Does Your Phone Know Your Touch?

In this paper, we consider the problem of distinguishing between authorized and unauthorized touchscreen and smart phone device users by leveraging a learned gesture classification profile combined with gesture anomaly detection. As touchscreen devices become more ubiquitous and the information stored within them becomes increasingly personal and valuable, the incentive and reward for circumventing existing security mechanisms has increased substantially. Given known vulnerabilities in existing biometric and non-biometric authentication methods such as fingerprint scanners, facial recognition, tokens, and pass codes; the development of an effective authentication approach that goes beyond the'something you know / have / are' paradigm is needed. In this paper, we propose models that accurately predict users based on touchscreen gesture patterns and detect anomalies in these patterns as a versatile approach to augment existing security methods and provide a method of continuous authentication. Touchscreen gesture are collected from a set of users from a capacitive sensor array to simulate a smart phone. Features include the pressure measured at the two dimensional (X,Y) coordinates on the sensor for each gesture, velocity at different instances of the gesture, and the duration of the gesture. We then demonstrate how logistic regression, support vector machines (SVM), and multiple Gaussian processes can be used to classify and predict the user creating the gesture. Our intent is to determine the extent to which supervised and unsupervised learning approaches can be successfully leveraged across multiple domains to limit the impact of unauthorized touchscreen device usage, quantify touchscreen security weaknesses and vulnerabilities, and potentially inform touchscreen device security design. Scenarios where our analysis may be useful include high security use cases where continuous authentication is required in the finance, transportation, public safety sectors.