels 2 /milliseconds) (c) Relative position of extreme speed (percent) Figure 2. Mouse features extracted from behavior pattern and holistic behavior for two different subjects. Panel (a) (b) (c) (d) show the probability distribution function (PDF) curves of some typical mouse features used for two different subjects, including left single click time, average movement velocity, average movement acceleration, and relative position of extreme speed. The features are extracted from both behavior pattern and holistic behavior. (d) features such as click time are highly dependent on the agility of a user's finger or a subject's intent; features such as movement speed or acceleration are contingent upon the motion habits of individual mouse actions or the scenario in which a subject is under way. For example, a subject tends to move and click faster when he/she knows where the files are, and hesitates for a longer time if he/she is trying to find that document. Therefore, this makes a good case to use the features extracted from mouse behavior pattern for comparison among subjects. We used the kernel density estimation [13] method, a non-parametric way of estimating the probability density function (PDF) of a random variable, to compute the PDF of each mouse feature from both behavior patterns and holistic behavior for two different subjects. Each feature's PDF is computed over 300 corresponding mouse operations from both mined behavior pattern and holistic behavior. Figure 2 shows the comparison of some typical features for two different subjects. We can observe that the PDF curves for the features extracted from behavior patterns appear much more compact and concentrated than those from holistic behavior, which indicates that the characteristics in a behavior pattern may allow one to more accurately characterize of mouse behavior. We conjecture this may be due to repeatedly recurring behavior segments providing more fine-grained and invariant information about mouse behavior. This also suggests that the features extracted from frequent behavior patterns are more stable and probably lead to a high detection performance. Similar results can be observed for other subjects. 2) Discriminability of Features in Behavior Patterns Another unique trait of the features extracted from behavior patterns is that they are more distinctive among subjects than those from holistic behavior. Not only does the same subject have relatively stable feature values in his/her behavior patterns, but different subjects have distinct feature values, which are more discriminable than those from holistic behavior. As Figure 2 shows, we observe that the PDF curves of features from holistic behavior overlap each other for two different subjects in a relatively large region, which makes it difficult to discriminate among subjects. As a comparison, there is a clearly distinctive gap between different subjects' PDF curves of features from behavior patterns, indicating

8 TABLE VI. AVERAGE DISPERSION METRICS OF MOUSE FEATURES FOR HOLISTIC BEHAVIOR AND BEHAVIOR PATTERNS. Features Holistic Behavior Behavior Pattern Left single click time (-91.7%) Left double click time (-66.2%) Right single click time (-72.2%) Right double click time (-61.3%) Average movement speed* (-62.4%) Average movement acceleration* (-61.4%) Relative position of extreme speed* (-54.94%) features from behavior patterns hold more discriminating power, and may boost detector performance for user discrimination tasks. Specifically, the average movement speed (panel (b» and acceleration (panel (c» from behavior patterns are separated completely for two different subjects, while those from holistic behavior are overlapping. This implies a noticeable difference among users' behavior when using the features extracted from behavior patterns, whereas it could be very hard to uniquely differentiate subjects using the features extracted from holistic behavior. Together with the feature stability discussed before, this makes the features extracted from behavior pattern evidently superior to those extracted from holistic behavior. Note that for easy presentation, we only compare the difference between a pair of subjects. However, a similar observation holds for other subjects. 3) Statistical Dispersion of Features Across Subjects Further to investigate the stability and discriminability of features extracted from frequent behavior patterns, we defined a simple and effective dispersion metric based on Gini's Mean Difference [2]. The measurement of this metric is a real number that is zero if all the data are identical (or stable and unique), and increases as the data become more diverse, with the same scale as the quantity being measured. For each feature fk used in this study, with a sequence of values {x; hxii, (nk is the number of feature samples), the dispersion metric DM(Jk) can be defined as: 1 11k 11k LL:!x: - xjl DM( fk) = nk (nk - 1) i=1 j=1 The dispersion metric of each feature for every subject is computed over 300 corresponding mouse operations. Then we calculated the average dispersion metric for each feature over all 28 subjects. Table VI shows the average dispersion metrics for some typical features extracted from behavior patterns, in comparison with those extracted from holistic behavior. In addition to the dispersion metrics, the table includes a percentage in parentheses, which indicates the percent decrease in dispersion metrics of behavior patterns over 'This study extracted average movement speeds for 24 types of mouse movement (same setting for average movement acceleration and relative position of maximal speed), based on 8 different movement directions and 3 different movement distances. Note that for easy presentation, we only present one case of speed features with the diagonal direction and 524 pixels' distance. However, the similar observation holds for the other speed features. those of holistic behavior. By comparing the second and third columns of Table VI, it is clear to see that features extracted from behavior patterns are much more stable and discriminative than those extracted from holistic behavior. We observe the significant decrease percentage over all the dispersion metrics for features from behavior patterns. Specifically, almost all the metrics for behavior patterns decrease over 50%. What's more, the decreased percentage for left single click time is up to 91.7%. This implies that the features in behavior patterns have their own inherently unique attributes which are much more stable and discriminative than features in holistic behavior. This may allow more fine-grained and accurate characterization of mouse behavior among subjects, and may result in a high performance boost for user discrimination task. VII. DETECTOR IMPLEMENTATION In this section, we develop three types of one-class detector. By ensuring that we have diversity in the set of detectors, we can examine whether or not an observed effect is specific to one type of detector or more generally true for a range of detectors. A. One-Class Detector Overview User authentication is still a challenging task from the pattern classification viewpoint. It is a two class (legitimate user vs. impostors) problem, but only the patterns from the legitimate user are available in advance. Most previous research used both the legitimate user's and impostors' samples to train their models. Yet this is not practical in realistic applications since there may be thousands of potential impostors' data samples at the risk of fatal intrusion. Therefore, a better solution is to build a model only based on the legitimate user's data samples, and then use it to detect impostors who are using some sort of similarity measures. This type of problem is known as one-class classification [14] or anomaly detection [15]. In this study, we constrained our attention to one-class anomaly detectors that behave similarity in terms of their input and output. B. Detector 1: Nearest-Neighbor Detector A nearest-neighbor based detector models a user's mouse behavior based on the assumption that new mouse behaviorpattern feature vectors from the user will resemble one or more of those in the training data. During training, the detector estimated the covariance matrix of the training feature vectors, and saved each mouse behavior-pattern feature vector. After multiple tests with k changing from 1 to 5 we obtained the best results with k=3, which will be shown in section 9. During testing, the detector calculated Mahalanobis distances (using the covariance matrix of the training data), and distance was calculated from the new feature-distance vector to each of the vectors in the training data. The distance from the new vector to the nearest vector from the training data was used as the anomaly score. C. Detector 2: Neural Network Detector Neural networks have been used successfully in many applications. In this paper, we considered single-hidden-layer

9 neural networks. In the training phase, a network was built with p input nodes, one output node, and L 2 p / 3 J hidden nodes. The network weights were randomly initialized, and then the detector was trained to produce a 1.0 on the output node for every training feature vector. We trained for 500 epochs using a learning-rate parameter of In the testing phase, the test vector was run through the network, and the output of the network was recorded. Denote s to be the output of the network; intuitively, if s is close to 1.0, the test vector is similar to the training vectors, and with s close to -1.0, it is dissimilar. D. Detector 3: Support Vector Machine (one-class) A one-class SVM generalizes the idea of mapping the data into a high dimensional feature space via a kernel function, and treating the origin as the only example from other classes. In the training phase, the detector was built using the training vectors. In the testing phase, the test vector was projected into the same high-dimensional space and the distance from the linear separator was calculated. The anomaly score was calculated as this distance, with the sign inverted, so that positive scores are separated from the data. We used a REF kernel function in this study, and the SVM parameter g and nu (using LibSVM [18]) were set to 0.01 and 0.02 respectively. Then the decision function was calculated. The function would generate "+ 1" if the authorized user's test set is input, otherwise it is a false rejection case. On the contrary, "-1" should be obtained if the impostors' test set is the input; otherwise a false acceptance case occurs. VIII. EVALUATION METHODOLOGY This section explains how we set up the detector training and testing, and calculates the detector performance. A. Training and Testing Procedure We started by designating one of our 28 subjects as the legitimate user, and the rest as impostors. We trained each detector and tested its ability to recognize the legitimate user and impostors as follows: Step 1: We ran the training phase of the detector on the randomly-selected half of feature samples generated by the legitimate subject. The detector builds a profile of that user. Step 2: We ran the testing phase of the detector on the feature samples from the remaining half of the data generated by the legitimate user. We recorded the anomaly scores assigned to each feature sample as user scores. Step 3: We ran the testing phase of the detector on the feature samples from data generated by the impostors. We recorded the anomaly scores assigned to each feature sample as impostor scores. This process was then repeated, designating each of other subjects as the legitimate user in turn. For choosing parameters of interest, lo-fold cross validation was employed. Since we used a random sampling to divide the data into training and testing sets, and we want to account for the effect of this randomness, we repeated the above procedure ten times, each time with an independently selected draw from the entire data set. B. Calculating Detection Peiformance To convert these sets of detection scores of legitimate users and impostors into aggregate measures of detector performance, we compute the false-acceptance rate (FAR) and false-rejection rate (FRR). The FAR is the measure of the likelihood that the biometric security system will incorrectly accept an access attempt by an unauthorized user. The FRR is the measure of the likelihood that the biometric security system will incorrectly reject an access attempt by an authorized user. The lower the FRR and FAR, the more accurate the approach. We also brought FAR and FRR together to generate a graphical summary of performance called an ROC curve [17]. Whether or not mouse operating behavior generates an alarm depends on how the threshold on the anomaly scores is chosen. An anomaly score over the threshold indicates an impostor, while a score under the threshold indicates a legitimate user. The choice of threshold establishes the operating point of the detector on the curve. Over the continuum of possible thresholds, the ROC curve illustrates the FARs and FRRs that would be attained at each possible detector operating point. Moreover, the threshold can be increased or decreased from the default value of 0.0 to bias the classifier towards authentic users or impostors, lowering the FRR or FAR, respectively. After multiple tests, we observe that setting the threshold value of 0.45 yields a relatively low FAR on average*. Therefore, throughout this paper, we would show results with a threshold value of 0.45 in most cases. IX. RESULTS AND ANALYSIS In this section, we present an objective evaluation on the effectiveness of the proposed approach through a series of experiments, and then investigate the performance at varying session lengths, trying to find a balance between security and usability. A. Detector Peiformance Table VII shows the average FARs and FRRs of continuous authentication for each of three detectors over all subjects, with the input set to be feature samples from behavior patterns and feature samples from holistic behavior (as mentioned in Section 8.2, these tests are performed with the threshold of 0.45.). Additionally, to further analyze the efficacy of features from behavior patterns, Figure 3 shows the ROC curve for each of three detectors. Our first observation is that the best performance has a FAR of 0.37% and FRR of 1.12%, obtained by the One Class SVM detector, which is impressive and achieves an acceptable level of accuracy for realistic application. It is also competitive with the best results previously reported, while being subject to more variability of mouse dynamics compared with previous work, because they represent activities in a longer period of observation. We also observe that the average error rates for features from the holistic *Note that for different detectors, there are different threshold intervals. For instance, the threshold interval for the neural network detector is [0, 1], and for the one-class SVM, it is [-1, 1]. For uniform presentation, we mapped all intervals to [0, 1].

10 TABLE VII. FARs AND FRRs OF THE THREE DETECTORS (WITH Q) en Cii I..L. STANDARD DEVIATION IN PARENTHESES) Behavior Pattern Holistic Behavior Detector FAR FRR FAR FRR Nearest Neighbor Neural Network One-Class SVM 2.73% 3.67% 8.87% 9.63% (0.0124) (0.0089) (0.0936) (0.0923) 0.89% 2.15% 6.36% 6.95% (0.0057) (0.0065) (0.0534) (0.0653) 0.37% l.l2% 5.57% 6.73% (0.0062) (0.0067) (0.0502) (0.0493) 40, _.,8".- One-Class SVM -e- Neural Network Nearest Neighbor False Acceptance Rate (FAR %) Figure 3. ROC curves for three different classifiers using features from behavior pattern: One-class SVM, neural network and nearest neighbor. behavior are much higher than those from behavior patterns. We conjecture that these results may be due to stable and fine-grained characterization of mouse behavior by using behavior patterns, and is also a demonstration of the true effectiveness of pattern mining methods in dealing with variable behavior data. Besides, it should be noted that our result is very close to the European standard for access control, which requires near-perfect accuracy of % false acceptance rate and 1 % false rejection rate [9]. While it might be unwise to rely solely on an authentication method which is not up to the European standard, it does seem that mouse dynamics could provide evidence in a user discrimination task. Another thing to note from Table VII is that the standard deviations of error rates from features from behavior patterns are much smaller than that of features from holistic behavior for all detectors, suggesting that behavior patterns might be more stable and robust to the variability of mouse behavior. Our second observation is that the one-class SVM detector has a much better performance than all other detectors considered in this study. This may be due to the fact that SVMs can convert the problem of classification into qu. adratic optimization in the case of relative insufficiency of pno. knowledge, and still maintain high accuracy and stability. Moreover, the standard deviation of FAR and FRR for the one-class SVM is competitive with other methods indicating that it may be robust to variable behavior data and different parameter selection procedures. Besides, we also TABLE VIII. FARs AND FRRs FOR VARIOUS DATA SESSION LENGTHS Operation lenj!th FAR FRR Authentication time % 34.78% about 1 minute % 9.45% about 5 minutes % 3.39% about 10 minutes % 1.69% about 20 minutes % l.l2% about 30 minutes observe that the performance obtained by nearest neighbor is of FAR=2.7 %, FRR=3.67%, which may be not encouraging comp ed WIth other two detectors in our study. We gauge that this may be due to lacking of self-learning ability using this method. Furthermore, to statistically and systematically evaluate the performance obtained from the proposed approach, we conduct a statistical test using the half total error rate (HTER) and confidence interval [22]. This statistical test shows that the proposed approach provides the lowest HTER among three detectors, and with 95% confidence, the confidence interval lies in between 0.75%±1. 15%. B. Effect of Session Length The session length corresponds to the number of mouse operations to accomplish a data collection session. Session length may play an important role in mouse dynamics for continuous user authentication since it represents the window of opportunities for an impostor, and even a few minutes is nough for an adversary to compromise the system. To InVestIgate the effect of session length on the accuracy of the detector, we conducted a test on the same data set with varying session lengths, trying to find a balance between security and usability. Table VIII shows the FARs and FRRs at varying session lengths, using a One-Class SVM detector. In addition to the FAR and FRR, the table includes the authentication time in minutes corresponding to the varying session lengths. The authentication time refers to the sum of average time needed to collect a data session, and the average time needed to make the decision. The FAR and FRR obtained on the ses ion leng h of 100 is 44.56% and 34.78% respectively, which IS akin to random guessing, but the authentication time only took about 1 minute. As the session length increases, the FAR and FRR drop to 2.75% and 3.39%, with the authentication time about 10 minutes. Therefore, we may draw a conclusion that the accuracies of detectors almost certainly get improved as the session length increases. What's more, the FAR and FRR drop to 0.37% and 1.12% after observing 3000 mouse operations, which achieves a practically useful level of performance, but having a authentication time up to 30 minutes. This may limit the applicability for a large scale deployment in real systems. Thus a tradeoff must be made between security (FAR and FRR) and user acceptability (authentication time), and more investigations and improvements should be performed to place it in more realistic settings.