Behavioural biometrics: a survey and classification
---
paper_title: An Intrusion-Detection Model

paper_content:

A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.
---
paper_title: Learning Program Behavior Profiles for Intrusion Detection

paper_content:

Profiling the behavior of programs can be a useful reference for detecting potential intrusions against systems. This paper presents three anomaly detection techniques for profiling program behavior that evolve from memorization to generalization. The goal of monitoring program behavior is to be able to detect potential intrusions by noting irregularities in program behavior. The techniques start from a simple equality matching algorithm for determining anomalous behavior, and evolve to a feed-forward backpropagation neural network for learning program behavior, and finally to an Elman network for recognizing recurrent features in program execution traces. In order to detect future attacks against systems, intrusion detection systems must be able to generalize from past observed behavior. The goal of this research is to employ machine learning techniques that can generalize from past observed behavior to the problem of intrusion detection. The performance of these systems is compared by testing them with data provided by the DARPA Intrusion Detection Evaluation program.
---
paper_title: Performance evaluation of fingerprint verification systems

paper_content:

This paper is concerned with the performance evaluation of fingerprint verification systems. After an initial classification of biometric testing initiatives, we explore both the theoretical and practical issues related to performance evaluation by presenting the outcome of the recent fingerprint verification competition (FVC2004). FVC2004 was organized by the authors of this work for the purpose of assessing the state-of-the-art in this challenging pattern recognition application and making available a new common benchmark for an unambiguous comparison of fingerprint-based biometric systems. FVC2004 is an independent, strongly supervised evaluation performed at the evaluators' site on evaluators' hardware. This allowed the test to be completely controlled and the computation times of different algorithms to be fairly compared. The experience and feedback received from previous, similar competitions (FVC2000 and FVC2002) allowed us to improve the organization and methodology of FVC2004 and to capture the attention of a significantly higher number of academic and commercial organizations (67 algorithms were submitted for FVC2004). A new, "light" competition category was included to estimate the loss of matching performance caused by imposing computational constraints. This paper discusses data collection and testing protocols, and includes a detailed analysis of the results. We introduce a simple but effective method for comparing algorithms at the score level, allowing us to isolate difficult cases (images) and to study error correlations and algorithm "fusion." The huge amount of information obtained, including a structured classification of the submitted algorithms on the basis of their features, makes it possible to better understand how current fingerprint recognition systems work and to delineate useful research directions for the future.
---
paper_title: Biometrics: a grand challenge

paper_content:

Reliable person identification is an important problem in diverse businesses. Biometrics, identification based on distinctive personal traits, has the potential to become an irreplaceable part of any identification system. While successful in some niche markets, the biometrics technology has not yet delivered its promise of foolproof automatic identification. With the availability of inexpensive biometric sensors and computing power, it is becoming increasingly clear that widespread usage of biometric person identification is being stymied by our lack of understanding of three fundamental problems; (i) How to accurately and efficiently represent and recognize biometric patterns? (ii) How to guarantee that the sensed measurements are not fraudulent? and (iii) How to make sure that the application is indeed exclusively using pattern recognition for the expressed purpose (function creep (A. K. JAin et al., December 1998))? Solving these core problems will not only catapult biometrics into mainstream applications but will also stimulate adoption of other pattern recognition applications for providing effective automation of sensitive tasks without jeopardizing our individual freedoms. For these reasons, we view biometrics as a grand challenge - "a fundamental problem in science and engineering with broad economic and scientific impact".
---
paper_title: Detecting malicious software by monitoring anomalous windows registry accesses

paper_content:

We present a host-based intrusion detection system (IDS) for Microsoft Windows. The core of the system is an algorithm that detects attacks on a host machine by looking for anomalous accesses to the Windows Registry. The key idea is to first train a model of normal registry behavior on a windows host, and use this model to detect abnormal registry accesses at run-time. The normal model is trained using clean (attack-free) data. At run-time the model is used to check each access to the registry in real time to determine whether or not the behavior is abnormal and (possibly) corresponds to an attack. The system is effective in detecting the actions of malicious software while maintaining a low rate of false alarms
---
paper_title: Recent advances in biometric person authentication

paper_content:

Biometrics is an emerging topic in the field of signal processing. While technologies (e.g. audio, video) for biometrics have mostly been studied separately, ultimately, biometric technologies could find their strongest role as interwined and complementary pieces of a multi-modal authentication system. In this paper, a short overview of voice, fingerprint, and face authentication algorithms is provided.
---
paper_title: Anomaly detection using call stack information

paper_content:

The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from the call stack and effectively using it to detect exploits. In this paper we propose a new method to do anomaly detection using call stack information. The basic idea is to extract return addresses from the call stack, and generate an abstract execution path between two program execution points. Experiments show that our method can detect some attacks that cannot be detected by other approaches, while its convergence and false positive performance is comparable to or better than the other approaches. We compare our method with other approaches by analyzing their underlying principles and thus achieve a better characterization of their performance, in particular on what and why attacks will be missed by the various approaches.
---
paper_title: Biometric cryptosystems: issues and challenges

paper_content:

In traditional cryptosystems, user authentication is based on possession of secret keys; the method falls apart if the keys are not kept secret (i.e., shared with non-legitimate users). Further, keys can be forgotten, lost, or stolen and, thus, cannot provide non-repudiation. Current authentication systems based on physiological and behavioral characteristics of persons (known as biometrics), such as fingerprints, inherently provide solutions to many of these problems and may replace the authentication component of traditional cryptosystems. We present various methods that monolithically bind a cryptographic key with the biometric template of a user stored in the database in such a way that the key cannot be revealed without a successful biometric authentication. We assess the performance of one of these biometric key binding/generation algorithms using the fingerprint biometric. We illustrate the challenges involved in biometric key generation primarily due to drastic acquisition variations in the representation of a biometric identifier and the imperfect nature of biometric feature extraction and matching algorithms. We elaborate on the suitability of these algorithms for digital rights management systems.
---
paper_title: Storage-based Intrusion Detection: Watching storage activity for suspicious behavior

paper_content:

Storage-based intrusion detection allows storage systems to watch for data modifications characteristic of system intrusions. This enables storage systems to spot several common intruder actions, such as adding backdoors, inserting Trojan horses, and tampering with audit logs. Further, an intrusion detection system (IDS) embedded in a storage device continues to operate even after client systems are compromised. This paper describes a number of specific warning signs visible at the storage interface. Examination of 18 real intrusion tools reveals that most (15) can be detected based on their changes to stored files. We describe and evaluate a prototype storage IDS, embedded in an NFS server, to demonstrate both feasibility and efficiency of storage-based intrusion detection. In particular, both the performance overhead and memory required (152KB for 4730 rules) are minimal.
---
paper_title: Profiling Users in GUI Based Systems for Masquerade Detection

paper_content:

Masquerading or impersonation attack refers to the illegitimate activity on a computer system when one user impersonates another user. Masquerade attacks are serious in nature due to the fact that they are mostly carried by insiders and thus are extremely difficult to detect. Detection of these attacks is done by monitoring significant changes in user's behavior based on his/her profile. Currently, such profiles are based mostly on the user command line data and do not represent his/her complete behavior in a graphical user interface (GUI) based system and hence are not sufficient to quickly detect such masquerade attacks. In this paper, we present a new framework for creating a unique feature set for user behavior on GUI based systems. We have collected real user behavior data from live systems and extracted parameters to construct these feature vectors. These vectors contain user information such as mouse speed, distance, angles and amount of clicks during a user session. We model our technique of user identification and masquerade detection as a binary classification problem and use support vector machine (SVM) to learn and classify these feature vectors. We show that our technique can provide detection rates of up to 96% with few false positives based on these feature vectors. We have tested our technique with various feature vector parameters and conclude that these feature vectors can provide unique and comprehensive user behavior information and are powerful enough to detect masqueraders
---
paper_title: Neural data mining for credit card fraud detection

paper_content:

Due to a rapid advancement in the electronic commerce technology, use of credit cards has dramatically increased. As credit card becomes the most popular mode of payment, credit card frauds are becoming increasingly rampant in recent years. In this paper, we model the sequence of operations in credit card transaction processing using a confidence-based neural network. Receiver operating characteristic (ROC) analysis technology is also introduced to ensure the accuracy and effectiveness of fraud detection. A neural network is initially trained with synthetic data. If an incoming credit card transaction is not accepted by the trained neural network model (NNM) with sufficiently low confidence, it is considered to be fraudulent. This paper shows how confidence value, neural network algorithm and ROC can be combined successfully to perform credit card fraud detection.
---
paper_title: Indirect Human Computer Interaction-Based Biometrics for Intrusion Detection Systems

paper_content:

The indirect HCI-based biometrics are events that can be obtained by monitoring users' HCI behavior indirectly via observable low-level actions of computer software, those include records in audit logs, call-stack data, GUI interaction events, network traffic, registry access data, storage activity, and system calls. These low-level events are produced unintentionally by the user during interaction with different software applications during pursuit of some, potentially mischievous, high level goals. This paper concentrates on the review and analysis of indirect human computer interaction-based biometrics frequently used in intrusion detection systems. We conclude with an experimental demonstration of an intrusion detection system based on network traffic analysis as an example of application of indirect human computer interaction-based behavioral biometrics.
---
paper_title: Human Computer Interaction Based Intrusion Detection

paper_content:

In this paper we survey the state of the art in human computer interaction based biometrics which are based on abilities, style, preference, knowledge, or strategy used by people while working with a computer. We examine current research and analyze the types of features used to describe HCI behavior. After comparing accuracy rates for verification of users using different HCI-based biometric approaches we address privacy issues which arise with the use of HCI dependant biometrics. Finally, we present results of our experiments with behavior-based intrusion detection in online game networks based on the strategy utilized by the players
---
paper_title: State Transition Analysis: A Rule-Based Intrusion Detection Approach

paper_content:

A new approach to representing computer penetrations is introduced called penetration state transition analysis. This approach models penetrations as a series of state transitions described in terms of signature actions and state descriptions. State transition diagrams are written to correspond to the states of an actual computer system, and these diagrams form the basis of a rule-based expert system for detecting penetrations, referred to as STAT. >
---
paper_title: A survey of biometric recognition methods

paper_content:

Biometric recognition refers to an automatic recognition of individuals based on a feature vector (s) derived from their physiological and/or behavioral characteristic. Biometric recognition systems should provide a reliable personal recognition schemes to either confirm or determine the identity of an individual. Applications of such a system include computer systems security, secure electronic banking, mobile phones, credit cards, secure access to buildings, health and social services. By using biometrics a person could be identified based on "who she/he is" rather then "what she/he has" (card, token, key) or "what she/he knows" (password, PIN). In this paper, a brief overview of biometric methods, both unimodal and multimodal, and their advantages and disadvantages, will be presented.
---
paper_title: An introduction to biometric recognition

paper_content:

A wide variety of systems requires reliable personal recognition schemes to either confirm or determine the identity of an individual requesting their services. The purpose of such schemes is to ensure that the rendered services are accessed only by a legitimate user and no one else. Examples of such applications include secure access to buildings, computer systems, laptops, cellular phones, and ATMs. In the absence of robust personal recognition schemes, these systems are vulnerable to the wiles of an impostor. Biometric recognition, or, simply, biometrics, refers to the automatic recognition of individuals based on their physiological and/or behavioral characteristics. By using biometrics, it is possible to confirm or establish an individual's identity based on "who she is", rather than by "what she possesses" (e.g., an ID card) or "what she remembers" (e.g., a password). We give a brief overview of the field of biometrics and summarize some of its advantages, disadvantages, strengths, limitations, and related privacy concerns.
---
paper_title: User re-authentication via mouse movements

paper_content:

We present an approach to user re-authentication based on the data collected from the computer's mouse device. Our underlying hypothesis is that one can successfully model user behavior on the basis of user-invoked mouse movements. Our implemented system raises an alarm when the current behavior of user X, deviates sufficiently from learned "normal" behavior of user X. To learn a model of normal behavior we explore supervised learning (learn to discriminate among the behaviors of the k users of the computer). Our empirical results show that although individuals that use the same set of applications can be differentiated via their mouse behavior, analyzing mouse movements alone is not sufficient for a stand-alone intrusion detection system. We conclude that user re-authentication via mouse movements is the first line of defense in the hierarchical structure of an intrusion detection system.
---
paper_title: An Intrusion-Detection Model

paper_content:

A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.
---
paper_title: Detecting Fraud in Mobile Telephony Using Neural Networks

paper_content:

Our work focuses on: the problem of detecting unusual changes of consumption in mobile phone users, the corresponding building of data structures which represent the recent and historic users' behaviour bearing in mind the information included in a call, and the complexity of the construction of a function with so many variables where the parameterization is not always known.
---
paper_title: Enhancing Profiles for Anomaly Detection Using Time Granularities

paper_content:

Recently, association rules have been used to generate profiles of "normal" behavior for anomaly detection. However, the time factor (especially in terms of multiple time granularities) has not been utilized extensively in generation of these profiles. In reality, user behavior during different time intervals may be very different. For example, the "normal" number and duration of FTP connections may vary from working hours to midnight, from business day to weekend or holiday. Furthermore, these variations may depend on the day of the month or the week. This paper proposes to build profiles using temporal association rules in terms of multiple time granularities, and describes algorithms to discover these profiles. Because multiple time granularities are used for the profile generation, the proposed method is more flexible and precise than previous methods that use fixed partition of time intervals. Finally, the paper describes an experiment and its preliminary result on TCP-dump data.
---
paper_title: Smile and laughter recognition using speech processing and face recognition from conversation video

paper_content:

This paper describes a method to detect smiles and laughter sounds from the video of natural dialogue. A smile is the most common facial expression observed in a dialogue. Detecting a user's smiles and laughter sounds can be useful for estimating the mental state of the user of a spoken-dialogue-based user interface. In addition, detecting laughter sound can be utilized to prevent the speech recognizer from wrongly recognizing the laughter sound as meaningful words. In this paper, a method to detect smile expression and laughter sound robustly by combining an image-based facial expression recognition method and an audio-based laughter sound recognition method. The image-based method uses a feature vector based on feature point detection from face images. The method could detect smile faces by more than 80% recall and precision rate. A method to combine a GMM-based laughter sound recognizer and the image-based method could improve the accuracy of detection of laughter sounds compared with methods that use image or sound only. As a result, more than 70% recall and precision rate of laughter sound detection was obtained from the natural conversation videos
---
paper_title: Speaker identification by lipreading

paper_content:

This paper describes a new approach for speaker identification based on lipreading. Visual features are extracted from image sequences of the talking face and consist of shape parameters which describe the lip boundary and intensity parameters which describe the grey-level distribution of the mouth area. Intensity information is based on principal component analysis using eigenspaces which deform with the shape model. The extracted parameters account for both, speech dependent and speaker dependent information. We built spatio-temporal speaker models based on these features, using HMMs with mixtures of Gaussians. Promising results were obtained for text dependent and text independent speaker identification tests performed on a small video database.
---
paper_title: Finding the vocabulary of program behavior data for anomaly detection

paper_content:

Application-based anomaly detectors construct a base-line model of normal application behavior, and deviations from that behavior are interpreted as signs of a possible intrusion. But current anomaly detectors monitor application behavior at a high level of detail, and many irrelevant variations in that behavior can cause false alarms. This paper discusses the preprocessing of audit data ultimately used by application-based anomaly detection systems. The goal is to create a more abstract picture of program behavior filtering out many irrelevant details. Our specific approach automatically identifies repeating sub-sequences of behavior events and sequences of events that always occur together. The main benefit of this preprocessing technique can be used with a wide variety of program-based anomaly detectors, but we present empirical results showing how it improves the performance of the well-known stide anomaly detection system.
---
paper_title: Biometric personal identification based on handwriting

paper_content:

In this paper, we describe a new method to identify the writer of Chinese handwritten documents. There are many methods for signature verification or writer identification, but most of them require segmentation or connected component analysis. They are content dependent identification methods, as signature verification requires the writer to write the same text (e.g. his name). In our new method, we take the handwriting as an image containing some special texture, and writer identification is regarded as texture identification. This is a content independent method. We apply the well-established 2D Gabor filtering technique to extract features of such textures and a weighted Euclidean distance classifier to fulfil the identification task. Experiments are made using Chinese handwritings from 17 different people and very promising results were achieved.
---
paper_title: POLYMER THICK-FILM SENSORS: POSSIBILITIES FOR SMARTCARD BIOMETRICS

paper_content:

In this paper the potential of polymer thick-film sensors are assessed for use as biometric sensors on smartcards. Piezoelectric and piezoresistive sensors have been printed on flexible polyester, then bonded to smartcard blanks. The tactile interaction of a person with these sensors has been investigated. It was found that whilst piezoresistive films offer good dynamic and static sensing properties, the relative complexity of their measurement circuitry over that of piezoelectrics, favours the use of piezoelectric films in the smartcard arena. The outline of a novel biometric discrimination method is presented, for which an equal false-acceptance and false-rejection error rate of 2.3% is reported.
---
paper_title: Research on object-storage-based intrusion detection

paper_content:

Storage-based intrusion detection systems (IDS) can be valuable tools in monitoring for the intrusion on a host computer. However, because the traditional storage device works on the block-level while intrusion always happens on the file-level, this gap has to be erased by detection software, which is a hard and time-consuming task. To solve this problem and to accord with the trend of moving more processing power into storage, this paper presents a novel idea to design an IDS on object-based storage devices (OSD), and analyzes how the features of OSD can be used for intrusion detection (ID) and for violation responding. Moreover, the existing OSD standard is enhanced to own the new functions. Compared with the existing research on block-level storage devices, OSD-based ID is more straightforward for implementation. We build such a prototype based on the OSD reference implementation provided by Intel. Testing results show that the extra overhead introduced by ID is acceptable.
---
paper_title: Automatic Signature Verification and Writer Identification - The state of the art

paper_content:

Abstract This paper presents a survey of the literature on automatic signature verification and writer identification by computer, and an overview of achievements in static and dynamic approaches to solving these problems, with a special focus on preprocessing techniques, feature extraction methods, comparison processes and performance evaluation. In addition, for each type of approache special attention is given to requirement analysis, human factors, practical application environments, and appropriate definitions and terminology. Throughout the paper, new research directions are suggested.
---
paper_title: A data mining framework for building intrusion detection models

paper_content:

There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program.
---
paper_title: The Design and Analysis of Graphical Passwords

paper_content:

In this paper we propose and evaluate new graphical password schemes that exploit features of graphical input displays to achieve better security than text-based passwords. Graphical input devices enable the user to decouple the position of inputs from the temporal order in which those inputs occur, and we show that this decoupling can be used to generate password schemes with substantially larger (memorable) password spaces. In order to evaluate the security of one of our schemes, we devise a novel way to capture a subset of the "memorable" passwords that, we believe, is itself a contribution. In this work we are primarily motivated by devices such as personal digital assistants (PDAs) that offer graphical input capabilities via a stylus, and we describe our prototype implementation of one of our password schemes on such a PDA, namely the Palm PilotTM.
---
paper_title: Learning Program Behavior Profiles for Intrusion Detection

paper_content:

Profiling the behavior of programs can be a useful reference for detecting potential intrusions against systems. This paper presents three anomaly detection techniques for profiling program behavior that evolve from memorization to generalization. The goal of monitoring program behavior is to be able to detect potential intrusions by noting irregularities in program behavior. The techniques start from a simple equality matching algorithm for determining anomalous behavior, and evolve to a feed-forward backpropagation neural network for learning program behavior, and finally to an Elman network for recognizing recurrent features in program execution traces. In order to detect future attacks against systems, intrusion detection systems must be able to generalize from past observed behavior. The goal of this research is to employ machine learning techniques that can generalize from past observed behavior to the problem of intrusion detection. The performance of these systems is compared by testing them with data provided by the DARPA Intrusion Detection Evaluation program.
---
paper_title: Keystroke Analysis of Different Languages: A Case Study

paper_content:

Typing rhythms are one of the rawest form of data stemming from the interaction between humans and computers. When properly analyzed, they may allow to ascertain personal identity. In this paper we provide experimental evidence that the typing dynamics of free text can be used for user identification and authentication even when typing samples are written in different languages. As a consequence, we argue that keystroke analysis can be useful even when people may use different languages, in those areas where ascertaining personal identity is important or crucial, such as within Computer Security.
---
paper_title: Person authentication using ASM based lip shape and intensity information

paper_content:

An authentication system solely based on visual lip information is of advantage since the uttering characteristics/manner is unique to the individual and difficult to imitate. This paper presents a study of using lip shape-based and intensity features in person authentication. These features are derived from a 14-point active shape model (ASM) lip model with the use of principal component analysis (PCA). The differential change of the feature parameters reflecting the uttering characteristics are also considered in the study. A database containing the visual utterance of 40 speakers has been generated and each of the utterances is of duration 3 seconds. The visual features are then extracted from this database and a hidden Markov model (HMM) classifier is used to perform the analysis. It is observed that the best authentication result is obtained when the first 8 modes of the intensity profile is used together with the lip shaped-based parameters.
---
paper_title: Can soft biometric traits assist user recognition?

paper_content:

Biometrics is rapidly gaining acceptance as the technology that can meet the ever increasing need for security in critical applications. Biometric systems automatically recognize individuals based on their physiological and behavioral characteristics. Hence, the fundamental requirement of any biometric recognition system is a human trait having several desirable properties like universality, distinctiveness, permanence, collectability, acceptability, and resistance to circumvention. However, a human characteristic that possesses all these properties has not yet been identified. As a result, none of the existing biometric systems provide perfect recognition and there is a scope for improving the performance of these systems. Although characteristics like gender, ethnicity, age, height, weight and eye color are not unique and reliable, they provide some information about the user. We refer to these characteristics as "soft" biometric traits and argue that these traits can complement the identity information provided by the primary biometric identifiers like fingerprint and face. This paper presents the motivation for utilizing soft biometric information and analyzes how the soft biometric traits can be automatically extracted and incorporated in the decision making process of the primary biometric system. Preliminary experiments were conducted on a fingerprint database of 160 users by synthetically generating soft biometric traits like gender, ethnicity, and height based on known statistics. The results show that the use of additional soft biometric user information significantly improves (approximately 6%) the recognition performance of the fingerprint biometric system.
---
paper_title: Multimodal person recognition for human-vehicle interaction

paper_content:

The authors combine two different biometric modalities for next-generation vehicles that use biometric person recognition. Next-generation vehicles will undoubtedly feature biometric person recognition as part of an effort to improve the driving experience. Today's technology prevents such systems from operating satisfactorily under adverse conditions. A proposed framework for achieving person recognition successfully combines different biometric modalities, borne out in two case studies.
---
paper_title: Masquerade detection using truncated command lines

paper_content:

A masquerade attack, in which one user impersonates another, can be the most serious form of computer abuse. Automatic discovery of masqueraders is sometimes undertaken by detecting significant departures from normal user behavior, as represented by a user profile formed from system audit data. While the success of this approach has been limited, the reasons for its unsatisfying performance are not obvious, possibly because most reports do not elucidate the origins of errors made by the detection mechanisms. This paper takes as its point of departure a recent series of experiments framed by Schonlau et al. (2001). In extending that work with a new classification algorithm, a 56% improvement in masquerade detection was achieved at a corresponding false-alarm rate of 1.3%. A detailed error analysis, based on an alternative data configuration, reveals why some users are good masqueraders and others are not.
---
paper_title: Host-Based Intrusion Detection Using Dynamic and Static Behavioral Models

paper_content:

Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.
---
paper_title: Profiling Users in the UNIX OS Environment

paper_content:

This paper presents results obtained by using a method of profiling a user based on the login host, the login time, the command set, and the command set execution time of the profiled user. It is assumed that the user is logging onto a UNIX host on a computer network. The paper concentrates on two areas: short-term and long-term profiling. In short-term profiling the focus is on profiling the user at a given session where user characteristics do not change much. In long-term profiling, the duration of observation is over a much longer period of time. The latter is more challenging because of a phenomenon called concept or profile drift. Profile drift occurs when a user logs onto a host for an extended period of time (over several sessions).
---
paper_title: An Application of Symbolic Learning to Intrusion Detection: Preliminary Results from the LUS Methodology

paper_content:

The Laboratory's research activities are supported in part by the UMBC/LUCITE #32 grant, and in part by the National Science Foundation under Grants No. IIS-9906858 and ::: IIS-0097476.
---
paper_title: FABS: file and block surveillance system for determining anomalous disk accesses

paper_content:

Despite increasingly sophisticated security measures, attackers have continued to find ways to gain access to stored data with impacts including data disclosure, modification, or deletion. There currently exist no tools independent of the operating system to monitor storage status. The authors introduced FABS as a comprehensive tool to monitor storage for anomalous accesses. A scalable GUI prototype, VisFlowConnect-SS, which represents storage accesses visually to human operators, was also introduced. The goal is an integrated storage-based monitoring system that provides intrusion detection, minimizes attack damage, and assists with post-attack forensic analysis.
---
paper_title: Keystroke Biometric Recognition on Long-Text Input: A Feasibility Study

paper_content:

While most previous keystroke biometric studies dealt with short input like passwords, we focused on long-text input for applications such as identifying perpetrators of inappropriate e-mail or fraudulent Internet activity. A Java applet collected raw keystroke data over the Internet, appropriate long-text-input features were extracted, and a pattern classifier made identification decisions. Experiments focused on the system's usability under ideal conditions: copy task, long-text input (600 characters), same keyboard for enrollment and testing, and subjects aware of the nature of the study and instructed to type naturally. Essentially 100% identification accuracy was achieved on 8 subjects typing the same text. This accuracy decreased in going to 30 subjects, on copying different testing texts, and on progressively reducing the length of the testing text. In summary, we found the keystroke biometric effective for identifying up to 30 users inputting text under the following conditions: sufficient training and testing text length, sufficient number of enrollment samples, and same keyboard type used for enrollment and testing.
---
paper_title: Enhancing byte-level network intrusion detection signatures with context

paper_content:

Many network intrusion detection systems (NIDS) use byte sequences as signatures to detect malicious activity. While being highly efficient, they tend to suffer from a high false-positive rate. We develop the concept of contextual signatures as an improvement of string-based signature-matching. Rather than matching fixed strings in isolation, we augment the matching process with additional context. When designing an efficient signature engine for the NIDS bro, we provide low-level context by using regular expressions for matching, and high-level context by taking advantage of the semantic information made available by bro's protocol analysis and scripting language. Therewith, we greatly enhance the signature's expressiveness and hence the ability to reduce false positives. We present several examples such as matching requests with replies, using knowledge of the environment, defining dependencies between signatures to model step-wise attacks, and recognizing exploit scans.To leverage existing efforts, we convert the comprehensive signature set of the popular freeware NIDS snort into bro's language. While this does not provide us with improved signatures by itself, we reap an established base to build upon. Consequently, we evaluate our work by comparing to snort, discussing in the process several general problems of comparing different NIDSs.
---
paper_title: Application profiling of IP traffic

paper_content:

Application profiling is a critical step in QoS solution design of today's IP networks. To aggregate applications into QoS classes effectively, one has to know the key characteristics of the applications. This is needed to arrive at a QoS solution design that meets the QoS targets for all applications, while allowing for maximum use of the network link capacities. We collected NetFlow data at several locations on a corporate intranet and analyzed the data producing flow, packet and byte application breakdowns. For the most popular and bandwidth-consuming applications, we analyzed the stochastic characteristics like distributions of flow lengths, packet sizes, throughputs, etc. Our study reveals that the measured traffic composition does not vary much on a day-by-day basis, but that it can be very different from location to location. Therefore traffic measurements have to be collected at each congested link in the network, since singular measurements may lead to inaccurate assessments of the live traffic mix, resulting in ineffective QoS solution designs. Also, to account for changes in user behavior, in- or decrease of the user population and changes in the application mix, the process of traffic profiling should be repeated every 3-6 months.
---
paper_title: Acoustic-labial Speaker Verification

paper_content:

This paper describes a multimodal approach for speaker verification. The system consists of two classifiers, one using visual features and the other using acoustic features. A lip tracker is used to extract visual information from the speaking face which provides shape and intensity features. We describe an approach for normalizing and mapping different modalities onto a common confidence interval. We also describe a novel method for integrating the scores of multiple classifiers. Verification experiments are reported for the individual modalities and for the combined classifier. The performance of the integrated system outperformed each sub-system and reduced the false acceptance rate of the acoustic sub-system from 2.3% to 0.5%.
---
paper_title: User authentication through keystroke dynamics

paper_content:

Unlike other access control systems based on biometric features, keystroke analysis has not led to techniques providing an acceptable level of accuracy. The reason is probably the intrinsic variability of typing dynamics, versus other---very stable---biometric characteristics, such as face or fingerprint patterns. In this paper we present an original measure for keystroke dynamics that limits the instability of this biometric feature. We have tested our approach on 154 individuals, achieving a False Alarm Rate of about 4p and an Impostor Pass Rate of less than 0.01p. This performance is reached using the same sampling text for all the individuals, allowing typing errors, without any specific tailoring of the authentication system with respect to the available set of typing samples and users, and collecting the samples over a 28.8-Kbaud remote modem connection.
---
paper_title: Using an Active Shape Structural Model for Biometric Sketch Recognition

paper_content:

A deformable shape model called Active Shape Structural Model (ASSM) is used within a biometric framework to define a biometric sketch recognition algorithm. Experimental results show that mainly structural relations rather than statistical features can be used to recognize sketches of different users with high accuracy.
---
paper_title: Dynamic learning of automata from the call stack log for anomaly detection

paper_content:

Anomaly detection based on monitoring of sequences of system calls has proved to be an effective approach for detection of previously unknown attacks on programs. This paper describes a new model for profiling normal program behavior that can be used to detect intrusions that change application execution flow. The model (hybrid push down automaton, HPDA) incorporates call stack information and can be learned by dynamic analysis of training data captured from the call stack log. The learning algorithm uses call stack information maintained by the program to build a finite state automaton. When compared to other approaches including VtPath which also uses call stack information, the HPDA model produces a more compact and general representation of control flow, handles recursion naturally, can be learned with less training data, and has a lower false positive rate when used for anomaly detection. In addition, dynamic learning can also be used to supplement a model acquired from static analysis.
---
paper_title: Detecting malicious software by monitoring anomalous windows registry accesses

paper_content:

We present a host-based intrusion detection system (IDS) for Microsoft Windows. The core of the system is an algorithm that detects attacks on a host machine by looking for anomalous accesses to the Windows Registry. The key idea is to first train a model of normal registry behavior on a windows host, and use this model to detect abnormal registry accesses at run-time. The normal model is trained using clean (attack-free) data. At run-time the model is used to check each access to the registry in real time to determine whether or not the behavior is abnormal and (possibly) corresponds to an attack. The system is effective in detecting the actions of malicious software while maintaining a low rate of false alarms
---
paper_title: Anomaly detection using call stack information

paper_content:

The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from the call stack and effectively using it to detect exploits. In this paper we propose a new method to do anomaly detection using call stack information. The basic idea is to extract return addresses from the call stack, and generate an abstract execution path between two program execution points. Experiments show that our method can detect some attacks that cannot be detected by other approaches, while its convergence and false positive performance is comparable to or better than the other approaches. We compare our method with other approaches by analyzing their underlying principles and thus achieve a better characterization of their performance, in particular on what and why attacks will be missed by the various approaches.
---
paper_title: Adaptive Fraud Detection

paper_content:

One method for detecting fraud is to check for suspicious changes in user behavior. This paper describes the automatic design of user profiling methods for the purpose of fraud detection, using a series of data mining techniques. Specifically, we use a rule-learning program to uncover indicators of fraudulent behavior from a large database of customer transactions. Then the indicators are used to create a set of monitors, which profile legitimate customer behavior and indicate anomalies. Finally, the outputs of the monitors are used as features in a system that learns to combine evidence to generate high-confidence alarms. The system has been applied to the problem of detecting cellular cloning fraud based on a database of call records. Experiments indicate that this automatic approach performs better than hand-crafted methods for detecting fraud. Furthermore, this approach can adapt to the changing conditions typical of fraud detection environments.
---
paper_title: Long-Text Keystroke Biometric Applications over the Internet

paper_content:

Biometrics, the computer-based identification of an individual, is becoming increasingly essential due to the increasing demand for high-security systems. Accurate and effective keystroke biometric technology can help provide a major boost to the security of electronic commerce, and it can help curb identify theft. This dissertation focused on keystroke biometric applications operating over the Internet and requiring a text input of several hundred characters. These applications can help identify a perpetrator of inappropriate or fraudulent Internet activity, such as the sending of obscene or inappropriate email. The system developed contained three components. A Java applet collected the raw keystroke data over the Internet, a feature extractor calculated appropriate long-text measurements from the raw data, and a pattern classification system was trained to make the appropriate application-dependent decisions. Experimental results on the keystroke biometric system with 30 users under ideal conditions yielded recognition accuracy of 99.3% showing that our system is highly effective (our "System 3"). The ideal conditions were that a user types a predefined text (copy task) of approximately 600 characters and uses the same keyboard type for both training and testing. Classification accuracy as a function of input text length was also obtained to determine the text length needed to obtain the accuracy required for a particular application.
---
paper_title: Keystroke dynamics as a biometric for authentication

paper_content:

More than ever before the Internet is changing computing as we know it. Global access to information and resources is becoming an integral part of nearly every aspect of our lives. Unfortunately, with this global network access comes increased chances of malicious attack and intrusion. In an effort to confront the new threats unveiled by the networking revolution of the past few years reliable, rapid, and unintrusive means for automatically recognizing the identity of individuals are now being sought. In this paper we examine an emerging non-static biometric technique that aims to identify users based on analyzing habitual rhythm patterns in the way they type. ©2000 Elsevier Science B.V. All rights reserved.
---
paper_title: On gait as a biometric: Progress and prospects

paper_content:

There is increasing interest in automatic recognition by gait given its unique capability to recognize people at a distance when other biometrics are obscured. Application domains are those of any noninvasive biometric, but with particular advantage in surveillance scenarios. Its recognition capability is supported by studies in other domains such as medicine (biomechanics), mathematics and psychology which also suggest that gait is unique. Further, examples of recognition by gait can be found in literature, with early reference by Shakespeare concerning recognition by the way people walk. Many of the current approaches confirm the early results that suggested gait could be used for identification, and now on much larger databases. This has been especially influenced by DARPA's Human ID at a Distance research program with its wide scenario of data and approaches. Gait has benefited from the developments in other biometrics and has led to new insight particularly in view of covariates. Equally, gait-recognition approaches concern extraction and description of moving articulated shapes and this has wider implications than just in biometrics.
---
paper_title: Storage-based Intrusion Detection: Watching storage activity for suspicious behavior

paper_content:

Storage-based intrusion detection allows storage systems to watch for data modifications characteristic of system intrusions. This enables storage systems to spot several common intruder actions, such as adding backdoors, inserting Trojan horses, and tampering with audit logs. Further, an intrusion detection system (IDS) embedded in a storage device continues to operate even after client systems are compromised. This paper describes a number of specific warning signs visible at the storage interface. Examination of 18 real intrusion tools reveals that most (15) can be detected based on their changes to stored files. We describe and evaluate a prototype storage IDS, embedded in an NFS server, to demonstrate both feasibility and efficiency of storage-based intrusion detection. In particular, both the performance overhead and memory required (152KB for 4730 rules) are minimal.
---
paper_title: Grip-Pattern Recognition for Smart Guns

paper_content:

This paper describes the design, implementation and evaluation of a user-verification system for a smart gun, which is based on grip-pattern recognition. An existing pressure sensor consisting of an array of 44 x 44 piezoresistive elements has been used. An interface has been developed to acquire pressure images from the sensor. The values of the pixels in the pressure-pattern images are used as inputs for a verification algorithm, which is currently implemented in software on a computer. The verification algorithm is based on a likelihood-ratio classifier for Gaussian probability densities. First results indicate that it is possible to use grip-pattern recognition for biometric verification, when allowing a certain false-rejection and false-acceptance rate. However, more measurements are needed to give a more reliable indication of the systems performance.
---
paper_title: Information Fusion for Robust Speaker Verification

paper_content:

In this paper we have studied two information fusion approaches, namely feature vector concatenation and decision fusion, for the task of reducing error rates in a speaker verification system used in mismatched conditions. Three types of features are fused: Mel Frequency Cepstral Coefficients (MFCC), MFCC with Cepstral Mean Subtraction (CMS) and Maximum Auto-Correlation Values (MACV). We have used the mismatch sensitivity of Linear Prediction Cepstral Coefficients (LPCC) as a speech quality measure for selecting the weight of the contribution of the MFCC modality in the adaptive decision fusion approach. We show that in most cases concatenation fusion is superior to decision fusion. The results lead us to propose a hybrid fusion approach in which two combinations of concatenation fusion are further fused using adaptive decision fusion. The hybrid system is shown to have the lowest error rates on both clean and noisy speech.
---
paper_title: Biometric applications based on handwriting

paper_content:

A wide variety of biometric based techniques have been proposed but it is quite difficult to classify the approaches according to their application domains and to measure their functionality. Our intention is to classify today's applications in detail for one particular biometric scheme, handwriting. To give individual users with a specific application in mind orientation and a decision tool, we have built a new classification scheme and furthermore define major characteristics for each of the application classes as an evaluation matrix.
---
paper_title: Detecting Fraud in the Real World

paper_content:

Finding telecommunications fraud in masses of call records is more difficult than finding a needle in a haystack. In the haystack problem, there is only one needle that does not look like hay, the pieces of hay all look similar, and neither the needle nor the hay changes much over time. Fraudulent calls may be rare like needles in haystacks, but they are much more challenging to find. Callers are dissimilar, so calls that look like fraud for one account look like expected behavior for another, while all needles look the same. Moreover, fraud has to be found repeatedly, as fast as fraud calls are placed, the nature of fraud changes over time, the extent of fraud is unknown in advance, and fraud may be spread over more than one type of service. For example, calls placed on a stolen wireless telephone may be charged to a stolen credit card. Finding fraud is like finding a needle in a haystack only in the sense of sifting through masses of data to find something rare. This chapter describes some issues involved in creating tools for building fraud systems that are accurate, able to adapt to changing legitimate and fraudulent behavior, and easy to use.
---
paper_title: Profiling Users in GUI Based Systems for Masquerade Detection

paper_content:

Masquerading or impersonation attack refers to the illegitimate activity on a computer system when one user impersonates another user. Masquerade attacks are serious in nature due to the fact that they are mostly carried by insiders and thus are extremely difficult to detect. Detection of these attacks is done by monitoring significant changes in user's behavior based on his/her profile. Currently, such profiles are based mostly on the user command line data and do not represent his/her complete behavior in a graphical user interface (GUI) based system and hence are not sufficient to quickly detect such masquerade attacks. In this paper, we present a new framework for creating a unique feature set for user behavior on GUI based systems. We have collected real user behavior data from live systems and extracted parameters to construct these feature vectors. These vectors contain user information such as mouse speed, distance, angles and amount of clicks during a user session. We model our technique of user identification and masquerade detection as a binary classification problem and use support vector machine (SVM) to learn and classify these feature vectors. We show that our technique can provide detection rates of up to 96% with few false positives based on these feature vectors. We have tested our technique with various feature vector parameters and conclude that these feature vectors can provide unique and comprehensive user behavior information and are powerful enough to detect masqueraders
---
paper_title: Wide-area Internet traffic patterns and characteristics

paper_content:

The Internet is rapidly growing in number of users, traffic levels, and topological complexity. At the same time it is increasingly driven by economic competition. These developments render the characterization of network usage and workloads more difficult, and yet more critical. Few recent studies have been published reporting Internet backbone traffic usage and characteristics. At MCI, we have implemented a high-performance, low-cost monitoring system that can capture traffic and perform analyses. We have deployed this monitoring tool on OC-3 trunks within the Internet MCI's backbone and also within the NSF-sponsored vBNS. This article presents observations on the patterns and characteristics of wide-area Internet traffic, as recorded by MCI's OC-3 traffic monitors. We report on measurements from two OC-3 trunks in MCI's commercial Internet backbone over two time ranges (24-hour and 7-day) in the presence of up to 240,000 flows. We reveal the characteristics of the traffic in terms of packet sizes, flow duration, volume, and percentage composition by protocol and application, as well as patterns seen over the two time scales.
---
paper_title: A Markov Chain Model of Temporal Behavior for Anomaly Detection

paper_content:

This paper presents an anomaly detection technique to detect intrusions into computer and network systems. In this technique, a Markov chain model is used to represent a temporal profile of normal behavior in a computer and network system. The Markov chain model of the norm profile is learned from historic data of the system’s normal behavior. The observed behavior of the system is analyzed to infer the probability that the Markov chain model of the norm profile supports the observed behavior. A low probability of support indicates an anomalous behavior that may result from intrusive activities. The technique was implemented and tested on the audit data of a Sun Solaris system. The testing results showed that the technique clearly distinguished intrusive activities from normal activities in the testing data.
---
paper_title: Person authentication using lip information

paper_content:

This paper presents preliminary experimental results on a multimodal person authentication system, which uses lip information to improve the accuracy of a speaker recognition system. Speaker identification is performed on lip models generated from shape and intensity lip features. A novel scheme is proposed for selecting the best shape or intensity features to discriminate between speakers. Speaker classification is then performed using Gaussian mixture models.
---
paper_title: Anomaly Intrusion Detection Systems: Handling Temporal Relations Between Events

paper_content:

Lately, many approaches have been developed to discover computer abuse. Some of them use data mining techniques to discover anomalous behavior in audit trail, considering this behavior as an intrusive one. This paper discusses a temporal knowledge representation of users' behavior that is used by data mining tools to construct behavior patterns. These are used to decide whether current behavior follows a certain normal pattern or differs from all known users’ behavior patterns. The representation uses Allen's temporal interval algebra to describe the temporal relations between events caused by the user. Also we discuss how our representation is used to help in the concept drift when the set of training samples is reduced by removing old data which is no more used for classification.
---
paper_title: Digital Forensic Analysis of E-Mails: A Trusted E-Mail Protocol

paper_content:

E-mail has revolutionized business, academic, and personal communication The advantages of e-mail include speedy delivery, ease of communication, cost effectiveness, geographical independence, and the portability of mailboxes. The last two are the biggest advantages over snail mail. However, with e-mail comes the threat of a genuine user being compromised through key loggers, social engineering, shoulder surfing, password guessing and other similar, though less technical, methods. This passive espionage can have a direct impact on the genuine user in terms of denial of information, loss of money, loss of time, mental harassment and an attack of personal privacy. To enable digital forensic analysis of e-mails, we propose behavioral biometric based authentication, which is analogous to a signature in paper documents. In the proposed system, if someone other than a genuine user tries to authenticate himself, then detection and fixing is possible.
---
paper_title: Biometric verification based on grip-pattern recognition

paper_content:

This paper describes the design, implementation and evaluation of a user-verification system for a smart gun, which is based on grip-pattern recognition. An existing pressure sensor consisting of an array of 44 £ 44 piezoresistive elements is used to measure the grip pattern. An interface has been developed to acquire pressure images from the sensor. The values of the pixels in the pressure-pattern images are used as inputs for a verification algorithm, which is currently implemented in software on a PC. The verification algorithm is based on a likelihoodratio classifier for Gaussian probability densities. First results indicate that it is feasible to use grip-pattern recognition for biometric verification.
---
paper_title: Automated detection of vulnerabilities in privileged programs by execution monitoring

paper_content:

Presents a method for detecting exploitations of vulnerabilities in privileged programs by monitoring their execution using audit trails, where the monitoring is with respect to specifications of the security-relevant behavior of the programs. Our work is motivated by the intrusion detection paradigm, but is an attempt to avoid ad hoc approaches to codifying misuse behavior. Our approach is based on the observation that although privileged programs can be exploited (due to errors) to cause security compromises in systems because of the privileges accorded to them, the intended behavior of privileged programs is, of course, limited and benign. The key, then, is to specify the intended behavior (i.e. the program policy) and to detect any action by a privileged program that is outside the intended behavior and that imperils security. We describe a program policy specification language, which is based on simple predicate logic and regular expressions. In addition, we present specifications of privileged programs in Unix, and a prototype execution monitor for analyzing audit trails with respect to these specifications. The program policies are surprisingly concise and clear, and in addition, capable of detecting exploitations of known vulnerabilities in these programs. Although our work has been motivated by the known vulnerabilities in Unix, we believe that by tightly restricting the behavior of all privileged programs, exploitations of unknown vulnerabilities can be detected. As a check on the specifications, work is in progress on verifying them with respect to an abstract security policy. >
---
paper_title: Neural data mining for credit card fraud detection

paper_content:

Due to a rapid advancement in the electronic commerce technology, use of credit cards has dramatically increased. As credit card becomes the most popular mode of payment, credit card frauds are becoming increasingly rampant in recent years. In this paper, we model the sequence of operations in credit card transaction processing using a confidence-based neural network. Receiver operating characteristic (ROC) analysis technology is also introduced to ensure the accuracy and effectiveness of fraud detection. A neural network is initially trained with synthetic data. If an incoming credit card transaction is not accepted by the trained neural network model (NNM) with sufficiently low confidence, it is considered to be fraudulent. This paper shows how confidence value, neural network algorithm and ROC can be combined successfully to perform credit card fraud detection.
---
paper_title: On the Feasibility of Intrusion Detection inside Workstation Disks

paper_content:

Abstract : Storage-based intrusion detection systems (IDSs) can be valuable tools in monitoring for and notifying administrators of malicious software executing on a host computer, including many common intrusion tool kits. This paper makes a case for implementing IDS functionality in the firmware of workstations' locally attached disks, on which the bulk of important system files typically reside. To evaluate the feasibility of this approach, the authors built a prototype disk-based IDS into a SCSI disk emulator. Experimental results from this prototype indicate that it would indeed be feasible, in terms of CPU and memory costs, to include IDS functionality in low-cost desktop disk drives.
---
paper_title: Intrusion detection using variable-length audit trail patterns

paper_content:

Audit trail patterns generated on behalf of a Unix process canb e used to model the process behavior. Most of the approaches proposed so far use a table of fixed-length patterns to represent the process model. However, variable-length patterns seem to be more naturally suited to model the process behavior, but they are also more difficult to construct. In this paper, we present a novel technique to build a table of variable-length patterns. This technique is based on Teiresias, an algorithm initially developed for discovering rigid patterns in unaligned biological sequences. We evaluate the quality of our technique in a testbed environment, and compare it with the intrusion-detection system proposed by Forrest et al. [8], which is based on fixed-length patterns. The results achieved with our novel method are significantly better than those obtained with the original method based on fixed-length patterns.
---
paper_title: Source Code Authorship Analysis for Supporting the Cybercrime Investigation Process

paper_content:

Cybercrime has increased in severity and frequency in the recent years and because of this, it has become a major concern for companies, universities and organizations. The anonymity offered by the Internet has made the task of tracing criminal identity difficult. One study field that has contributed in tracing criminals is authorship analysis on e-mails, messages and programs. This paper contains a study on source code authorship analysis. The aim of the research efforts in this area is to identify the author of a particular piece of code by examining its programming style characteristics. Borrowing extensively from the existing fields of linguistics and software metrics, this field attempts to investigate various aspects of computer program authorship. Source code authorship analysis could be implemented in cases of cyber attacks, plagiarism and computer fraud. In this paper we present the set of tools and techniques used to achieve the goal of authorship identification, a review of the research efforts in the area and a new taxonomy on source code authorship analysis.
---
paper_title: Biometrics: Personal Identification in Networked Society

paper_content:

Biometrics: Personal Identification in Networked Society is a comprehensive and accessible source of state-of-the-art information on all existing and emerging biometrics: the science of automatically identifying individuals based on their physiological or behavior characteristics. In particular, the book covers: *General principles and ideas of designing biometric-based systems and their underlying tradeoffs *Identification of important issues in the evaluation of biometrics-based systems *Integration of biometric cues, and the integration of biometrics with other existing technologies *Assessment of the capabilities and limitations of different biometrics *The comprehensive examination of biometric methods in commercial use and in research development *Exploration of some of the numerous privacy and security implications of biometrics. Also included are chapters on face and eye identification, speaker recognition, networking, and other timely technology-related issues. All chapters are written by leading internationally recognized experts from academia and industry. Biometrics: Personal Identification in Networked Society is an invaluable work for scientists, engineers, application developers, systems integrators, and others working in biometrics.
---
paper_title: Software forensics: Can we track code to its authors?

paper_content:

Viruses, worms, trojan horses and crackers all exist and threaten the security of our computer systems. Often, we are aware of an intrusion only after it has occured. On some occasions, we may have a fragment of code left behind-used by an adversary to gain access or to damage the system. A natural question to ask is ''Can we use this remnant of code to identify the culprit or gain clues as to his identity?rd In this paper, we define the study of features of code remnants that might be analyzed to identify their authors. We further outline some of the difficulties involved in tracing an intruder by analyzing code. We conclude by discussing some future work that needs to be done before this approach can be more formally applied. We refer to our process as software forensics, similar to medical forensics: we are examining the remains to obtain evidence about the actors involved.
---
paper_title: Haptic: the new biometrics-embedded media to recognizing and quantifying human patterns

paper_content:

Authentication for the purposes of security has taken giant strides since the introduction of Biometrics to help identify people by their behavioral and physiological features. From organizations and corporations to educational institutes, electronic resources, and even crime scenes, Biometrics offers a wide application scope to detect fraud attempts. This paper proposes a research path to achieve the task of authenticating users that are working in a haptic-based environment. The field of Biometrics can be divided into two main classes of human features. Birth-given characteristics like fingerprints and facial features cannot be developed or altered by humans. Behavioral characteristics such as hand signature and voice fall into the second class [1]. The work presented in this paper pursues the latter class and specifically studies how a person reacts to using daily devices or tools. The fact that we can exploit people's habits in handling devices to detect identity was the hypothesis that motivated this work.
---
paper_title: Graphical Models for Driver Behavior Recognition in a SmartCar

paper_content:

In this paper we describe our SmartCar testbed: a real-time data acquisition system and a machine learning framework for modeling and recognizing driver maneuvers at a tactical level, with special emphasis on how the context affects the driver's performance. The perceptual input is multimodal: four video signals capture the contextual traffic, the driver's head and the driver's viewpoint; and a real-time data acquisition system records the car's brake, gear, steering wheel angle, speed and acceleration throttle signals. Over 70 drivers have driven the SmartCar for 1.25 hours in the greater Boston area. Graphical models, HMM and coupled HMM, have been trained using the experiment driving data to create models of seven different driver maneuvers: passing, changing lanes right and left, turning right and left, starting and stopping. We show that, on average, the predictive power of our models is of 1 second before the maneuver starts taking place. Therefore, these models would be essential to facilitate operating mode transitions between driver and driver assistance systems, to prevent potential dangerous situations and to create more realistic automated cars in car simulators.
---
paper_title: Anomaly Detection Based Intrusion Detection

paper_content:

This paper is devoted to the problem of neural networks as means of intrusion detection. We show that properly trained neural networks are capable of fast recognition and classification of different attacks. The advantage of the taken approach allows us to demonstrate the superiority of the neural networks over the systems that were created by the winner of the KDD Cups competition and later researchers due to their capability to recognize an attack, to differentiate one attack from another, i.e. classify attacks, and, the most important, to detect new attacks that were not included into the training set. The results obtained through simulations indicate that it is possible to recognize attacks that the intrusion detection system never faced before on an acceptably high level
---
paper_title: Multi-modal Person Recognition for Vehicular Applications

paper_content:

In this paper, we present biometric person recognition experiments in a real-world car environment using speech, face, and driving signals. We have performed experiments on a subset of the in-car corpus collected at the Nagoya University, Japan. We have used Mel-frequency cepstral coefficients (MFCC) for speaker recognition. For face recognition, we have reduced the feature dimension of each face image through principal component analysis (PCA). As for modeling the driving behavior, we have employed features based on the pressure readings of acceleration and brake pedals and their time-derivatives. For each modality, we use a Gaussian mixture model (GMM) to model each person's biometric data for classification. GMM is the most appropriate tool for audio and driving signals. For face, even though a nearest-neighbor-classifier is the preferred choice, we have experimented with a single mixture GMM as well. We use background models for each modality and also normalize each modality score using an appropriate sigmoid function. At the end, all modality scores are combined using a weighted sum rule. The weights are optimized using held-out data. Depending on the ultimate application, we consider three different recognition scenarios: verification, closed-set identification, and open-set identification. We show that each modality has a positive effect on improving the recognition performance.
---
paper_title: Automatic Identification of Participants in Haptic Systems

paper_content:

Biometric systems identify of users based on behavioral or physiological characteristics. This paper explores the feasibility of automatically identifying participants in haptic systems. Such a biometric system would lead to important and interesting applications such as continuous authentication in tele-operation. In order to test this feasibility, we designed a haptic system in which position, velocity, force and torque data from the tool was continuously measured and stored. Using this system, users navigated a simple maze where the user generates a continuous path from start to finish. Subsequently, several algorithms were developed to extract characteristic biometric features from the measured data. A 78.8% probability of verification was observed for data from trained users. Overall, the paper suggests the possibility of extracting identity information in a real world haptic system
---
paper_title: Speaker verification for multimedia application

paper_content:

In this paper the possibilities of modern speaker verification systems have been described. One of the most important tasks is a proper definition of feature vectors. The long-term spectra vector has been chosen as the background for text-independent verification system. The proposed method permits to compare specific features of the current speaker voice with the computer base containing stored vectors of known speakers. As the results, the distances between the vector of unknown person and the vectors of the persons inclined in the base have been obtained. The possibility of hardware realization of some voice processing components has been also discussed.
---
paper_title: Evaluating the security of handwriting biometrics

paper_content:

Ongoing interest in biometric security has resulted in much work on systems that exploit the individuality of human behavior. In this paper, we study the use of handwritten passphrases in the context of authentication or cryptographic key generation. We demonstrate that accurate generative models for a targeted user's handwriting can be developed based only on captured static (offline) samples combined with pen-stroke dynamics learned from general population statistics. Our work suggests that such automated attacks are nearly as effective as skilled human forgers and hence deserve serious consideration when evaluating the security of systems that use handwriting as a biometric.
---
paper_title: Investigation of neural network classification of computer network attacks

paper_content:

We investigate the neural network classification of computer network attacks using statistical anomaly detection, carried out by HIDE. HIDE is a hierarchical, multitier, multiobservation-window, anomaly based network intrusion detection system, prototyped in our laboratory for the US Army's Tactical Internet. HIDE monitors several network traffic parameters simultaneously, constructs a probability density function (PDF) for each, statistically compares it to a reference PDF of normal behavior using a similarity metric, then combines the results into an anomaly status vector that is classified by a neural network classifier. Many simulation experiments have been carried out focusing on the denial of service (DOS) class of attacks, including UDP, ICMP and TCP flooding attacks. We investigated the detection effectiveness of the perceptron (P), backpropagation (BP), perceptron-backpropagation-hybrid (PBH), fuzzy ARTMAP, and radial-based function (RBF) artificial neural network (ANN) classifiers. We present here results on several data sets from different UDP flooding scenarios. The results showed that the PBH and BP classifiers outperform all others. ICMP and TCP DOS attacks behave similarly to the UDP ones.
---
paper_title: Multifactor Biometric Sketch Authentication

paper_content:

In this paper we propose a multifactor biometric sketch authentication method based on biometric sketch recognition and a user's personal knowledge about the sketch's content, which is negotiated between the biometric authentication system and the user during enrollment. The used sketch recognition algorithm is based on the active shape structural model (ASSM) for analyzing the structural variability of sketches built up from a set of deformable shapes. For increasing the reliability of the biometric sketch authentication method the user's knowledge as authentication factor has been added by fulfilling specific sketching tasks of varying complexity given by the authentication system. An evaluation and testing framework for biometric algorithms was used to prove the accuracy of the method. For this purpose the biometric sketch algorithm has been adapted to the framework, a compiled sample database for comparability testing be- tween users has been generated, and attack classes ranging from none, over partial to complete knowledge about the user's sketch has been developed and used. The evaluation of the test results shows that particularly the user's knowledge as an added authentication factor leads the used sketch recognition algorithm to high accuracy.
---
paper_title: State Transition Analysis: A Rule-Based Intrusion Detection Approach

paper_content:

A new approach to representing computer penetrations is introduced called penetration state transition analysis. This approach models penetrations as a series of state transitions described in terms of signature actions and state descriptions. State transition diagrams are written to correspond to the states of an actual computer system, and these diagrams form the basis of a rule-based expert system for detecting penetrations, referred to as STAT. >
---
paper_title: Dataflow anomaly detection

paper_content:

Beginning with the work of Forrest et al, several researchers have developed intrusion detection techniques based on modeling program behaviors in terms of system calls. A weakness of these techniques is that they focus on control flows involving system calls, but not their arguments. This weakness makes them susceptible to several classes of attacks, including attacks on security-critical data, race-condition and symbolic link attacks, and mimicry attacks. To address this weakness, we develop a new approach for learning dataflow behaviors of programs. The novelty in our approach, as compared to previous system-call argument learning techniques, is that it learns temporal properties involving the arguments of different system calls, thus capturing the flow of security-sensitive data through the program. An interesting aspect of our technique is that it can be uniformly layered on top of most existing control-flow models, and can leverage control-flow contexts to significantly increase the precision of dataflows captured by the model. This contrasts with previous system-call argument learning techniques that did not leverage control-flow information, and moreover, were focused on learning statistical properties of individual system call arguments. Through experiments, we show that temporal properties enable detection of many attacks that aren't detected by previous approaches. Moreover, they support formal reasoning about security assurances that can be provided when a program follows its dataflow behavior model, e.g., tar would read only files located within a directory specified as a command-line argument.
---
paper_title: Automatic Authorship Attribution

paper_content:

In this paper we present an approach to automatic authorship attribution dealing with real-world (or unrestricted) text. Our method is based on the computational analysis of the input text using a text-processing tool. Besides the style markes relevant to the output of this tool we also use analysis-dependent style markers, that is, measures that represent the way in which the text has been processed. No word frequency counts, nor other lexically-based measures are taken into account. We show that the proposed set of style markers is able to distinguish texts of various authors of a weekly newspaper using multiple regression. All the experiments we present were performed using real-world text downloaded from the World Wide Web. Our approach is easily trainable and fully-automated requiring no manual text preprocessing nor sampling.
---
paper_title: Intrusion Detection Using Sequences of System Calls

paper_content:

A method is introduced for detecting intrusions at the level of privileged processes. Evidence is given that short sequences of system calls executed by running processes are a good discriminator between normal and abnormal operating characteristics of several common UNIX programs. Normal behavior is collected in two waysc Synthetically, by exercising as many normal modes of usage of a program as possible, and in a live user environment by tracing the actual execution of the program. In the former case several types of intrusive behavior were studieds in the latter case, results were analyzed for false positives.
---
paper_title: Passdoodles; a Lightweight Authentication Method

paper_content:

This paper investigates the use of unique finger traces, or doodles, as a means of authentication in a pervasive environment. Velocity here is investigated as means to uniquely identify a doodle. A blurred distribution grid created from combined training samples and the variance across this grid is also used for recognition. These three systems used together have produced accurate results for a population of ten users. The research presented here may have applications to hand writing and drawing recognition as well. 1 Lightweight Authentication Mechanisms New demands of authentication today are simplicity and effortlessness. Biometric technologies offer a partial solution but are be too robust for the relatively small issues such as personalization. Privacy concerns and trust also inhibit public acceptance due to the inextricable ties of biometric imprinting. The remainder of this paper discusses the design and implementation of a lightweight “passdoodle” system where a unique finger trace or doodle is used to quickly identify users in an integrated intelligent (or pervasive) computing environment. 1
---
paper_title: Computer Intrusion: Detecting Masquerades

paper_content:

.; . .. ... .... .. ......... .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - - - . .. .... ..... .... .... ..... .... .... ..... ..... .... ..... ..... .... .... ..... .... .... ..... ... :: .... ..... ..... .... ..... ..... .... .... ..... .... .... ..... .... .... ..... .... .... ..... .... .... ..... ..... .... ..... ..... . . . . . . . . . . . . . ......... . . . . . .. . . . ......... . . . . . . . . . . . . . . . . . . . . ....... .. . . . . . . . . . . . :.:.:. :.:.:.: : : : :-: -: :-: : : : : :-: :-:-: :- " .' ' . .." ' .." ' , .' ' , .'.'.'.' -, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . '' . . . . ........ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .:.:.:.:. :.: :-: ::-: :-:-: .. . . . . ... ..... . ..... .... .... ..... .... .... ..... ..... .... ..... ..... .... .... ..... .... .... ..... .... .... ..... ..... .... ..... ..... .... .... ..... .... .... ..... .... .... ..... .... .... ..... .... .... ..... ..... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .
---
paper_title: Detecting intrusions using system calls: alternative data models

paper_content:

Intrusion detection systems rely on a wide variety of observable data to distinguish between legitimate and illegitimate activities. We study one such observable-sequences of system calls into the kernel of an operating system. Using system-call data sets generated by several different programs, we compare the ability of different data modeling methods to represent normal behavior accurately and to recognize intrusions. We compare the following methods: simple enumeration of observed sequences; comparison of relative frequencies of different sequences; a rule induction technique; and hidden Markov models (HMMs). We discuss the factors affecting the performance of each method and conclude that for this particular problem, weaker methods than HMMs are likely sufficient.
---
paper_title: User re-authentication via mouse movements

paper_content:

We present an approach to user re-authentication based on the data collected from the computer's mouse device. Our underlying hypothesis is that one can successfully model user behavior on the basis of user-invoked mouse movements. Our implemented system raises an alarm when the current behavior of user X, deviates sufficiently from learned "normal" behavior of user X. To learn a model of normal behavior we explore supervised learning (learn to discriminate among the behaviors of the k users of the computer). Our empirical results show that although individuals that use the same set of applications can be differentiated via their mouse behavior, analyzing mouse movements alone is not sufficient for a stand-alone intrusion detection system. We conclude that user re-authentication via mouse movements is the first line of defense in the hierarchical structure of an intrusion detection system.
---
paper_title: Automated Biometrics

paper_content:

Identity verification becomes a challenging task wizen it has to be automated with high accuracy and nonrepudiability. Existing automatic verification methods such as passwords and credit cards are vulnerable to misuse and fraud. Automated biometrics-based attthentication methods soh, e these problems by providing a strong guarantee of the user's identity: In this tutorial, we present an overview of the fast-developing and excithzg area of automated biometrics. Several popular biometrics including fingerprint, face and iris are reviewed, and an introduction to accuracy evaluation methods is presented.
---
paper_title: Soft Biometric Traits for Personal Recognition Systems

paper_content:

Many existing biometric systems collect ancillary information like gender, age, height, and eye color from the users during enrollment. However, only the primary biometric identifier (fingerprint, face, hand-geometry, etc.) is used for recognition and the ancillary information is rarely utilized. We propose the utilization of “soft” biometric traits like gender, height, weight, age, and ethnicity to complement the identity information provided by the primary biometric identifiers. Although soft biometric characteristics lack the distinctiveness and permanence to identify an individual uniquely and reliably, they provide some evidence about the user identity that could be beneficial. This paper presents a framework for integrating the ancillary information with the output of a primary biometric system. Experiments conducted on a database of 263 users show that the recognition performance of a fingerprint system can be improved significantly (≈ 5%) by using additional user information like gender, ethnicity, and height.
---
paper_title: Intrusion detection via static analysis

paper_content:

One of the primary challenges in intrusion detection is modelling typical application behavior so that we can recognize attacks by their atypical effects without raising too many false alarms. We show how static analysis may be used to automatically derive a model of application behavior. The result is a host-based intrusion detection system with three advantages: a high degree of automation, protection against a broad class of attacks based on corrupted code, and the elimination of false alarms. We report on our experience with a prototype implementation of this technique.
---
paper_title: Person identification using automatic height and stride estimation

paper_content:

We present a parametric method to automatically identify people in monocular low-resolution video by estimating the height and stride parameters of their gait. Stride parameters (stride length and cadence) are functions of body height, weight, and gender Previous work has demonstrated an effective use of these biometrics for identification and verification of people. In this paper, we show that performance is significantly improved by using height as an additional discriminant feature. Height is estimated by segmenting the person from the background and fitting their apparent height to a time-dependent model. With a database of 45 people and 4 samples of each, we show that a person is correctly identified with 49% probability when using both height and stride parameters, compared with 21% when using stride parameters only. Height estimates for this configuration are accurate to within /spl sigma/=3.5 cm. This method works with low-resolution images of people, and is robust to changes in lighting, clothing, and tracking errors.
---
paper_title: Software forensics: Extending authorship analysis techniques to computer programs

paper_content:

Software forensics is the analysis of the syntactic, structural and semantic form of software in order to identify, characterise and discriminate between the authors of software products for some legal purpose. Determining software authorship may be important in several contexts: civil litigation involving allegations of software theft or plagiarism or apportioning liability for software failure; criminal litigation in relation to computer fraud or software attacks on computer systems using viruses and other similar means. Our focus is on forensic analysis of software source code, the structured English-like implementation of the algorithm selected to undertake the task at hand. We use a fictionalised version of a recent case to illustrate the potential of software forensics to provide evidence and also review in detail the judicial reception of such material.
---
paper_title: Detecting insider threats by monitoring system call activity

paper_content:

One approach to detecting insider misbehavior is to monitor system call activity and watch for danger signs or unusual behavior. We describe an experimental system designed to test this approach. We tested the system's ability to detect common insider misbehavior by examining file system and process-related system calls. Our results show that this approach can detect many such activities.
---
paper_title: Lip signatures for automatic person recognition

paper_content:

This paper evaluates lip features for person recognition, and compares the performance with that of the acoustic signal. Recognition accuracy is found to be equivalent in the two domains, agreeing with the findings of Chibelushi (1997). The optimum dynamic window length for both acoustic and visual modalities is found to be about 100 ms. Recognition performance of the upper lip is considerably better than the lower lip, achieving 15% and 35% identification error rates respectively, using a single digit test and training token.
---
paper_title: Learning users' interests by unobtrusively observing their normal behavior

paper_content:

For intelligent interfaces attempting to learn a user's interests, the cost of obtaining labeled training instances is prohibitive because the user must directly label each training instance, and few users are willing to do so. We present an approach that circumvents the need for human-labeled pages. Instead, we learn “surrogate” tasks where the desired output is easily measured, such as the number of hyperlinks clicked on a page or the amount of scrolling performed. Our assumption is that these outputs will highly correlate with the user's interests. In other words, by unobtrusively “observing” the user's behavior we are able to learn functions of value. For example, an intelligent browser could silently observe the user's browsing behavior during the day, then use these training examples to learn such functions and gather, during the middle of the night, pages that are likely to be of interest to the user. Previous work has focused on learning a user profile by passively observing the hyperlinks clicked on and those passed over. We extend this approach by measuring user mouse and scrolling activity in addition to user browsing activity. We present empirical results that demonstrate our agent can accurately predict some easily measured aspects of one's use of his or her browser.
---
paper_title: A digital technique for art authentication

paper_content:

We describe a computational technique for authenticating works of art, specifically paintings and drawings, from high-resolution digital scans of the original works. This approach builds a statistical model of an artist from the scans of a set of authenticated works against which new works then are compared. The statistical model consists of first- and higher-order wavelet statistics. We show preliminary results from our analysis of 13 drawings that at various times have been attributed to Pieter Bruegel the Elder; these results confirm expert authentications. We also apply these techniques to the problem of determining the number of artists that may have contributed to a painting attributed to Pietro Perugino and again achieve an analysis agreeing with expert opinion.
---
paper_title: Identification of humans using gait

paper_content:

We propose a view-based approach to recognize humans from their gait. Two different image features have been considered: the width of the outer contour of the binarized silhouette of the walking person and the entire binary silhouette itself. To obtain the observation vector from the image features, we employ two different methods. In the first method, referred to as the indirect approach, the high-dimensional image feature is transformed to a lower dimensional space by generating what we call the frame to exemplar (FED) distance. The FED vector captures both structural and dynamic traits of each individual. For compact and effective gait representation and recognition, the gait information in the FED vector sequences is captured in a hidden Markov model (HMM). In the second method, referred to as the direct approach, we work with the feature vector directly (as opposed to computing the FED) and train an HMM. We estimate the HMM parameters (specifically the observation probability B) based on the distance between the exemplars and the image features. In this way, we avoid learning high-dimensional probability density functions. The statistical nature of the HMM lends overall robustness to representation and recognition. The performance of the methods is illustrated using several databases.
---
paper_title: Recognizing song-based blink patterns: applications for restricted and universal access

paper_content:

We introduce a system for recognizing patterns of eye blinks for use in assistive technology interfaces and security systems. First, we present a blink-based interface for controlling devices. Well known songs are used as the cadence for the blinked patterns. Our system distinguishes between ten similar patterns with 99.0% accuracy. Second, we present a method for identifying individual people based on the characteristics of how they perform a specific pattern (their "blinkprint"). This technique could be used in conjunction with face recognition for security systems. We are able to distinguish between nine individuals with 82.02% accuracy based solely on how they blink the same pattern.
---
paper_title: Speaker recognition: A tutorial

paper_content:

A tutorial on the design and development of automatic speaker-recognition systems is presented. Automatic speaker recognition is the use of a machine to recognize a person from a spoken phrase. These systems can operate in two modes: to identify a particular person or to verify a person's claimed identity. Speech processing and the basic components of automatic speaker-recognition systems are shown and design tradeoffs are discussed. Then, a new automatic speaker-recognition system is given. This recognizer performs with 98.9% correct decalcification. Last, the performances of various systems are compared.
---
paper_title: Smile and laughter recognition using speech processing and face recognition from conversation video

paper_content:

This paper describes a method to detect smiles and laughter sounds from the video of natural dialogue. A smile is the most common facial expression observed in a dialogue. Detecting a user's smiles and laughter sounds can be useful for estimating the mental state of the user of a spoken-dialogue-based user interface. In addition, detecting laughter sound can be utilized to prevent the speech recognizer from wrongly recognizing the laughter sound as meaningful words. In this paper, a method to detect smile expression and laughter sound robustly by combining an image-based facial expression recognition method and an audio-based laughter sound recognition method. The image-based method uses a feature vector based on feature point detection from face images. The method could detect smile faces by more than 80% recall and precision rate. A method to combine a GMM-based laughter sound recognizer and the image-based method could improve the accuracy of detection of laughter sounds compared with methods that use image or sound only. As a result, more than 70% recall and precision rate of laughter sound detection was obtained from the natural conversation videos
---
paper_title: Speaker identification by lipreading

paper_content:

This paper describes a new approach for speaker identification based on lipreading. Visual features are extracted from image sequences of the talking face and consist of shape parameters which describe the lip boundary and intensity parameters which describe the grey-level distribution of the mouth area. Intensity information is based on principal component analysis using eigenspaces which deform with the shape model. The extracted parameters account for both, speech dependent and speaker dependent information. We built spatio-temporal speaker models based on these features, using HMMs with mixtures of Gaussians. Promising results were obtained for text dependent and text independent speaker identification tests performed on a small video database.
---
paper_title: Automatic singer recognition of popular music recordings via estimation and modeling of solo vocal signals

paper_content:

In this paper, we investigate the problem of automatic singer identification, detection and tracking in popular music recordings with one or multiple singers. This problem reflects an important issue in multimedia applications that require the transcription and indexing of music data to meet the increasing demand for content-based information retrieval. The major challenges for this study arise from the fact that a singer's voice tends to be arbitrarily altered from time to time and is inextricably intertwined with the signal of the background accompaniment. To determine who is singing, or whether or when a particular singer is present in a music recording, methods are presented for separating vocal from nonvocal regions, for isolating singers' vocal characteristics from background music, and for distinguishing singers from one another. Experimental evaluations conducted on a pop music database consisting of solo and duet tracks confirm the validity of the proposed methods.
---
paper_title: Acoustic-labial Speaker Verification

paper_content:

This paper describes a multimodal approach for speaker verification. The system consists of two classifiers, one using visual features and the other using acoustic features. A lip tracker is used to extract visual information from the speaking face which provides shape and intensity features. We describe an approach for normalizing and mapping different modalities onto a common confidence interval. We also describe a novel method for integrating the scores of multiple classifiers. Verification experiments are reported for the individual modalities and for the combined classifier. The performance of the integrated system outperformed each sub-system and reduced the false acceptance rate of the acoustic sub-system from 2.3% to 0.5%.
---
paper_title: Person authentication using lip information

paper_content:

This paper presents preliminary experimental results on a multimodal person authentication system, which uses lip information to improve the accuracy of a speaker recognition system. Speaker identification is performed on lip models generated from shape and intensity lip features. A novel scheme is proposed for selecting the best shape or intensity features to discriminate between speakers. Speaker classification is then performed using Gaussian mixture models.
---
paper_title: Biometrics: Personal Identification in Networked Society

paper_content:

Biometrics: Personal Identification in Networked Society is a comprehensive and accessible source of state-of-the-art information on all existing and emerging biometrics: the science of automatically identifying individuals based on their physiological or behavior characteristics. In particular, the book covers: *General principles and ideas of designing biometric-based systems and their underlying tradeoffs *Identification of important issues in the evaluation of biometrics-based systems *Integration of biometric cues, and the integration of biometrics with other existing technologies *Assessment of the capabilities and limitations of different biometrics *The comprehensive examination of biometric methods in commercial use and in research development *Exploration of some of the numerous privacy and security implications of biometrics. Also included are chapters on face and eye identification, speaker recognition, networking, and other timely technology-related issues. All chapters are written by leading internationally recognized experts from academia and industry. Biometrics: Personal Identification in Networked Society is an invaluable work for scientists, engineers, application developers, systems integrators, and others working in biometrics.
---
paper_title: Phoneme-less hierarchical accent classification

paper_content:

This paper introduces a novel accent classification method. Compared with existing methods, it has two unique features. First, it does not explicitly utilize phoneme information. Second, it is built on top of the gender classification. We have tested the proposed algorithm on datasets that are completely independent of training data. The accuracy of distinguishing American accent and British accent is 83%. We have also compared the accent classification with the gender classification in terms of accuracy and the saturation behavior with respect to length of utterance.
---
paper_title: Accent classification in speech

paper_content:

Apart form the word content and identity of a speaker; speech also conveys information about several soft biometric traits such as accent and gender. Accurate classification of these features can have a direct impact on present speech systems. An accent specific dictionary or word models can be used to improve accuracy of speech recognition systems. Gender and accent information can also be used to improve the performance of speaker recognition systems. In this paper, we distinguish between standard American English and Indian Accented English using the second and third formant frequencies of specific accent markers. A GMM classification is used on the feature set for each accent group. The results show that using just the formant frequencies of these accent markers is sufficient to achieve a suitable classification for these two accent groups.
---
paper_title: Lip signatures for automatic person recognition

paper_content:

This paper evaluates lip features for person recognition, and compares the performance with that of the acoustic signal. Recognition accuracy is found to be equivalent in the two domains, agreeing with the findings of Chibelushi (1997). The optimum dynamic window length for both acoustic and visual modalities is found to be about 100 ms. Recognition performance of the upper lip is considerably better than the lower lip, achieving 15% and 35% identification error rates respectively, using a single digit test and training token.
---
paper_title: The Problem of Concept Drift: Definitions and Related Work

paper_content:

Alexey Tsymbal Department of Computer Science Trinity College Dublin, Ireland tsymbalo@tcd.ie April 29, 2004 Abstract In the real world concepts are often not stable but change with time. Typical examples of this are weather prediction rules and customers’ preferences. The underlying data distribution may change as well. Often these changes make the model built on old data inconsistent with the new data, and regular updating of the model is necessary. This problem, known as concept drift, complicates the task of learning a model from data and requires special approaches, different from commonly used techniques, which treat arriving instances as equally important contributors to the final concept. This paper considers different types of concept drift, peculiarities of the problem, and gives a critical review of existing approaches to the problem. 1. Definitions and peculiarities of the problem A difficult problem with learning in many real-world domains is that the concept of interest may depend on some hidden context, not given explicitly in the form of pre-dictive features. A typical example is weather prediction rules that may vary radically with the season. Another example is the patterns of customers’ buying preferences that may change with time, depending on the current day of the week, availability of alter-natives, inflation rate, etc. Often the cause of change is hidden, not known a priori, making the learning task more complicated. Changes in the hidden context can induce more or less radical changes in the target concept, which is generally known as con-cept drift (Widmer and Kubat, 1996). An effective learner should be able to track such changes and to quickly adapt to them. A difficult problem in handling concept drift is distinguishing between true concept drift and noise. Some algorithms may overreact to noise, erroneously interpreting it as concept drift, while others may be highly robust to noise, adjusting to the changes too slowly. An ideal learner should combine robustness to noise and sensitivity to concept drift (Widmer and Kubat, 1996). In many domains, hidden contexts may be expected to recur. Recurring contexts may be due to cyclic phenomena, such as seasons of the year or may be associated with irregular phenomena, such as inflation rates or market mood (Harries and Sam-mut, 1998). In such domains, in order to adapt more quickly to concept drift, concept
---
paper_title: Biometrics: Personal Identification in Networked Society

paper_content:

Biometrics: Personal Identification in Networked Society is a comprehensive and accessible source of state-of-the-art information on all existing and emerging biometrics: the science of automatically identifying individuals based on their physiological or behavior characteristics. In particular, the book covers: *General principles and ideas of designing biometric-based systems and their underlying tradeoffs *Identification of important issues in the evaluation of biometrics-based systems *Integration of biometric cues, and the integration of biometrics with other existing technologies *Assessment of the capabilities and limitations of different biometrics *The comprehensive examination of biometric methods in commercial use and in research development *Exploration of some of the numerous privacy and security implications of biometrics. Also included are chapters on face and eye identification, speaker recognition, networking, and other timely technology-related issues. All chapters are written by leading internationally recognized experts from academia and industry. Biometrics: Personal Identification in Networked Society is an invaluable work for scientists, engineers, application developers, systems integrators, and others working in biometrics.
---
paper_title: Adaptation to drifting user’s interests

paper_content:

In recent years, many systems have been developed which aim at helping users to find pieces of information or other objects that are in accordance with their personal interests. In these systems, machine learning methods are often used to acquire the user interest profile. Frequently user interests drift with time. The ability to adapt fast to the current user's interests is an important feature for recommender systems. This paper presents a method for dealing with drifting interests by introducing the notion of gradual forgetting. Thus, the last observations should be more "important" for the learning algorithm than the old ones and the importance of an observation should decrease with time. The conducted experiments with a recommender system show that the gradual forgetting improves the ability to adapt to drifting user's interests. Experiments with the STAGGER problem provide additional evidences that gradual forgetting is able to improve the prediction accuracy on drifting concepts (incl. drifting user's interests).
---
paper_title: An introduction to biometric recognition

paper_content:

A wide variety of systems requires reliable personal recognition schemes to either confirm or determine the identity of an individual requesting their services. The purpose of such schemes is to ensure that the rendered services are accessed only by a legitimate user and no one else. Examples of such applications include secure access to buildings, computer systems, laptops, cellular phones, and ATMs. In the absence of robust personal recognition schemes, these systems are vulnerable to the wiles of an impostor. Biometric recognition, or, simply, biometrics, refers to the automatic recognition of individuals based on their physiological and/or behavioral characteristics. By using biometrics, it is possible to confirm or establish an individual's identity based on "who she is", rather than by "what she possesses" (e.g., an ID card) or "what she remembers" (e.g., a password). We give a brief overview of the field of biometrics and summarize some of its advantages, disadvantages, strengths, limitations, and related privacy concerns.
---
paper_title: Dynamic Recommendations In Internet Retailing

paper_content:

With current projections regarding the growth of Internet sales, online retailing raises many questions about how to market on the Net. While convenience impels consumers to purchase items on the web, quality remains a significant factor in deciding where to shop online. The competition is increasing and personalization is considered to be the competitive advantage that will determine the winners in the market of online shopping in the following years. Recommender systems are a means of personalizing a site and a solution to the customer’s information overload problem. As such, many e-commerce sites already use them to facilitate the buying process. In this paper we study the application of recommender systems for electronic retail sites, focusing on the peculiar characteristics and requirements of this environment. We also introduce a hybrid model supporting dynamic recommendations, which eliminates the problems the underlying techniques have when applied solely. We then discuss the application of the proposed solution in the case of an innovative research project on electronic retailing funded by the European Commission and conclude with some ideas for further development and research in this area.
---
paper_title: A Framework for Personal Web Usage Mining.

paper_content:

In this paper, we propose to mine Web usage data on client side, or personal Web usage mining, as a complement to the server side Web usage mining. By mining client side Web usage data, more complete knowledge about Web usage can be obtained. A framework for personal Web usage mining is proposed. Some related issues and applications of personal Web usage mining
---
paper_title: Accuracy performance analysis of multimodal biometrics

paper_content:

Since biometrics may be used to ensure that a person accessing information is authorized to do so, interest in biometrics for information assurance has increased recently. New biometric applications are constantly being announced while at the same time new spoofing technology is being developed to defeat them. One approach to overcoming the problem of spoofing is the use of multimodal biometric fusion. Most current research is focused on overcoming the deficiencies of a single biometric trait or reducing the false acceptance rate, both without any emphasis on the false rejection rate. Multimodal biometric fusion combines measurements from different biometric traits to enhance the strengths and diminish the weaknesses of the individual measurements. We investigate two types of errors associated with biometrics. The accuracy is analyzed for multimodal biometric systems utilizing two commonly used fusion rules. The purpose of the study is to provide a theoretical evaluation for the false acceptance and the false rejection rates to improve the accuracy as well as the convenience of biometric applications.
---
paper_title: Learning users' interests by unobtrusively observing their normal behavior

paper_content:

For intelligent interfaces attempting to learn a user's interests, the cost of obtaining labeled training instances is prohibitive because the user must directly label each training instance, and few users are willing to do so. We present an approach that circumvents the need for human-labeled pages. Instead, we learn “surrogate” tasks where the desired output is easily measured, such as the number of hyperlinks clicked on a page or the amount of scrolling performed. Our assumption is that these outputs will highly correlate with the user's interests. In other words, by unobtrusively “observing” the user's behavior we are able to learn functions of value. For example, an intelligent browser could silently observe the user's browsing behavior during the day, then use these training examples to learn such functions and gather, during the middle of the night, pages that are likely to be of interest to the user. Previous work has focused on learning a user profile by passively observing the hyperlinks clicked on and those passed over. We extend this approach by measuring user mouse and scrolling activity in addition to user browsing activity. We present empirical results that demonstrate our agent can accurately predict some easily measured aspects of one's use of his or her browser.
---

Title: Behavioural Biometrics: A Survey and Classification

Section 1: Introduction
Description 1: Introduce the need and advantages of behavioural biometrics and provide an overview of the various categories.

Section 2: Behavioural Biometrics
Description 2: Present short overviews of the most researched behavioural biometrics listed in alphabetical order.

Section 3: Generalised Algorithm
Description 3: Describe a generalised algorithm for behavioural biometrics, outlining its steps and the statistical properties used for similarity measurement.

Section 4: Comparison and Analysis
Description 4: Analyze behavioural biometrics using seven properties of good biometrics and discuss the ethical and privacy concerns related to behavioural profiles.

Section 5: Applications
Description 5: Discuss the various applications of behavioural biometrics in different fields such as security, personalised education, user modelling, criminal profiling, and more.

Section 6: Conclusions
Description 6: Summarize the survey, discuss promising emerging areas in behavioural biometrics, and suggest directions for future research.