The article is devoted to the biometrics algorithms of authentication in web application. The authors conduct an overview of biometrics algorithms. Described benefit of most popular biometrics' algorithms and two-factor user authentication. Selected one which most prefer for web application and doesn't require additional devices. Modeled this approach and tested it on real data. The modification of the keystroke dynamics algorithm, as the collection of input characteristics on the keyboard during a visit to the site had been proposed. The authors come to the conclusion that the use of a larger set of date for training will improve the algorithm and will be possible to increase the accuracy.
Biometric data [
The initial model is first stored in a database. Person who try to be authenticated is “visitor”. Stored data is then compared with the biometric characteristics of the “visitor”. Because the biometric characteristics are unique to everyone, they cannot be seen or stolen.
In order to be able to identify the individual, the first thing you need to do is to get the data from that user. The data obtained depend entirely on the method by which the user will be identified. For example, for the voice recognition it can be a record of their voices, for the face recognition it can be a photo of their face. These data are then compared with the biometric data which person provide to special device, which can read out the information.
In a fast moving world, biometrics has quickly established itself as the most appropriate means of identification and authentication of individuals, as it is a fast way to use unique biological characteristics.
Today, this technology is used in many areas, such as web applications, specially protected objects, mobile access and others.
Please note that the first paragraph of a section or subsection is not indented. The first paragraphs that follows a table, figure, equation etc. does not have an indent, either.
Subsequent paragraphs, however, are indented. 2
Biometrics [
There are two categories of biometric technologies: physiological and behavior measurements.
The physiological measurements can be either morphological or biological [
The most common behavioral measurements [
The various methods used are the subject of constant research and development and are, of course, constantly being improved. However, not all measurements have the same level of reliability. Physiological measurements are generally considered to have the advantage of remaining more stable throughout a person's life. 3
Biometric authentication [
A biometric template or identifier (a sample known to belong to an authorized user) should be stored in a database so that the device can compare it with the new sample received during the login process. Biometric data is often used in combination with smart cards in highly secure environments. The most popular types of biometric devices are: Fingerprint scanners Facial pattern recognition devices Hand geometry recognition devices Iris scan identification devices Retinal scan identification devices Keystroke Dynamics
Behavioral key biometrics [
For web applications on of the best approach of two-step authentication is
keystroke dynamics. Mainly, because this method requires only keyboard. Everyone has
their own unique handwriting, which is very difficult to forge. The same can be said
about keyboard handwriting. The main idea of this method is on Fig 2.
The dynamics [
Typically, all keystroke evaluations include (1) a set of subjects to collect data and provide them with input assignments, (2) recording of keystroke times, (3) retrieval of elements suitable for training and testing the classifier, (4) training the classifier using one part of the printed data, and (5) performance testing of the classifier using another part of the printed data.
Before discussing the approaches used by researchers in the dynamics of keystrokes, the features that can be extracted from printed data are described here. When typing, the computer can record the time the key is pressed (waiting time), the time the key is pressed, and the time the key is delayed between the keys of the managers, i.e. the time elapsed between one key and the next. The time measured between key up and the key down is called Flight time. Thus, three timing functions can be derived from the source data: Pressure printing (PP), Release to release (RR) and Release to Press (RP). You can also retrieve other temporary information, such as the time it takes to write a word, a digital graph (two letters) or a three-letter graph (three letters). This item belongs to the category "press to press".
Digital charts contain two consecutive keystrokes, while trigrams contain three; this continues for any number of combinations, resulting in n-charts. Using this terminology, the word "renown" will have three digital charts (“re”,”no”,”wn”) and two trigrams (“ren”,”own”).
The recorded keystroke times are then processed to produce simple templates derived from performance statistics, such as average and standard deviation from the complex pattern recognition algorithm. All this information can be obtained during user input. 4.1
Nowadays, there are many classifiers for keystroke dynamics, so these models are
tested based on security parameters [
FRR – is ratio of the number of false refusals divided by the total number of genuine attempts at a match. Thus, FRR gives the number of true users who are denied access to the system. A higher FRR is preferred in higher security systems.
EER is a FAR attitude divided by FRR. A lower EER value means a better system. 4.2
Nowadays, there are many classifiers for keystroke dynamics, so these models are tested based on security parameters such as false acceptance rate (FAR), false rejection rate (FRR) and equal error rate (EER).
The procedure of generation of subsets is a search procedure within which subsets
of candidate characteristics are created on the basis of the evaluation criterion. The
evaluation function is used to evaluate the subsets under study, the stop criterion is
used to determine when to stop, and the validation procedure is used to check the
validity of the subsets. FSS algorithms [
The filter model [
The wrapper model [
The hybrid model [
After the extraction of the feature and the selection of the feature, the next step is the
classification step, which compares the saved template with the sample provided
during the session. There are various methods used for classification. These classification
algorithms are divided into four main categories [
Statistical approaches calculate the average, standard deviation of characteristics in the template. Distance measurement methods such as Euclidean distance, weighted Euclidean distance, Manhattan distance, etc. are used to compare the training data set with the test data set. There is no need for the data collected for authentication and verification at the push of a button to be linear, so sometimes these linear statistical approaches do not produce good results.
Thus, there is a need for some approaches that use probabilistic data rather than deterministic data. Other statistical methods can also be used for classification, such as the decision tree, Bayes classification (based on a hindsight probability), etc. In addition, the Montecarlo method [12] can be used for the dynamics of keystrokes and thus achieve an average false alarm rate of 9.62% and an average acceptance rate of 0.88%. Another approach used for classification purposes is the use of an artificial neural network.
Ting-Yi Chang [14] used ANN technology and keystroke capabilities to dynamically generate a long-lived private key, and found out that if the password was opened, the probability of hacking the private key would decrease. The advantage of this approach is that it can handle many of the parameters and thus gives good results. This method shown on Fig. 4. Image recognition is defined as the act of obtaining initial data (samples, objects) and their classification into different categories based on algorithms. Pattern recognition includes machine learning algorithms, various classification methods, such as the closest neighbour, Bayesian classifier, and support vector machine, clustering methods such as K-means, etc.
Hyoung-joo Lee [13] used SVM, and it was noticed that retraining increases the efficiency of authentication and that quantization of vector learning to detect novelties surpasses other widely used novelty detectors. This method shown on Fig. 5. The fourth approach usually includes evolutionary algorithms, such as genetic algorithm, Ant colony optimization, Particle swarm optimization etc. The advantage of using these evolutionary methods is that they can work with large databases. Ant colony optimization method shown on Fig. 6. In the course of this work, a two-factor authentication simulation was developed in a web application. The keystroke dynamics was chosen. This method allows to very accurately determining the identity of the person who enters the username and password without special devices. BeiHang Keystroke Dynamics Database" was selected as the data set for training. Further, the results were checked on the “Stonybrook Keystroke Patterns as Prosody in Digital Writings” of this data set. The algorithm has shown good results. On average, the accuracy was 99.5%.
Also, to improve this algorithm it will be possible to use a larger set date for training, which can increase the accuracy even more. Also, a modification of this algorithm is the collection of input characteristics on the keyboard during a visit to the site. This will increase the accuracy of data taken for the truth for the user. 12. Yong Sheng, Vir V. Phoha and Steven M. Rovnyak, A Parallel Decision Tree-Based Method for User Authentication Based on Keystroke Patterns‖, IEEE Transactions On Systems, Man, And Cybernetics – Part B: Cybernetics, vol. 35, No. 4, 2005, pp. 826-833 13. Alon Schclar, Lior Rokach, Adi Abramson, and Yuval Elovici, User Authentication Based on Representative Users‖, IEEE Transactions on systems, man, and cybernetics –part c: applications and reviews, vol. 42, №. 6, pp. 1669-1678, 2012. 14. Ting-Yi Chang, Dynamically generate a long-lived private key based on password keystroke features and neural network, Information Sciences 211, pp. 36-47, 2012. 15. Dychka, I., Tereikovskyi, I., Tereikovska, L., Pogorelov, V., Mussiraliyeva, S. Deobfuscation of computer virus malware code with value state dependence graph // Advances in Intelligent Systems and Computing. 2018. Vol. 754, pp 370-379. 16. Aitchanov, B., Korchenko, A., Tereykovskiy, I., Bapiyev, I. Perspectives for using classical neural network models and methods of counteracting attacks on network resources of information systems., News of the national academy of sciences of the republic of Kazakhstan series of geology and technical sciences. Vol. 5, № 425 (2017), pp. 202-212.