Pointing device biometrics continuous user authentication

Patent metadata

Field	Value
Publication number	US-2018012003-A1
Application number	US-201615206333-A
Country	US
Kind code	A1
Filing date	Jul 11, 2016
Priority date	Jul 11, 2016
Publication date	Jan 11, 2018
Grant date	—

Abstract

There is provided, in accordance with some embodiments, a method comprising using one or more hardware processors for receiving a behavioral biometric model that characterizes a human user according to pointing device data of the human user, where the pointing device data comprises screen coordinate and time stamp pairs. The method comprises an action of monitoring an input data stream from a pointing device in real time, wherein the input data stream covers two or more spatial regions of a display screen, and an action of segregating the input data stream into one or more subset streams that is restricted to one of the plurality of spatial regions. The method comprises an action of computing a similarity score based on one or more comparisons of the behavioral biometric model and the one or more subset streams, and an action of sending the similarity score to a user authorization system.

First claim

What is claimed is:

1 . A method comprising using at least one hardware processor for:
receiving a behavioral biometric model that characterizes a human user according to pointing device data of the human user, wherein the pointing device data comprises screen coordinate and time stamp pairs; monitoring an input data stream from a pointing device in real time, wherein the input data stream covers a plurality of spatial regions of a display screen; segregating the input data stream into at least one subset stream that is restricted to one of the plurality of spatial regions; computing a similarity score based on at least one comparison of the behavioral biometric model and the at least one subset stream; and sending the similarity score to a user authorization system.

2 . The method according to claim 1 , further comprising the steps of:
monitoring a training data stream from a pointing device of a user interface, wherein the pointing device is operated by an authorized user, and wherein the training data stream covers the plurality of spatial regions of the display screen; computing the plurality of spatial regions using spatial cluster analysis of the screen coordinates of the training data stream; segregating the training data stream into at least one subset training stream, each restricted to one of the plurality of spatial regions; and computing the behavioral biometric model from the at least one subset training stream.

3 . The method according to claim 1 , wherein the behavioral biometric model is selected from the group consisting of a path model and a pattern model, wherein the path model is a statistical model of pointing device motions between the plurality of spatial regions, and wherein the pattern model is a statistical model of pointing device motions within the plurality of spatial regions.

4 . The method according to claim 1 , wherein the pointing device data further comprises at least one from the group consisting of a mouse button transition a mouse button state, a combined keyboard and mouse button state, and a difference in timestamp values greater than a threshold.

5 . The method according to claim 1 , further comprising at least one action from the group consisting of sending a notification, activating an alarm, and sending a login request.

6 . The method according to claim 1 , further comprising the action of computing a confidence score based on a statistical power of the similarity score and the comparison of the behavioral biometric model and the at least one subset stream.

7 . The method according to claim 1 , wherein the similarity score is computed from a plurality of comparisons of the behavioral biometric model and a plurality of subset streams, thereby providing an aggregate similarity score.

8 . A behaviometric computer program product comprising a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor for:
receiving a behavioral biometric model that characterizes a human user according to pointing device data of the human user, wherein the pointing device data comprises screen coordinate and time stamp pairs; monitoring an input data stream from a pointing device in real time, wherein the input data stream covers a plurality of spatial regions of a display screen; segregating the input data stream into at least one subset stream that is restricted to one of the plurality of spatial regions; computing a similarity score based on at least one comparison of the behavioral biometric model and the at least one subset stream; and sending the similarity score to a user authorization system.

9 . The behaviometric computer program product according to claim 8 , further comprising the steps of:
monitoring a training data stream from a pointing device of a user interface, wherein the pointing device is operated by an authorized user, and wherein the training data stream covers the plurality of spatial regions of the display screen; computing the plurality of spatial regions using spatial cluster analysis of the screen coordinates of the training data stream; segregating the training data stream into at least one subset training stream, each restricted to one of the plurality of spatial regions; and computing the behavioral biometric model from the at least one subset training stream.

10 . The behaviometric computer program product according to claim 8 , wherein the behavioral biometric model is selected from the group consisting of a path model and a pattern model, wherein the path model is a statistical model of pointing device motions between the plurality of spatial regions, and wherein the pattern model is a statistical model of pointing device motions within the plurality of spatial regions.

11 . The behaviometric computer program product according to claim 8 , wherein the pointing device data further comprises at least one from the group consisting of a mouse button transition a mouse button state, a combined keyboard and mouse button state, and a difference in timestamp values greater than a threshold.

12 . The behaviometric computer program product according to claim 8 , further comprising at least one action from the group consisting of sending a notification, activating an alarm, and sending a login request.

13 . The behaviometric computer program product according to claim 8 , further comprising the action of computing a confidence score based on a statistical power of the similarity score and the comparison of the behavioral biometric model and the at least one subset stream.

14 . The behaviometric computer program product according to claim 8 , wherein the similarity score is computed from a plurality of comparisons of the behavioral biometric model and a plurality of subset streams, thereby providing an aggregate similarity score.

15 . A computerized system, comprising:
at least one hardware processor; a user interface comprising a display screen and a pointing device; and a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor for:
receiving a behavioral biometric model that characterizes a human user according to pointing device data of the human user, wherein the pointing device data comprises screen coordinate and time stamp pairs;
monitoring an input data stream from a pointing device in real time, wherein the input data stream covers a plurality of spatial regions of a display screen;
segregating the input data stream into at least one subset stream that is restricted to one of the plurality of spatial regions;
computing a similarity score based on at least one comparison of the behavioral biometric model and the at least one subset stream; and
sending the similarity score to a user authorization system.

16 . The computerized system according to claim 15 , further comprising the steps of:
monitoring a training data stream from a pointing device of a user interface, wherein the pointing device is operated by an authorized user, and wherein the training data stream covers the plurality of spatial regions of the display screen; computing the plurality of spatial regions using spatial cluster analysis of the screen coordinates of the training data stream; segregating the training data stream into at least one subset training stream, each restricted to one of the plurality of spatial regions; and computing the behavioral biometric model from the at least one subset training stream.

Assignees

• IBM

Inventors

• Asulin David
• Margalit Oded
• Peleg Ron
• Regev Shmulik
• Shulman-Peleg Alexandra

Classifications

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• G06F21/36

  by graphic or iconic representation · CPC title

• G06F21/32

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title