This document proposes a hybrid authentication system that uses both short-term and long-term user behavior modeling. It extracts multiple unique features from a user's recent behavior and stores them in models. An ensemble classifier analyzes the features to authenticate the user. If the recent behavior is consistent with both models, authentication is granted without credentials. Otherwise, credentials are requested. Experimental results show the system can accurately model two users' daily calling and location patterns over time for authentication.

1. Hybrid Authentication
KIANOOSH MOKHTARIAN
MOHAMMAD-SADEGH FARAJI

2. Introduction
 Authentication
 Explicit
 Implicit
 Previous works
 Biometric authentication
 Regarding individual elements
 Mostly using a modeling method
 Try to authenticate users by characteristics

3. System Architecture
Recent user behavior
User model Authentication
Learning
Algorithm module
O
u
t
User credential p
u
t

4. Intuition for our work
 A combination of characteristics is unique
 Combination of characteristics is not forgeable
 Short-term behavior sometimes differs dramatically
from long-term one.
 Short term behavior modeling should store more
details
 Leveraging multiple user behavior modeling
 Short term user behavior ought to be considered
periodically not event driven

5. Algorithm
I: recent user behavior
If I is similar short term user behavior and does not
violate long term behavior
update both
If I is similar to long term behavior and does not
violate short term user behavior
update both
Else
ask for credential

6. Modeling
 All features are independent
 Each feature is considered as a random variable
 Score is calculated independently for each feature
 An ensemble classifier will decide based on these
score
 Gaussian Mixture Model for GPS
 Bayesian belief network for long term modeling
 K-nearest neighbor for short term modeling

7. Short term modeling
Store all input data in7the training set
For each pattern in the test set
Search for the K nearest patterns to the
input pattern using a Euclidean distance
measure
For classification, compute the confidence for
each class as Ci /K,
(where Ci is the number of patterns among the
K nearest patterns belonging to class i.)
The classification for the input pattern is the
class with the highest confidence.

8. Ensemble Classifier
8
Original
D Training data
Step 1:
Create Multiple D1 D2 .... Dt-1 Dt
Data Sets
Step 2:
Build Multiple C1 C2 Ct -1 Ct
Classifiers
Step 3:
Combine C*
Classifiers

9. Evaluation
 Training period
 Store features over a week and detemine user model
 Call pattern over time
 Authentication phase
 Calculate authentication score over last few hours and figure
delta= f- fp
 If delta is acceptable, update probabilty density function from
last few hours
 Else reject the request

10. User modeling experiment
7 User 1
6
5
4 8:00 AM
9:00 AM
10:00 AM
3
11:00 AM
12:00 PM
2
1
0
Satureday Sunday Monday Tuesday Wendneseday Thurseday Friday

11. User modeling experiment
8
7
User 2
6
5
4 8:00 AM
9:00 AM
3
10:00 AM
2 11:00 AM
1 12:00 PM
0

12. Authentication score - Calls
Score
0.8
0.7
0.6
0.5
0.4
User 1 Score
0.3
0.2 User 2
0.1
0
8:00 AM 9:00 AM 10:00 AM 11:00 AM 12:00 PM

13. Authentication score - GPS
Score
1
0.9
0.8
0.7
0.6
0.5
User 1 Score
0.4
0.3 User 2
0.2
0.1
0
8:00 AM 9:00 AM 10:00 AM 5:00 PM

14. User behavior modeling
1.2
1
0.8
0.6
0.4
0.2
0
0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 5.5 6 6.5 7 7.5 8 8.5 9 9.5 10