Time Intervals as a Behavioral Biometric John (Vinnie) Monaco - PowerPoint PPT Presentation

Introduction Data Modeling Conclusions Time Intervals as a Behavioral Biometric John (Vinnie) Monaco Seidenberg School of CSIS, Pace University November 11, 2015 http://vmonaco.com/dissertation John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Modeling Conclusions Outline Introduction 1 Motivation Background Data 2 Description Empirical patterns Modeling 3 Model specification Experimental results Conclusions 4 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions “You are what when you eat” John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Newell’s time scale. Newell’s time scale of human action Scale Time World System (sec) Units (theory) 10 7 Months SOCIAL 10 6 Weeks BAND 10 5 Days 10 4 Hours Task RATIONAL 10 3 10 min Task BAND 10 2 Minutes Task 10 1 10 sec Unit task COGNITIVE 10 0 1 sec Operations BAND 10 -1 100 ms Deliberate act 10 -2 10 ms Neural circuit BIOLOGICAL 10 -3 1 ms Neuron BAND 10 -4 100 µ s Organelle John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Behavioral biometrics. The measure of human behavior for the purpose of identification or verification. John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Timestamped events and time intervals. Timestamped events: keystrokes, touchscreen gestures, financial transactions, source code contributions... Given a series of events that occur at times t 0 , t 1 ,..., t N Time interval between events τ n = t n − t n − 1 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Outline Introduction 1 Motivation Background Data 2 Description Empirical patterns Modeling 3 Model specification Experimental results Conclusions 4 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Why focus on timestamps? Timestamps are truly ubiquitous Timestamps are persistent Timestamps are resilient to encryption and masking Timestamps can generally be collected without cooperation Timestamps can be incorporated into domain-specific models John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Problems. Identification Given a sequence of events, decide who they belong to (1 out of N) Verification Given a sequence of events with claimed responsibility, decide whether the claim is legitimate (binary classification) Prediction Given a sequence of events, predict the time of a future event John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Outline Introduction 1 Motivation Background Data 2 Description Empirical patterns Modeling 3 Model specification Experimental results Conclusions 4 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Bursts of activity in human behavior. Random process (Poisson process, exponential inter-event times) Bursty process (power-law inter-event times) Barabasi, 2005 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Time intervals of a random vs. bursty process. Random process Bursty process Barabasi, 2005 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Psychology of human timing. Implicit and explicit timing John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Motivation Modeling Background Conclusions Neurophysiology of human timing. Praamstra, 2006 Wiener, 2011 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Outline Introduction 1 Motivation Background Data 2 Description Empirical patterns Modeling 3 Model specification Experimental results Conclusions 4 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Datasets. Dataset Source Size Freq.(Hz) Keystroke fixed-text Monaco et al. (2013) 24k keystrokes, 60 users 4 . 4 Keystroke free-text Villani et al. (2006) 251k keystrokes, 56 users 3 . 8 Mobile Jain et al. (2014) 11k gestures, 52 users 3 . 1 Keypad Bakelman et al. (2013) 6.6k keystrokes, 30 users 2 . 9 2 . 8 × 10 − 4 Bitcoin transactions Reid et al. (2013) 239k transactions, 61 users 2 . 6 × 10 − 6 Linux kernel commits Passos et al. (2014) 16k commits, 52 authors 1 . 4 × 10 − 6 White House visits Hudson (2015) 2.7k visits, 18 people 2 . 8 × 10 − 7 Terrorist events LaFree et al. (2007) 1.8k events, 10 groups John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Keystroke. Non-overlapping and overlapping keystrokes John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Bitcoin transaction. John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Terrorist activity. John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Outline Introduction 1 Motivation Background Data 2 Description Empirical patterns Modeling 3 Model specification Experimental results Conclusions 4 John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Heavy tails. 10 0 10 0 10 0 P ( τ ) 10 − 1 10 − 1 10 − 1 Keystroke (fixed) Keystroke (free) Bitcoin 10 − 2 10 − 2 10 − 2 10 1 10 2 10 3 10 4 10 1 10 2 10 3 10 4 10 5 10 1 10 2 10 3 10 4 10 5 τ τ τ 10 0 10 0 10 0 P ( τ ) 10 − 1 10 − 1 10 − 1 Kernel commits White House visits Terrorist activity 10 − 2 10 − 2 10 − 2 10 0 10 1 10 2 10 1 10 2 10 3 10 4 10 5 10 6 10 0 10 1 10 2 10 3 10 4 τ τ τ John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Preference for a log-normal. Power law vs log-normal loglikelihood ratio tests Dataset Power law Log-normal Keystroke (free) 0.00 (0.00) 1.00 (1.00) Keystroke (fixed) 0.00 (0.00) 1.00 (1.00) Bitcoin 0.00 (0.00) 1.00 (1.00) Kernel commits 0.75 (0.56) 0.25 (0.08) White House visits 0.00 (0.00) 1.00 (1.00) Terrorist activity 0.70 (0.20) 0.30 (0.00) John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Time dependence. 2 . 0 2 . 0 2 . 0 Bitcoin Keystroke (fixed) Keystroke (free) 1 . 5 1 . 5 1 . 5 Density Density Density 1 . 0 1 . 0 1 . 0 0 . 5 0 . 5 0 . 5 0 . 0 0 . 0 0 . 0 0 . 0 0 . 2 0 . 4 0 . 6 0 . 8 1 . 0 0 . 0 0 . 2 0 . 4 0 . 6 0 . 8 1 . 0 00:00 06:00 12:00 18:00 24:00 Time of word Time of word Time of day 0 . 30 0 . 30 0 . 30 Kernel commits White House visits Terrorist activity 0 . 25 0 . 25 0 . 25 0 . 20 0 . 20 0 . 20 Density Density Density 0 . 15 0 . 15 0 . 15 0 . 10 0 . 10 0 . 10 0 . 05 0 . 05 0 . 05 0 . 00 0 . 00 0 . 00 M T W Th F Sa Su M T W Th F Sa Su M T W Th F Sa Su Day of week Day of week Day of week John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Non-stationarity. 6 6 Keystroke (fixed) Keystroke (free) Bitcoin 4 Predict sample Predict sample Predict sample 5 5 3 4 4 3 3 2 2 2 1 1 1 1 2 3 4 1 2 3 4 5 6 1 2 3 4 5 6 Train sample Train sample Train sample Kernel commits White House visits Terrorist activity 4 4 4 Predict sample Predict sample Predict sample 3 3 3 2 2 2 1 1 1 1 2 3 4 1 2 3 4 1 2 3 4 Train sample Train sample Train sample John (Vinnie) Monaco Time Intervals as a Behavioral Biometric

Introduction Data Description Modeling Empirical patterns Conclusions Temporal clustering. 10 2 10 2 10 2 Bitcoin Keystroke (fixed) Keystroke (free) 10 1 10 1 10 1 AF ( T ) 10 0 10 0 10 0 10 − 1 10 − 1 10 − 1 10 0 10 1 10 2 10 3 10 4 10 2 10 3 10 4 10 5 10 6 10 3 10 4 10 5 10 6 10 7 T (millisecond) T (millisecond) T (second) 10 2 10 2 10 2 Kernel commits White House visits Terrorist activity 10 1 10 1 10 1 AF ( T ) 10 0 10 0 10 0 10 − 1 10 − 1 10 − 1 10 − 5 10 − 4 10 − 3 10 − 2 10 − 1 10 − 3 10 − 2 10 − 1 10 − 5 10 − 4 10 − 3 10 − 2 10 − 1 10 0 10 1 T (hour) T (day) T (day) John (Vinnie) Monaco Time Intervals as a Behavioral Biometric