Ibnu Mubarok

Kiryong Lee

Sihyung Lee
email: sihyunglee@swu.ac.kr

Heejo Lee

Lightweight Resource Management for DDoS Traffic Isolation in a Cloud Environment

Keywords: Cloud computing, DDoS attack, resource management

Distributed denial-of-service (DDoS) attacks are one of the most difficult issues in network security and communications. This paper is a part of research project that applies distributed defense against distributed attacks. The aim of this project is to provide services by distributing load from one main server to an infrastructure of cloud-based replicas. This paper proposes a lightweight resource management for DDoS traffic isolation in cloud environments. Experimental results show that our mechanism is a viable approach for dynamic resource scaling under high traffic with distributed resource location.

Introduction

Existing DDoS mitigation solutions can be categorized by their approach: victim-based and network-based. Victim-based solutions focus on the mitigation of an attack at the client side, while network-based solutions protect the attack at routers. Victim-based solutions suffer from several drawbacks, such as the need for oversized server resources. Network-based solutions often suffer from link congestion and other challenging issues. New types of attacks, such as Layer-7 DDoS attacks, also contribute to the difficulties with network-based solutions. Several methods use a signature-based approach, in which attack signatures are automatically shared among service providers [START_REF]ArborNetworks: Fingerprint sharing alliance[END_REF]. However, the collection and analysis of these signatures are time consuming. Content delivery network (CDN)-based approaches, such as Akamai [START_REF] Nygren | The akamai network: a platform for high-performance internet applications[END_REF] and CloudFlare [START_REF] Cloudflare | An overview of cloudflare[END_REF], typically use cache servers, and therefore, they are vulnerable to cache pollution attacks such as false-locality and locality-disruption attacks [START_REF] Xie | Enhancing cache robustness for content-centric networking[END_REF], [START_REF] Muttik | Cloud security technologies[END_REF]. Attackers might continue to send requests for unpopular data and pollute the cache stored in different locations within the network topology, leading to service disruption and incurring additional costs.

Enormous resource capacity and ease of scalability in cloud computing could be beneficial to protecting services from DDoS attacks. Many companies and researchers are considering the use of a cloud as a shield from DDoS attacks. However, one concern with this approach is the resource usage. Because one component of billing for cloud services is resource usage and most DDoS attacks aim to deplete a servers resource. However, if critical services are being targeted, and those services cannot be shut down, there is no other option but to keep the service alive using the clouds massive power. This paper proposes a lightweight resource management for isolating DDoS traffic in a cloud environment. Our work focuses on resource allocation management and provides a mechanism for scaling resources under DDoS attack. In this paper, we describe a simple resource placement based on response time and a modified threshold-based scaling mechanism to ensure resource availability.

The main contribution of this research is to propose and evaluate a simple yet effective mechanism for resource scaling and allocation management in a cloud environment under a DDoS attack. Further, this mechanism can be used when the large bandwidth consumption from other legitimate applications lead to the degradation of the servers quality of service (QoS).

2 Distributed Defense Against Distributed Attacks

DROPFAST

This paper is a part of a research project that is attempting to apply distributed defense against distributed attacks. The project, DROPFAST, is based on the idea of providing efficient and secure service by distributing the load from one main server to an infrastructure of cloud-based replicas of the main protected server [START_REF] Rashad | Dropfast: Defending against ddos attacks using cloud technology[END_REF].

Our project is based on the use of the massive computing power of the cloud infrastructure as well as the distributed nature of the cloud to protect the system from DDoS attacks. Our goal is to distribute DDoS traffic inside the cloud environment, guaranteeing that the main server remains accessible to legitimate users. Anomalous users are directed to a replica server in the cloud, whereas an obvious attacker is directed to the quarantine server.

We define the main server as our primary server in which the services must be protected during a DDoS attack. Replica servers are virtual machine resources in the cloud comprising an image of the original server. Based on traffic classification, legitimate users can access the original server, whereas users are forced to access the replicas. We can not simply drop the suspicious traffic, as it is the gray area in which user might be legitimate. For DDoS detection, we use an open source IDS such as Snort system since detection is not our main research focus. To distribute traffic, we apply DNS-based traffic redirection.

As today's services depend on multiple resources, all the independent resources might be replicated in several locations. Our prototype implementation only mentions about one type of resource, which is a web server, but the concept and idea could be extended as well.

Problem Statement

In a cloud, computing resources must be allocated and scheduled in such a manner that providers achieve high resource utilization and users meet their applications performance requirements with minimal cost. This task is related to cloud resource management. Based on the idea of providing service by redistributing load from one main server to an infrastructure of cloud-based replicas, in addition to proper traffic isolation and user classification, a clouds resources can be managed to efficiently mitigate DDoS attacks. Therefore, to guarantee service availability, a cloud service provider must provide effective resource management for handling DDoS traffic.

Lightweight Resource Management

Overview

An implicit goal of our work is to minimize cost when serving resource to client. In order to do so, we must ensure that our scaling mechanism works effectively and efficiently. One option is to significantly minimize resource consumption by selecting the best replica locations and allocate a minimum number of resources to each replica. Therefore, our mechanism consists of two main phases: (1) Replica Location Activation; responsible for selecting the best replica placement among these potential locations. (2) Dynamic Scaling; phase when the system triggers an increase or a decrease in the amount of allocated resources in the server, using modified-threshold based scaling.

Replica Activation and Deactivation

We assume that replica servers are deployed in N predefined locations. In this setting, our objective is to choose M replicas (M < N ) and activate selected replicas, such that congestion is minimized near the main server. Figure 1 shows the ideal result when we activate one replica (M = 1). The high load of attack traffic is redirected to the location furthest from the main server, thus relieving the load near the main server. Legitimate traffic can still access the main server. Because our ultimate goal is to minimize congestion near the main server, we need to define a measure of congestion. For our purposes, we use the response time at the main server. The response time is a straightforward metric that represents a servers availability. A benefit of using this metric is that it can be measured by probing the server from the outside, and it does not require installing a probing agent at the server. The installation of additional agents in the server is often a sensitive issue, because such modifications may degrade the servers performance or lead to failure.

According to the objective and the measure of congestion, the optimal solution is to choose an M-subset of replicas with a minimal response time out of all possible M-subsets. However, identifying such a subset is not practical when N is large. The evaluation of all possible M-subsets can take a significant amount of time, and quick decisions are necessary when under DDoS attack. Therefore, we propose an approximation algorithm, a greedy method that performs M iterations and chooses one replica at each iteration. This greedy algorithm works as follows:

1. At the beginning of the iterations, none of the N replicas are activated. 2. At each iteration, we evaluate all of the replicas that are not yet activated. In particular, we compute two metrics: (i) the response time from each replica to the main server, and (ii) the hop count from the replica to the main server. 3. We choose the replica with the highest response time, assuming that the area around this selected replica is more congested than other areas. The response time is measured by sensor agents, which are deployed in every replica farm, and which send TCP SYN and simple HTTP requests to the main server on a regular basis. 4. In step [START_REF] Cloudflare | An overview of cloudflare[END_REF], if more than one replica yields the same highest response time, we choose the replica with the highest hop count. Such a selection ensures that the attack traffic is redirected at the farthest possible location from the main server. 5. We activate the selected replica, and then repeat steps (2)-( 4), until M replicas are activated.

To summarize, we activate one replica R at a time, selecting the replica with the highest response time and hop count. We expect that this will redirect the largest amount of traffic to R and that this redirection will occur at the location farthest from the server. One advantage of the proposed greedy algorithm is that it does not require the network topology information. Retrieving the latest topology information may not be practical, particularly when the network has thousands of nodes and the topology (and routing) changes frequently.

In the evaluation, we compare the proposed algorithm with two traditional methods that have been used for resource placement: (i) Random placement: randomly chooses M replicas among N potential sites (M < N ) according to the uniform distribution, and it does not depend on traffic workload. (ii) Hotspot placement: This algorithm selects replicas near the clients that generate the highest load [START_REF] Qiu | On the placement of web server replicas[END_REF]. In particular, the algorithm sorts the N potential sites according to the amount of trafc generated within their area. The algorithm then selects the M sites that generate the largest amount of trafc.

In most cases, DDoS attacks only occur for a certain amount of time. To deactivate the replica location, we check the status of the attack using DDoS detection software/module, whether it is still under attack. The sensor agent then checks the response time. If the response time is gradually returning to normal, there is no congestion, the traffic load returns to normal, and the server health check yields a normal status, the server is in a healthy condition. At this point, we deactivate the replica location. If there are many replica locations, we select the replica location where no congestion is detected or where there is the smallest response time. This purpose of the replica location deactivation is resource saving.

Scaling Condition

In this section we explain how our scaling mechanism works. Initially, we start with a low number of machines and gradually increase the load to determine the number of resources required. This approach helps us avoid a situation where we need to reduce the number of machines (M -1) at each iteration. The number of resources required must be estimated accurately so that they can be provisioned within the cloud infrastructure.

Normally, a simple threshold consists of two lines, the upper threshold and lower threshold. This simple threshold might not sufficiently capture traffic fluctuation and adapt to changes. Therefore, we use a four-line threshold-based mechanism. We use a modified threshold mechanism to dynamically change the resource allocation for certain threshold configurations. Using a threshold is a straightforward method to scale resources, and it is shown to be effective in any type of scenario. If the performance metric overpassed the invocation threshold, for a certain time, the system will perform invocation. Similarly, when the performance metric is under the revocation threshold, the system will automatically perform revocation. Figure 2 shows the threshold-based approach for invocation. Invocation is a process by which a system increases the resource allocation, whereas revocation decreases the current resource allocation.

Fig. 2: Invocation condition

The four lines of threshold are: threshold invoke(θ inv ), bumper invoke(β inv ), bumper revoke(β rev ), and threshold revoke(θ rev ). We use four lines because a metric that goes beyond the original threshold might only stay momentarily above a certain point, and the additional threshold (bumper) can help us determine if the situation is lasting. For the first interval, if the performance metric value exceeds the invocation threshold, we start the timer to monitor the systems status. During this monitoring period, we collect the performance metric value until the monitoring time ends. If the stop value is located above the bumper invocation threshold, there is a high probability that current resource allocation is stressed. If the last P M (M stop ) value is above βinv and below θinv, and the average P M value is also above βinv, we perform invocation with a one-by-one increase. If the average P M value is above θinv, and the M stop value is also above θinv, we conduct invocation with a two-fold increase. This is similar to TCPs slow start, we do 'x 2' to reach the top as soon as possible at the beginning of a DDoS. Once we are near the top, we do "+1" to gradually increase the number of replicas. In addition to the invocation condition, the revocation condition has the same principle for deciding the revocation step, but with a different direction value. The monitoring starts when the performance metric value goes deep below the θrev. This triggers collection of the performance metric value until the monitoring stops. We use response time as performance metric, as we found it sufficient to determine the degradation of a server's performance. Possible threshold and bumper values are 10% for threshold revocation, 25% for bumper revocation, 75% for bumper invocation, and 90% for threshold invocation. This percentage is proportionally scaled with range value from minimum to maximum for the performance metric.

Evaluation and Results

For our experiment, we use OMNET++, a simulation environment shown to be efficient for large networks [START_REF] Bless | Using realistic internet topology data for large scale network simulations in om-net++[END_REF]. We also use OverSim and HTTP component from INET module in OMNET++. To emulate Internet topology, we use GT-ITM and BRITE topology generator. We also derive the topology from BGP routing tables. We use the public Web trace of World Cup 1998 as input, which contains flash crowd traffic, a traffic pattern very similar to DDoS attack. The server and network was overloaded by a flash crowd event, and the aggregated volume resembles that of DDoS attack. In total, the web site received more than 1.35 billion requests during the collection period of three months (11,000 requests per minute on average), and almost 5TB of data was sent to clients (41 MB per minute on average). We vary the number of replicas from 1 to 4 for 10-node graphs, from 1 to 10 for 100-node graphs, and from 1 to 100 for 1,000-node graphs.

We ran the simulation several times to obtain a stable result, and these results resemble the normal condition. First, we analyzed the replica placement algorithm. We measured the response time from clients to replicas. As shown in Figure 3.a, which is generated by 100-node graphs, our mechanism achieves shorter response time than random and hot-spot placements. The results are similar in 10-node and 1,000-node graphs. Further, we measured the response time as we increased the number of replicas, starting from 1 to 10. Figure 3.b shows that our mechanism outperforms random and hot-spot placements, and the differences become greater as more replicas are used. This is because hotspot algorithm makes decisions solely based on traffic volume, whereas our mechanism considers multiple factors, (i) response time and (ii) furthest location based on the hop counts. We also measured the efficiency of our scaling mechanism. We assume that one replica can handle one million requests per hour and this may vary depending on the capacity of replicas. Figure 4 compares our approach with the sim-ple threshold and shows that our mechanism much more closely follows the real traffic load, thereby eliminating the needs to invoke redundant replicas. Compared to the random and hotspot algorithms, our approach demonstrates the following benefits: it will only be active when there is an attack, and it is lightweight and easy to implement.

Conclusion

A lightweight scaling mechanism to guarantee service during a DDoS attack. We evaluate a simple and effective mechanism for resource scaling allocation management for DDoS traffic isolation in a cloud environment. Our work has demonstrated the compelling benefit of the cloud, which can handle high traffic and scale the service dynamically. This research motivation is not to entirely eliminate DDoS attacks, but to provide continuity of a service during a DDoS attack. Other topics, such as a pricing scheme for this mechanism, can be calculated fairly by the cloud service provider as a new type of service, despite the actual resource usage. Inconsistency and synchronization issues procedure would be another problem we should consider be to apply the resource prediction mechanism for dynamic resource scaling.

Fig. 1 :

 1 Fig. 1: Replica activation. After activating replica farm 1, traffic from attackers will be redirected from the main server to replica farm 1

Fig. 3 :Fig. 4 :

 34 Fig. 3: Result of comparison between random, hotspot and our approach

Acknowledgments. This research was supported by the R&D Support Center of the Seoul Development Institute and the South Korean government (WR080951).


Mee Loong Yang

Adnan Al Anbuky

William Liu

Security of the Multiple-Key Blom's Key Agreement Scheme for Sensor Networks

The security of the Multiple-Key Blom's (MKB) key agreement scheme is analysed. We considered how the scheme may be broken by a very powerful and well resourced adversary who is able to capture any number of nodes to extract all the sensitive keying material. We showed that by choosing suitable keying parameters, the captured private keys cannot be used directly to break the scheme. Each captured key must first be correctly associated with the public key and master key used to compute it. The chances of finding this private-public-master-key association (PPMka) can be made extremely small and would require the attacker to capture a very large number of nodes, or try an extremely large number of possible solutions. This allows the scheme to be secure for use in large networks, overcoming the limitations in the original Blom's scheme. We obtained some analytical results and compared them to those from computer simulated attacks on the scheme.

Introduction

In our previous works [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF] [2], we presented the Multiple-Key Blom's (MKB) key agreement scheme for sensor networks. This scheme is fast, efficient and frugal, making it specially attractive for low power devices in ad hoc mobile networks. In this paper we show that it is also resilient against a powerful and well resourced adversary who is able capture a large number of nodes and extract all keying material.

For ad hoc mobile networks, an identity-based cryptographic (IBC) key establishment protocol would be very useful for pairs of node to derive their pairwise keys when needed. As defined in [START_REF] Menezes | Handbook of Applied Cryptography[END_REF] an IBC key establishment protocol uses an entity's identity (ID) information (e.g. name and address, identifying index, etc.) as its public key. While its origin is usually attributed to Shamir [START_REF] Shamir | Identity-based Cryptography and Signature Schemes[END_REF] where the ID can be the node's name and address, according to Menezes, Oorschot & Vanstone [START_REF] Menezes | Handbook of Applied Cryptography[END_REF], Blom was first to propose the identity-based (or more accurately, index-based) key establishment scheme in [START_REF] Blom | Non-Public Key Distribution[END_REF] [START_REF]An Optimal Class of Symmetric Key Generation Systems[END_REF]. The Blom's scheme is unconditionally-secure in the information-theoretic sense if less than a certain number of nodes are compromised. Once this threshold is exceeded, the scheme can be completely broken. Recognising this limitation, Blom [START_REF] Blom | Non-Public Key Distribution[END_REF] said "It would be nice to have systems that degrade more gracefully but more research is needed". We believe that our scheme is able to fulfil this requirement.

This Contribution We considered the security of the Multiple-Key Blom's scheme in the three aspects -the strength of the keys, the security of the underlying Blom's scheme as it applies to our scheme, and the probabilities of the scheme being completely broken by a very powerful adversary. We presented analytical results to compute the probability of success in breaking the scheme and compared it with computer simulated attacks on some implementations.

The paper is structured as follows: In Section 2, we described briefly some related works and the necessary background material. Section 3 dealt with the security of the keys and how our scheme would improve the security of the original Blom's scheme. In Section 4 we presented some analytical results on the effort required and the probabilities of breaking the scheme. We gave our conclusions in Section 5.

Notations and terms used K -private key, a secret (1 × m) row vector unique to the node M -master key, an (m × m) secret symmetric matrix N -number of master keys R -pairwise key-set, the set of numbers used to form the pairwise key V -public key, a (m × 1) column vector unique to the node m -the size of the master key matrix η -number of public keys assigned to each node p -prime modulus for key operations q -prime modulus for public key operations only s -public key seed, an integer ∈ [0, q -1]

Related Works

The original Blom's scheme has limitations in that to be secure, it would require substantial memory for storage of keying material when used in large networks. The work in [START_REF] Chen | An Improved Matrix Key Pre-distribution Scheme for Wireless Sensor Networks[END_REF], improved on its scalability by using a clustered topology where only the cluster-heads implemented the Blom's scheme. The probabilistic scheme in [START_REF] Du | A pairwise key pre-distribution scheme for wireless sensor networks[END_REF] used multiple key-spaces where nodes would first discover their shared key space to implement the scheme. A recent work in [START_REF] Yu | Noninteractive Pairwise Key Establishment for Sensor Networks[END_REF] added some constrained random perturbations to the private keys to break its direct relationship with the master key, thereby increasing the resilience against the master key being computed from sufficient number of stolen private keys. All these works did not address the issue of the pairwise key sizes which would be same as the data size used for the master key elements.

The BYka scheme

The basic concepts of our Multiple-key Blom's key agreement scheme, now called the Blom-Yang key agreement (BYka) scheme, has been presented in [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF] [START_REF]The Multiple-Key Blom's Scheme for Key Establishment in Mobile Ad Hoc Sensor Networks[END_REF]. Due to space constraint only a brief description suffice for this paper is given here.

Trusted Authority and Master keys The Trusted Authority (TA) is responsible for all keying material. It generates

N secret master keys M 1 , M 2 , • • • , M N , each one being a random (m × m) symmetric matrix M over the prime field F p .
Public key-tag (ID) The TA assigns each node one set of public keys called the "public key-set" consisting of η column vectors over the prime field F q , where q p. For example, for node A, the public key-set is {V A1 , • • • , V Aη }. These vectors are columns of the Vandermonde matrix, i.e.,

V T Ai = 1 s Ai s 2 Ai • • • s m-1 Ai (mod q), for i = 1, • • • , η
The values s Ai are called the public key "seeds". The seeds s A1 , • • • , s Aη are consecutive such that the smallest seed, s A1 is a multiple of η. In this way, each node's public key-set is unique and can be concisely represented by just the smallest seed. This serves as the node's identity ID, also called the "public key-tag". For example, node A's public key-set can be represented by its public key-tag ID A = s A1 .

Private keys

The TA computes the private keys for each node using all permutations of their η public keys with the N master keys. For node A, the private keys are a set of ηN (1 × m) row vectors, called the "private key-set" computed as follows,

K Aij = V T Ai M j (mod p), for i = 1, • • • , η, j = 1, • • • , N Consider the u th element of the private key K Aij , K Aij u = m n=1 s n-1
Ai (mod q) M jnu (mod p)

= M j1u + s 1 Ai M j2u + • • • + s m-1 Ai M jmu (mod p) (1)
The public key operations are modulo q, while all other key operations are modulo p. It is possible for multiple public keys to map to the same key in Eqn.

(1), a phenomenon we call "key aliasing".

To prevent key aliasing, a seed s is chosen such that at least one vector element is > q and ≡ 0 (mod p), i.e., for some w m, s w-1 > q i.e. s w-1 ≡ r (mod q)

and r ≡ 0 (mod p), or s (mod p)

       (2)
The TA installs into each node their keying material comprising the global keying parameters {m, N, η, p, q}, the node's individual public key-tag ID, and its private key-set K 1,••• ,N η . Crucially, the private keys in the key-set are stored in a random order. All these are static and can be stored in the ROM or flash memory.

Pairwise Key Derivation After deployment, any pair of nodes can derive their common secret pairwise key after exchanging their IDs, a very small amount of bits. For example, A and B have obtained each other's IDs. Next, each node generates their counterpart's public keys. For example, node A generates B's public keys,

s B k = ID B + (k -1), V T B k = 1 s B k s 2 B k • • • s m-1 B k (mod q) for k = 1, • • • , η    (3)
Then, using all the permutations with its own private keys, the nodes computes (modulo p), the "pairwise key-sets" R A and R B as follows,

Node A: R A ijk = {K Aij V B k } = {(V T Ai M j )V B k } Node B: R B ijk = {K Bij V A k } = {(V T Bi M j )V A k } for i, k = 1, • • • , η, and j = 1, • • • , N
Transposing all the elements in the set R B we have,

R B ijk = {((V T Bi M j )V A k ) T } = {(V T A k M T j )V Bi } Since M j is symmetric, V T Ai M j V B k
is scalar, and i, j, k are merely independent counters, the sets R A and R B each contain N η 2 identical numbers, though not in the same order. These numbers would be used by both nodes to form a pairwise key using a preconfigured method.

In our scheme, the sequence formed from the number of occurrences of the integers 0, 1, • • • , p -1 is used as input to a hash function to obtain a 128-bit pairwise key.

3 Security of the BYka scheme

Security Model System Model

The system comprises nodes belonging to one administrative unit under the TA. The TA has access to a good random number generator for generating the master key matrices. Before deployment, each node uses a secure connection with the TA to obtain its keying material.

The nodes have very limited computing power, memory, and battery life. They have access to strong cryptographic services such as hash functions, pseudo random number generators, and strong symmetric encryption techniques such as the AES algorithm. They are highly mobile, are deployed in an ad hoc manner, and communicate with each other using low power radio with a limited range.

Adversary model

The adversary is a very powerful agent capable of moving about freely in the deployment space to monitor and insert messages. In addition, it is capable of capturing any number of nodes to extract all the keying material including the public and private keys from ROM and RAM. It also has access to unlimited computing resources. It cannot compromise the TA.

System breakdown

The scheme is consider broken if the adversary is able to, by monitoring messages and/or obtaining sensitive information from captured nodes, compute the pairwise keys of any pair of un-compromised nodes, fabricate new valid public and private keys, or compute the master keys of the TA. Identity theft attacks are not considered in this paper.

Vulnerabilities

The vulnerabilities of the BYka scheme can be studied in three main aspects:

1. Resistance of the keys against brute force attacks, 2. Security of the Blom's scheme on which is is based, and 3. Resilience against node capture Private keys In Eqn. [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF], the elements of the private keys, being products and sums of random numbers, are also random. Hence, each private key is just a row vector of random numbers and is indistinguishable from each other.

There are ηN m elements in each private key-set. Even with small values of m = 12, N = 6, η = 6 and p = 13, there are about 1.673 × 10 481 possible keys, or equivalent to 1, 599 bits. This is large enough to defeat the brute force attempt to fabricate a node's private key-set.

Pairwise key The BYka scheme can be viewed as a mechanism for two nodes to derive identical (unordered) key-sets R A and R B which contains N η 2 integers ∈ [0, p -1]. The numbers in the key-set, for example, Pairwise key size The pairwise-key set contains N η 2 integers ∈ [0, p -1]. These can be combined together to form a pairwise key of up to N η 2 b bits, where b is the data size of p. For example with N, η = 6, and p = 31, the key size can be up to 1080 bits.

R A ijk = K Aij V B k = m n=1 K Aij s n-1 B k (mod p),

Pairwise keyspace

The number of possible pairwise keys, or the keyspace size, must be at least as large as the desired key size. It is however, limited by the number of possible combinations of the N η 2 integers in the key-sets R. The keyspace size can be determined by considering the number of possible combinations of the integers 1, 2, • • • , p-1, such that the total number of integers in each combination is exactly N η 2 . This can be obtained by considering the following partitioning problem.

Given a row of N η 2 items, we wish to partition them such that there are p groups, g 0 , g 1 , • • • , g p-1 , each containing the integers 0, 1, • • • , p -1 respectively. To create the partitions, we first insert (p -1) items into the row so that there are now (N η 2 + p -1) items. If any (p -1) items are now removed, it would leave (p -1) gaps separating the remaining items into p groups as desired. The number of ways to remove (p -1) items from (N η 2 + p -1) gives the keyspace size as follows,

K space = N η 2 + p -1 p -1 (4)
Using suitable values of N , η, and p, keyspace sizes of 64, 80, 96, and 128 bits are possible, as shown in Table [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF].

Security of the underlying Blom's scheme

In our previous work [START_REF]The Multiple-Key Blom's Scheme for Key Establishment in Mobile Ad Hoc Sensor Networks[END_REF], we showed how the Blom's scheme would be completely broken if the number of nodes compromised is m, the "capture threshold". The scheme is said to be unconditionally secure if no more than (m -1) nodes are compromised, and all the public key vectors are linearly independent of each other [START_REF] Menezes | Handbook of Applied Cryptography[END_REF]. Otherwise, using the captured private keys from m or more nodes, the attacker would be able to either mount the Sybil attack by fabricating new public and private keys using linear combinations of the m captured keys, or attack the master key M by solving the system of m × m linear equations, K X = V T X M. The security of the BYka scheme would appear to be similar to the original Blom's scheme. Apparently, the capture threshold is lower at m η since each node has η private keys associated with each master key. However, the attacker would first have to associate each private key with the public key and master key used to compute it, i.e. discover the private-public-master-key associations (PPMka).

Each private key computed in Eqn. ( 1) is a row vector of random integers ∈ [0, p -1] and has no information about the public key and master key used to compute it. Without the PPMka information each key can be correctly associated with the public key and master key with a probability of 1 N η . To mount the Sybil or master key attack, all the m private keys must be used together. This will result in a very large number of possible solutions as shown later.

4 Attacks to discover the PPMka

Using brute force

Using one captured node Consider that the attacker has obtained the public and private keys from one captured node. The attacker generates an arbitrary master key, and using one of the public keys, computes a trial private key using Eqn. [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF]. This is then compared with each of the captured keys to find a match. After trying all the possible master keys, there will be N matches and eventually all the master keys will be found. The number of possible master keys to try is p

m(m+1) 2
which is a very large number with typical keying parameters.

Using sufficient captured nodes Consider that m η nodes have been captured. Each node has N η private keys. There is enough information to construct the N systems of m × m equations to solve for all the master keys, using for example, the following procedure.

From each node, the N η keys are grouped into N η η possible groups each associated with one of the master keys. Within each group, each private key can be associated with the η public keys in η! ways. Therefore for each node there are N η η η! ways to obtain the set of ηm equations for solving one master key, say M 1 . Using a total of m n nodes, it is possible to obtain a set of m × m equations to solve for M 1 .

After obtaining the first master key, the η private keys associate with M 1 is removed and the process is repeated for M 2 , and so on. Overall, the total number of attempts required to obtain all the master keys is

Φ = N -1 i=0 N η -iη η η! m η
The number of iterations required, even with small parameter values is very large. For example with m = 12, N = 6, η = 6, there are 2.16 × 10 18 possible master keys solutions.

Pairing Attack to discover the PPMka

A better approach would be to get pairs of nodes, e.g. nodes A and B, to compute their pairwise key-sets R A and R B using each other's public keys. The N η 2 numbers in the two key-sets will be identical, and if they are unique, the attacker would be able to, by matching them, associate the related private keys to the same master key. We call this the "pairing attack". A more efficient pairing attack would use only one of each other's public keys to compute the partial key-sets R rA and R rB which now contains only N η elements. This is illustrated in Fig. [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF] for the simple case using N, η = 2. Here, since K A1 V B2 = K B3 V A1 , both must be associated with the same master key say, M 1 . The PPMka for the private keys can then be found, i.e. Collisions If all the numbers in R r are unique, the above attack would be successful. However, if they are not, we say there are "collisions", and there are more than one possible PPMka's for the affected private key.

K A1 = V T A1 M 1 , K B3 = V T B2 M 1 and similarly, K A2 = V T A1 M 2 , K B2 = V T B2 M 2 .

Couplers and Couplings

We call the numbers that are identical across both partial key-sets R rA and R rB , "couplers". In Fig. [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF], the set C contains the couplers. The links connecting the couplers to the numbers in R rA and R rB are called "couplings". The number of couplings linking R r to the couplers is denoted as N c .

In the ideal case where there is no collision, there would be exactly N c = N couplings on each side of C, each one linking the private key to the associated master key and public key, revealing their PPMka. However, if the couplers are not distinct, then the PPMka's for the related private keys are ambiguous.

The probability of having all distinct couplers in the partial key-set of N η numbers is

P u = ( p p )( p-1 p ) • • • ( p-N η-1 p
). This can be made very small by choosing suitable values of p, N and η. For example, with p = 31, η = 6, N = 5, we have P u = 2.49 × 10 -12 . If N η p + 1, the probability P u is zero as there is not enough numbers to go round without repetition.

Pairing Attack approaches We consider two extreme approaches to discover the PPMka. In the first case, the "unlimited capture" attack, the attacker is able to capture as many nodes as necessary until finally the PPMka can be exposed. At the other end of the spectrum, in the "limited capture" attack, the attacker has just enough nodes to compute the master keys.

Unlimited Capture Attack

Traitor Node The pairing attack would be successful if each pairing results in key-sets R in which all the numbers are unique. However with suitable choice of keying parameters this probability is very small. Nevertheless, the attack would have a better chance of success if a node is available such that all the N private keys associated with one of the public keys is known or "exposed". This set of private keys can be used to reduce the ambiguities in subsequent pairings. We call this node the "traitor node" since it can be used to betray other nodes. For example in Fig. [START_REF] Yang | A Fast and Efficient Key Agreement Scheme for Wireless Sensor Networks[END_REF], nodes A and node B are possible traitor nodes.

In general, a traitor node T is found if, in a pairing, the number of couplings it has is N c = N i.e. there are N couplers. If N c > N , there will be ambiguities.

Using the traitor node, another node say B, is paired with it. If the number of couplings in R rB is N , they distinctly link the related private keys in B to the exposed private keys in T revealing the PPMka. For example, in Fig. (2), T is a traitor node and the keys K T 1 and K T 2 are known to be associated with M x and M y respectively. Then for node B, the keys K B1 and K B2 must be associated with M x and M y respectively, and both associated with public key V B2 . First, consider the general case of arranging N a numbers given r numbers, such that each arrangement has all the r numbers. For example, in arranging 4 numbers given the 3 numbers {6, 7, 8}, permutations like {6, 6, 7, 8} and {6, 7, 7, 8} would be included, but excludes permutations such as {6, 6, 6, 7} and {6, 6, 7, 6}, etc. Let the number of arrangements be Q Nar . It can be shown that

Q Nar = r Na - r-1 i=1 r i Q Nai where Q Na1 = 1 (5)
The total number of arrangements where R rA is disjoint with (R rB ∪R c ) is then,

θ u = Na r=1 p r Q Nar (p -r) N η (6)
It is also possible that the sets R rA , R rB and R c are all disjoint. The number of such arrangements θ d , can be similarly shown to be,

θ d = Nc r=1 p r Q Ncr × Na k=1 p -r k Q Nak (p -r -k) N b (7)
where Q Ncr and Q Nak can be obtain as in Eqn. [START_REF] Blom | Non-Public Key Distribution[END_REF]. The total number of possible arrangements is θ t = 2θ u -θ d , without double counting the cases for all 3 disjoint sets.

The probability of finding a traitor node is then,

P t = θ t p 2N η-N = 2θ u -θ d p 2N η-N (8)
The values of P t for various keying parameters is given in Table ( Expected Node capture We assume that attacker is able to capture any number of nodes. As a new node is captured, it is paired with each of the previous ones to find the traitor, if not another new node is captured and the process repeated. Since the probability of finding a traitor node is P t , the expected number of pairing attempts to find one is 1 Pt . Each node has η public keys to try, so each pair gives η 2 attempts. If the number of nodes captured is n c , the number of pairs that can be formed is nc 2 giving a total of η 2 nc 2 pairing attempts. To find a traitor node we have,

η 2 n c ! 2!(n c -2)! 1 P t i.e. n c 1 2 1 + 1 + 8 η 2 P t (9)
The values of n c for some keying parameters is also given in Table [START_REF]The Multiple-Key Blom's Scheme for Key Establishment in Mobile Ad Hoc Sensor Networks[END_REF]. It can be seen that for these cases, thousands of nodes need to be captured just to find a traitor node. Finding a traitor does not break the scheme. The chance of finding a node which has exactly N couplers when paired with the traitor node is as improbable as finding the traitor node itself. m . After obtaining the first master key, the associated private key is removed leaving N c -1 keys to choose for solving the next master key. In total, to solve for all the master keys, the total possible number of sets of equations, i.e. the number of iterations required is, Φ =

N -1 i=0 [N c -i] m .
P (X = x) = N η x p x r (1 -p r ) (N η-x) (10)
where the x is the number of couplings, and µ = N ηp r is the mean. From Eqn.

(8), we can compute the probability when there are N couplings, i.e. P (X = N ). Then solving for p r in Eqn. (10), we can obtain the mean µ. Writing the expected number of couplings in a pairing as N c = µ, then the probable number of possible solutions for all the master keys is,

Φ = N -1 i=0 [N c -i] m = N -1 i=0 [µ -i] m (11)

Experimental Results of Simulated Pairing Attacks

A computer programme was used to implement the pairing attacks to determine the traitor capture sizes n c and the probable number of master key solutions Φ.

The programme first generates the master keys. It then randomly creates new nodes with unique IDs to simulate captured nodes. Each node is paired with each of the previously "captured" nodes until a traitor node is found. At the same time the number of couplings is accumulated for the first m η nodes. This is the probable number of couplings in the limited captured attack. When a traitor node is found, a new implementation is done using a new set of master keys and this is repeated for 1000 times.

These are real attacks on real systems as the public and private keys can be implemented in real sensor nodes. They are "simulated" in the sense that capturing the nodes and extracting the keys are done in the computer programme, greatly accelerating the attacks.

Due to the large traitor capture sizes, only cases which gives results within a reasonable time is given in Table [START_REF] Shamir | Identity-based Cryptography and Signature Schemes[END_REF]. These results are the mean values for 1000 implementations for each case. As an indication, one run for the case using N = 6, η = 4 took over 2 1 2 hours to find a traitor node, requiring about 135 captured nodes.

Conclusion

The security of our BYka key agreement scheme was analysed in term of the resistance of its keys against brute force attacks, the security of the Blom's scheme on which it is based, and its resilience against node capture. We showed that the keys are random and large enough to resist brute force attacks. The scheme inherits the unconditionally security of the original Blom's scheme and also allows it to break free from the limitations therein. This is because, by using multiple keys in permutations, the relationships of the private keys with the master keys and public keys becomes indiscernible, and they cannot be used directly to break the scheme. We calculated the probabilities of discovering the correct private-public-master-key association information and showed that, with suitable keying parameters, these probabilities are very small. Consequently, to break the scheme, it would require a very large number of nodes to be captured, or an infeasibly large number of solutions are possible. Our analytical results were verified by comparing them with results obtained from simulated attacks on the scheme using a computer programme. Our BYka scheme is thus secure against very powerful adversaries and being fast, efficient and frugal, would be useful for large ad hoc mobile sensor networks.

3. 3

 3 Security of keys against brute force Master keys Each master key is an m × m symmetric matrix. It has m(m+1) 2 unique elements, each one being a random number ∈ [0, p -1]. The brute force attacker would have to try all the p m(m+1) 2 possible keys. For example, even with small values of m = 12, p = 13, there are 7.72 × 10 86 possible keys, equivalent to 288 bits.

  where s B k satisfy Eqn.[START_REF]The Multiple-Key Blom's Scheme for Key Establishment in Mobile Ad Hoc Sensor Networks[END_REF], are also random numbers ∈ [0, p -1]. Hence the number of occurrences of the integers 1, 2, • • • , p -1 in the key-set R A is also random.

Fig. 1 .

 1 Fig. 1. Pairing attack for case N = 2, η = 2

Fig. 2 .

 2 Fig. 2. Traitor Node can be used to attack the PPMka

Fig. 3 .Fig. 4 .

 34 Fig. 3. Traitor Node cannot be used to discover the PPMka

4. 4

 4 Limited capture pairing attack In this attack only m η , but sufficient, number of nodes has been captured. Using the pairing attack, the partial key-set is obtained. If there are N c > N couplings due to collisions, there are N c possible ways choose the private key related to one of the master keys, say M 1 . Using all the η public keys one at a time, the number of sets of equations from one node is [N c ] η . To obtain the m × m equation, m η nodes are required. The number of possible solutions for the master key M 1 is [N c ]

Fig. 5 .

 5 Fig. 5. Distribution of number of couplings for p = 31, N = 6, η = 6 Binomial Distribution Approximation Fig. (5) shows the typical distribution of the number of couplings in the pairing attacks, in this case for p = 31, N = 6, η = 6. It suggests that the distribution can be approximated by the binomial distribution,

Table 1 .

 1 Key space sizes in bits

	η N	13	Values of p 17 19 23	31
		6	64	80	88 102 127
	6	7	67	84	92 106 134
		8	69	87	95 111 139
		6	69	87	95	111 140
	7	7	72	91	99	116 146
		8	74	94 103 120 152
		6	74	93 102 119 151
	8	7	77	97 106 124 157
		8	79 100 109 128 163

Table 2 .

 2 2). 07×10 -16 2.29×107 1.70×10 -15 5.75×106 5.62×10 -12 1.00×10 5 7 5.25×10 -19 1.02×10 9 8.71×10 -19 2.51×10 8 5.01×10 -15 3.31×10 6 8 2.57×10 -23 4.68×10 10 4.37×10 -22 1.12×10 10 3.72×10 -18 1.23×10 8 7 6 2.40×10 -20 1.29×10 9 4.07×10 -19 3.16×10 8 2.45×10 -15 4.07×10 6 7 2.88×10 -24 1.20×10 11 5.01×10 -23 2.88×10 10 4.68×10 -19 2.95×10 8 8 3.47×10 -28 1.10×10 13 6.17×10 -27 2.57×10 12 7.59×10 -23 2.34×10 10 8 6 5.50×10 -24 7.59×10 10 9.55×10 -23 1.82×10 10 8.71×10 -19 1.91×10 8 7 1.62×10 -28 1.38×10 13 2.88×10 -27 3.31×10 12 3.63×10 -23 2.95×10 10 8 4.79×10 -33 2.57×10 15 8.51×10 -32 6.03×10 14 1.32×10 -27 4.90×10 12 Probabilities of finding a Traitor Node Pt, and expected capture sizes nc

	η N	Pt	p = 13	nc	Pt	p = 17	nc	Pt	p = 31	nc
	6 1.
	6

Table ( 3

 ( ) gives the probable number of master keys solutions, Φ for various keying parameters. 55×10 17 2.34×10 17 9.55×10 16 1.26×1035 5.37×10 34 9.12×10 33 7 2.40×10 18 1.66×10 18 7.94×10 17 5.75×10 36 2.75×10 36 6.17×10 35 8 1.23×10 19 1.23×10 19 4.79×10 18 1.55×10 38 1.55×10 38 2.24×10 37 7 6 1.66×10 18 1.66×10 18 5.37×10 17 2.75×10 36 2.75×10 36 2.82×10 35 7 1.23×10 19 1.23×10 19 4.79×10 18 1.55×10 38 1.55×10 38 2.24×10 37 8 8.91×10 19 6.92×10 19 3.02×10 19 8.13×10 39 4.79×10 39 9.12×10 38 8 6 9.12×10 18 6.61×10 18 3.39×10 18 8.13×10 37 4.37×10 37 1.15×10 37 7 6.92×10 19 6.61×10 19 3.02×10 19 4.79×10 39 2.75×10 39 9.12×10 38 8 3.89×10 20 3.09×10 20 1.91×10 20 1.51×10 41 9.55×10 40 3.63×10 40

	η N	13	m = 12 17	31	13	m = 24 17	31
	6 3.
	6

Table 3 .

 3 Probable number of Master key solutions, Φ

Table 4 .

 4 Comparison between analytical and experimental results for p = 31

	η N	Traitor Capture size nc Number of solutions, Φ Eqn.(9) Expt. Eqn.(11) Expt.
		4	5.59	5.23	7.97 × 10 22 1.06 × 10 24
	4	5	23.23	21.48	5.43 × 10 26 8.46 × 10 26
		6 128.05	113.53	7.92 × 10 28 1.10 × 10 29
	5	4 5 237.99 24.45	21.37 215.63	7.95 × 10 26 8.16 × 10 26 7.93 × 10 28 9.95×10 29
	6	3 4 155.91 10.76	9.62 135.88	1.00 × 10 24 1.17 × 10 25 1.68 × 10 28 1.42 × 10 29
	7 3	37.57	33.04	7.95 × 10 25 7.17 × 10 26


Hataichanok Saevanee

Nathan Clarke

Steven Furnell

Valerio Biscione

Text-Based Active Authentication for Mobile Devices

Keywords: Active authentication, Transparent authentication, Continuous authentication, Multimodal, Biometric, Mobile devices

As modern mobile devices are increasing in their capability and accessibility, they introduce additional demands in terms of securityparticularly authentication. With the widely documented poor use of PINs, Active Authentication is designed to overcome the fundamental issue of usable and secure authentication through utilizing biometric-based techniques to continuously verify user identity. This paper proposes a novel text-based multimodal biometric approach utilizing linguistic analysis, keystroke dynamics and behavioral profiling. Experimental investigations show that users can be discriminated via their text-based entry, with an average Equal Error Rate (EER) of 3.3%. Based on these findings, a framework that is able to provide robust, continuous and transparent authentication is proposed. The framework is evaluated to examine the effectiveness of providing security and user convenience. The result showed that the framework is able to provide a 91% reduction in the number of intrusive authentication requests required for high security applications.

Introduction

Mobile devices are commonplace with over 6 billion subscribers worldwide [START_REF] Ericsson | Traffic and market report on the pulse of the networked society[END_REF]. With the rapid development of mobile network technology and the increasing popularity of mobile devices, modern devices are capable of providing a wide range of services and applications over multiple networks. The plethora of functionalities offered by the mobile device enables users to store increasing amounts of a wider variety of information from business to personal and sensitive data. A series of studies have highlighted the potential risk of mobile device misuse through the storing of personal information (e.g. home address), security credentials (e.g. PIN codes, user names and passwords) and business data (e.g. customer data) [START_REF]European Users Mobile Behaviour and Awareness of MobileThreats[END_REF][START_REF]The impact of mobile devices on information security: A survey of IT professionals[END_REF].

Although PIN or password authentication is available on most mobile devices, a survey conducted by [START_REF] Mcafee | McAfee Reveals Consumers Fail To Protect Their Mobile Devices[END_REF] demonstrated that a third of mobile users do not protect their devices with this simple technique. Furthermore, the poor use of PIN or pass-word techniques when they are used is also widely documented in several studies [START_REF] Mcafee | McAfee Reveals Consumers Fail To Protect Their Mobile Devices[END_REF][START_REF] Clarke | Authentication of users on mobile telephones -A survey of attitudes and practices[END_REF]. A fundamental weakness of the PIN is that as a point-of-entry approach, once the user has been successfully authenticated, they obtain access to the system without having to re-authenticate. Several studies [START_REF] Karatzouni | Utilising Biometric for transparent user authentication on mobile devices[END_REF][START_REF] Li | Behaviour Profiling for Transparent Authentication for Mobile Devices[END_REF] proposed Active Authentication or transparent authentication to overcome the fundamental issue and more closely associate the authentication and access control decisions. There are a number of biometric techniques that have the potential to be used for authentication in a transparent and thus continuous fashion, such as keystroke dynamics, behavioral profiling, gait recognition, speaker verification and facial recognition. Unfortunately, research has demonstrated that using a single biometric may be inadequate for verification due to a variety of reasons, such as noise in the sample data, the unavailability of a sample at a given time and the underlying performance of the technique [START_REF] Sim | Continuous verification using multimodal biometrics[END_REF]. To overcome this limitation within traditional the point-of-entry domain, several researchers have proposed the use of multiple biometric modalities, which have demonstrated increased accuracy of verification [START_REF] Kittler | Combining Evidence in Personal Identity Verification Systems[END_REF][START_REF] Poh | Hybrid Biometric Authentication System Using Face and Voice Features[END_REF][START_REF] Snelick | Large-Scale Evaluation of Multimodal Biometric Authentication Using State-of-the-Art Systems[END_REF].

This paper presents the findings of a research study exploring the application of multimodal biometric authentication in a transparent fashion to text-based entry. As users frequently use their mobile device to send SMS text messages (over 9.8 trillion in 2012), social network posts, emails and tweets, it was felt this medium provided a frequent opportunity to capture samples [START_REF]Cmo Council[END_REF]. The focus upon text-based entry provides the possibility to apply keystroke dynamics, linguistic analysis and behavioral profiling. It is the aim of this paper to present the results of an exhaustive investigation into optimizing the recognition performance and an evaluation of the security processes required to maximize the security of the approach whilst minimizing user inconvenience. Section 2 presents the state of the art in behavioral biometrics that have been applied in the mobile domain. Section 3 describes the feasibility study of multimodal biometric. Based upon the results, a novel text-based multimodal framework that will provide the verification of a mobile user's identity in a continuous and transparent manner is proposed in Section 4 and then evaluated through simulation in Section 5. The paper concludes by highlighting the future direction of research in Section 6.

Text-based behavioral biometric for mobile devices

With the rapid evolution of mobile devices, utilizing biometrics on them has become a reality. Many mobile devices come equipped with a number of hardware components that are able to be used for capturing a variety of biometric traits, enabling several biometric approaches to be deployedsuch as keystroke dynamics, behavioral profiling and voice recognition. For example, Apple has now incorporated TouchID, a fingerprint-based approach, and Google has Face Unlock for its Android Operating System [13,14]. To date, however, these are point-of-entry solutions that focus upon usability rather than security. Of interest in this research is the use of three behavioral biometric techniques: linguistic profiling, keystroke dynamics and behavioral profiling. It is hypothesized that the integration of these three techniques together offers the opportunity to improve upon the usability through transparent capture, improve the overall recognition performance and mitigate the unavailability of samples at a given time. Linguistic profiling is a behavioral biometric that identifies people based upon linguistic morphology. Previous studies have investigated the feasibility of linguistic profiling for several tasks such as text categorization, authorship identification and authorship verification. In the authorship verification domain, examples of writing from a single author are given to the system, which is then asked to confirm if the given texts were written by this author. According to previous studies [START_REF] Rudman | The state of authorship attribution studies: Some problems and solutions[END_REF], almost 1000 writing styles have been analyzed and both statistical and machine learning methods were used in the analytical process. Many studies have confirmed the good discriminating capability of linguistic features. Through using a machine learning method, the performance accuracies were in the range of 80%-100% [START_REF] Halteren | Linguistic Profiling for Author Recognition and Verification[END_REF][START_REF] Zheng | A Framework for Authorship Identification of Online Messages: Writing-Style Features and Classification Techniques[END_REF]. However, there is no agreement on a best set of features for authorship verification and historically large volumes of text are required for the training dataset. The performance of linguistic profiling technique highly depends upon the combination of the selected features and classification models utilized.

Behavioral profiling aims to identify users based upon the way in which they interact with the services on their mobile device. Previous behavior-based studies have mainly focused upon the area of fraud detection. Research in mobile IDSs can be divided into two categories: call-based and mobility-based mechanisms. The former monitors user's calling behavior (e.g. start date of call and dial telephone number) that have been collected over a service provider's network during a period of time [START_REF] Boukerche | Behavior-based intrusion detection in mobile phone systems[END_REF][START_REF] Damopoulos | Evaluation of Anomaly-Based IDS for Mobile Devices Using Machine Learning Classifiers[END_REF]. Based upon the theory that people have a predictable travelling pattern when they travel from one location to another, the mobility-based approach monitors a mobile user's location activities to detect abnormal behavior [START_REF] Buschkes | How to increase security in mobile networks by anomaly detection[END_REF]. Through monitoring a user's calling or location activities, behavioral-based IDS can offer a high detection rate and ability to detect unforeseen attacks [START_REF] Boukerche | Behavior-based intrusion detection in mobile phone systems[END_REF][START_REF] Damopoulos | Evaluation of Anomaly-Based IDS for Mobile Devices Using Machine Learning Classifiers[END_REF][START_REF] Buschkes | How to increase security in mobile networks by anomaly detection[END_REF][START_REF] Hall | Anomaly based intrusion detection using mobility profiles of public transportation users[END_REF]. Depending upon application types, profiling techniques and classification approach, a study by [START_REF] Li | Behaviour Profiling for Transparent Authentication for Mobile Devices[END_REF] showed that behavioral profiling could be used for authentication on mobile devices with accuracies of between 87% and 98%.

Keystroke dynamics identifies a user based upon the typing pattern of a user, looking at characteristics of their interaction with a keyboard. Based upon previous studies, two main characteristics were identified: inter-key and hold time [START_REF] Clarke | Authenticating Mobile Phone Users Using Keystroke Analysis[END_REF]. The inter-key is the duration between two successive keys. The hold-time represents the duration between the press down and releasing of a single key. Many studies have shown it is feasible to authenticate users successfully based upon usernames and passwords (i.e. in parallel with a typical Windows login request), with a commercial product on the market utilizing this technology [START_REF] Biopassword | the keystroke dynamics approach[END_REF][START_REF] Behaviosec | [END_REF]. More recent studies [START_REF] Karatzouni | Utilising Biometric for transparent user authentication on mobile devices[END_REF][START_REF] Clarke | Authenticating Mobile Phone Users Using Keystroke Analysis[END_REF] investigated the possibility of using keystroke dynamics on mobile devices, showing the possibility of keystroke dynamic based authentication can be deployed in practice to provide an extra layer of security for mobile devices with an average accuracy of 87%.

Based upon the prior-art, these three techniques provide valuable discriminative information to permit identity authentication. All of the biometric traits of these three techniques can be captured during user interactions with a mobile device without a user explicit interaction to authenticate. In addition, no additional hardware is required to deploy these techniques. As a result, these approaches arguably provide a cost effective and a non-intrusive solution for mobile handset authentication. Furthermore, a significant amount of prior research within the point-of-entry authentication domain [START_REF] Kittler | Combining Evidence in Personal Identity Verification Systems[END_REF][START_REF] Poh | Hybrid Biometric Authentication System Using Face and Voice Features[END_REF][START_REF] Snelick | Large-Scale Evaluation of Multimodal Biometric Authentication Using State-of-the-Art Systems[END_REF] has concluded that using multiple biometric modalities can improve accuracy and reliability of single-modal systems. For example, using combination of fingerprint and face modality can achieve better performance than using single biometric, improving the accuracy of 2.3% at 0.1% FAR [START_REF] Indovina | Multimodal biometric authentication methods: a COTS approach[END_REF].

A feasibility study of text-based multimodal biometrics

Since no multimodal database availability where the above three biometric modalities are measured within the same individual, a standard practice employed within multibiometrics is to combine the modalities from different datasets and create a virtual person [START_REF] Snelick | Large-Scale Evaluation of Multimodal Biometric Authentication Using State-of-the-Art Systems[END_REF]. The SMS corpus collected by the authors, a public mobile usage dataset provided by [START_REF] Eagle | inferring Social Network Structure using Mobile Phone Data[END_REF] and keystroke dataset provided by [START_REF] Clarke | Authenticating Mobile Phone Users Using Keystroke Analysis[END_REF] were used in this experiment. An individual user from the linguistic profiling database was associated with an individual of keystroke and behavioral profiling database to create a virtual subject. As a result, a final database consisting of 30 users, each user having their SMS messages, keystroke and text messaging activity data was created and utilized in this experiment.

Experiment procedure

The experiments investigated the performance both of the individual techniques and their combination. To investigate the linguistic profiling's effectiveness; four types of linguistic features were examined: word profiling, lexical, syntactic and structural. The frequency distribution of a total 133 abbreviations and emotional words were used to create a user's word profiles, including 64 discriminating characteristics of every possible type of feature. To create a user profile, the t-test ranking measure was utilized to rank input features according to its discriminative capability. From the ranking list, features with a p value less than 0.05 were selected to create input vectors. The key to utilizing the t-test was to ensure a set of features that was as unique to the individual authorized user in comparison to the wider population. Therefore, the number of linguistic features required for discrimination will vary between users. Three different classification techniques: K-Nearest Neighbor (K-NN), the Radial Basis function (RBF) and Feed-Forward Multi-Layered Perceptron (FF-MLP) neural networks were utilized with differing network configurations -looking to optimum performance.

In the keystroke dynamics experiment, the hold time vector constructed from five letters: E, T, A, O and N were extracted. A number of analyses were undertaken using the FF-MLP neural network as it had demonstrated the better performance in previous studies over other techniques [START_REF] Clarke | Authenticating Mobile Phone Users Using Keystroke Analysis[END_REF].

For the behavioral profiling technique, the following features were extracted: receiver's telephone number and location of texting. A number of analyses were undertaken, using a Radial Basis Function (RBF) neural network as it had performed the best in the prior study [START_REF] Li | Behaviour Profiling for Transparent Authentication for Mobile Devices[END_REF]. To perform the classification for the individual techniques, the dataset was divided into two groups: 171 data samples were used for the testing set and the remainder was used for training (as illustrated in Table 1). The pattern classification test was performed with one user acting as the valid user, while all others are acting as impostors (a standard procedure in this type of test) [START_REF] Karatzouni | Utilising Biometric for transparent user authentication on mobile devices[END_REF][START_REF] Li | Behaviour Profiling for Transparent Authentication for Mobile Devices[END_REF][START_REF] Sim | Continuous verification using multimodal biometrics[END_REF]. The Equal Error Rate (EER) was calculated to evaluate the system. The EER is the value where False Acceptance Rate (FAR) crosses the False Rejection Rate (FRR), and is typically used as a comparative measure within the biometric industry [START_REF] Jain | Score normalization in multimodal biometric systems[END_REF].

The multimodal experiment was conducted using all possible combination of three techniques. The results of each technique were combined at the matching-level -as each technique utilized different classifiers and a different range of outputs, the minmax score normalization method was applied to scale the results of each technique into the range between 0 and 1. Based upon prior research, two fusion methods were utilized: simple sum and matcher weighting [START_REF] Snelick | Large-Scale Evaluation of Multimodal Biometric Authentication Using State-of-the-Art Systems[END_REF], [START_REF] Clarke | Biometric Authenticating for Mobile Devices[END_REF]. For the Simple Sum fusion, the raw score of each individual technique were simple added and rescaled into the 0 to 1 range. For the Matcher Weighting approach, weights are assigned to the individual matchers based on their individual EER. The weights are inversely proportional to the corresponding errors; the weights for less EER are higher than those of with a high EER.

Experiment results

The results of using individual biometrics and the multimodal approach are shown in Table 2. The results illustrated an average of all the users' EERs by using a single optimized neural network. The results showed that the individual techniques can be used to discriminate users with relatively low error rates for a good proportion of participants. However, further analysis showed that the individual user is able to achieve a better overall EER when each user is permitted to use a different network configuration. By using individually optimized network configurations for individual user, the overall performance was an EER of 8.9%. Behavioral profiling demonstrated the best individual performance using a single network configuration, with keystroke dynamics being the worst performer.

A further analysis of individual performances raises a number of interesting points. Foremost, that the best-case EERs are extremely good. However, it is noticeable that there are some users that experience very high error rates, reiterating the importance of multimodal approaches. As seen in the Table 2, both of the two fusion methods lead to better performance than any of the individual classifiers. Generally, the Matcher Weighting technique outperforms simple sum method. Whilst the results show that on average the use of more modalities leads to a better performance, this is not reflected within the individual user results. On occasions, it was noticed that users performed better when using two inputs (typically LP+BP) rather than three. Therefore in an operational environment case must be taken on selecting the most appropriate classifier. Examining the individual worst-case performance, it can be seen that the multimodal models have significantly improved upon the error ratesfurther supporting the use of multimodal approaches.

A novel framework for active authentication

The concept of Transparent Authentication System (TAS) on mobile devices was first proposed in 2002 [START_REF] Ledermuller | Risk assessment for mobile devices[END_REF]. The framework utilizes a mixture of biometric techniques to verify a mobile user's identity in a continuous and transparent manner. The framework is able to: ─ to increase the authentication security beyond that offered by the password based approach; ─ to provide transparent non-intrusive authentication for the user (rather than intrusive) to maximize user convenience; ─ to provide continuous verification of the user, ensuring that the protection can be maintained throughout the duration of the device usage; ─ to provide an authentication architecture that automatically works on all mobile devices regardless of hardware configuration, processing capability and network connectivity.

A number of process engines and a security manager have been devised to achieve these objectives (as demonstrate in Fig. 1). A detailed description of these processes is presented in the following sections.

Data Collection Engine

Input traits The main duty of the biometric profiling engine is to generate the various biometric profile templates by using the combination of the user's historical data and a number of template generation algorithms. The generated biometric templates will be stored in the Profile Storage and will be used in the verification process.

The main functionality of the Authentication Engine is to perform the user authentication process. The Authentication Engine has the ability to perform authentication for every permutation of inputs to ensure that authentication can be performed even if all of the three biometric samples are not presented (e.g. location may be not be able to be determined). When a verification process is required by the Authentication Manager, the Authentication Engine compares the input samples with the biometric templates to determine the legitimacy of the user. Once the verification process is completed, the verification result is appropriately processed by the Authentication Manager. If the verification result indicates the sample(s) came from authorized user, the sample(s) will be stored within the Profile Storage to be used for profile (re)generation; otherwise it will be deleted. A multibiometric authentication technique may produce a verification result that accepts the samples as coming from the authorized user even though the sample from one individual technique might be rejected as coming from an imposter. Since the overall decision was that the sample comes from the authorized user, the failed samples are deemed to be, in fact, from the authorized user and incorrectly failed. As such, these samples are added to the profile and are not deleted. In this way, the template re-training process can produce a more accurate profile that could provide better performance. This process overcomes a fundamental issue with biometric template re-training and ensuring the correct inclusion of relevant samples.

The framework can operate in both standalone and distributed modes to allow the framework to be useful for non-wireless and wireless devices. If the framework operates in client-server mode, the communication engine works as a bridge between the capture device and the comprehensive framework. When the framework operates in a standalone mode and the device is locked down, the communication engine sends a code to the user which they can use to unlock their device.

Security manager

The Authentication Manager is the central controller of the framework and provides the "intelligence". The key task of the Authentication Manager is to monitor the security level and make authentication decisions when the user requests access to an application. It is the responsibility of the Authentication Manager to handle the security and user convenience trade-off. In order to achieve this, the Authentication Manager utilizes two processing algorithms: the System Security (SS) Level Automatic Update Algorithm and the Application Request Algorithm to manage the balance between the security of the mobile device and user convenience. These processes have been designed based upon a well-known study [START_REF] Clarke | Authenticating Mobile Phone Users Using Keystroke Analysis[END_REF].

The SS level is a sliding numerical value in the range of 0 and +5 with 0 indicating a low security level and +5 indicates a high security level 1 . The SS level changes depending upon the outcomes of the authentication processes and the time that has elapsed between authentication requests. In this proposed framework, each application will have its own security level. The high value application will have a high security level and a normal application will have a low security level. This can be achieved either manually by the user or automatically by the system, using a database stored in the Long-term Storage. Prior research has investigated simple mechanisms by which these risk-based evaluations for applications can be made [START_REF] Ledermuller | Risk assessment for mobile devices[END_REF].

The Authentication Manager utilizes the SS Level Automatic Update Algorithm in order to periodically update the SS level based on the results of authentication decisions based upon the user's input samples. The Authentication Manager periodically sends an authentication request to the Authentication Engine in order to update the SS level. The time interval in which the authentication should be requested depends upon the user's preference (i.e. every 5 minutes). Initially, the Authentication Manager requires the Authentication Engine to perform authentication using the best set of the user's input samples (i.e. utilizes the classifier with the lowest EER that samples exist for) from the last x minutes (i.e. 5 minutes). In a case where no user's input data is presented, the Authentication Manager maintains the SS level at its latest updated value. However, if the Authentication Engine responds with a pass then the Authentication Manager updates the SS level and subsequently reverts back to monitoring mode. If not, the Authentication Manager decreases the SS level and sends an authentication request again by using the next best set of user's input samples. The Authentication Manager will try three times to send an authentication request, every time with the next best available sample being employed. The Authentication Manager updates the SS level based upon the authentication result. The SS value is increased or decreased based on the type of sample used. For example, a sample using the keystroke dynamics technique will have an increment/decrement value of 0.5; a sample which contains both linguistic profiling and behavior profiling will have an increment/decrement value of 2. This numbers are based on the performance of the technique or combination of techniques. In scenarios where the updated SS level is less than 0, the Authentication Manager will set the SS level back to 0, meaning that the user will be able to access only the applications that do not required security. The process gives bias toward the user as they are given three non-intrusive chances to authenticate correctly and no intrusive authentication requests. This enables the system to minimize inconvenience to its user. Should the user attempt to access applications that require a SS level greater than the current SS level, the Authentication Manager will utilize the Application Request Algorithm to check the legitimacy of the user as shows in Fig. 2.

Fig. 2. Application Request Algorithm

The current SS level of the user is compared with the security level of the requested application. If the level is equal to or greater than the security level of the required application, the user can automatically access the application. Otherwise the user will be asked intrusively to authenticate. If the authentication response to this intrusive request fails to pass, the device is locked. Otherwise, the level of the user will be updated to the security level of the requested application and access will be granted.

Evaluation

To examine the effectiveness of the framework in providing security and user convenience, the proposed framework was evaluated through a simulation. The simulation process involves implementing a virtual user and applying the SS Level Automatic Update Algorithm and the Application Request Algorithms.

To evaluate the performance of the security mechanisms to an authorized user, three different usage levels (infrequent, moderate and frequent) will be investigatedas the level of usage will have a direct impact on the availability of biometric samples and thus the capability of the system to maintain the security level. The use of the mobile device is simulated using a flow of timeslots. Each time slot can be seen as a minute in real life. Within each time slot the user can do one of two actions, or both: provide an input sample (thus simulating a text-based entry) or the use an app. Within each timeslot, the probability for the user to provide an input sample or accessing an application will set to 0.05, 0.15 and 0.50 in order to simulate an infrequent, moderate and frequent user respectively. There are 6 different types of application that can be chosen by the user (reflecting the possible security levels of an application from 0 to 5). Each type of application has the same probability of being accessed. Similarly, there are 7 different non-intrusive techniques (refer to Table 2). Given that within a time slot the user provides an input sample, each type of technique has the same probability of occurring.

All non-intrusive techniques are evaluated based upon the EER of each authentication technique as demonstrated in the experimental result section. This means that, when the system evaluates a sample, there is a probability (equal to the EER of the technique) that an authorized user will be rejected or an imposter will be authorized. With regards to the intrusive authentication requests, the probability of an authorized user and impostor being rejected and accepted respectively is set to 0.03. This approach to the methodology removes any bias and provides for a randomly generated dataset with a mix of samples, performances and application requests across three usage scenarios. To further remove any bias that would exist from a single run of the simulation, the simulation is repeated.

The security system will work as described in the Security Manager session. The SS will be updated every 10 minutes. If the mobile device is not used for 10 minutes consecutively, the SS will be decreased by 0.05 for every following minute, until the system is used again. The simulation simulated the use of the mobile phone for 12 hours or 720 minutes.

In order to examine the ability of the system security to prevent an imposter from using the mobile device, two scenarios were simulated: an imposter using a mobile device at the initial state (SS =0) and the imposter using a mobile device starting from a high level of security (SS=5). This can simulate an imposter taking control a mobile device which has just been used by the authorized user.

5.1

Simulation results

The result for all scenarios is represented using the average of running the simulation 10 times. The simulation results for an infrequent, moderate and frequent authorized user are presented in Table3. Based upon the simulation results, it can be shown that the security system can provide a high level of security whilst minimizing user inconvenience in all three scenarios. Analysing the proportion between intrusive authentication request and application access permits an insight into how often the user experiences an intrusive authentication request. Ideally, this proportion would be zero meaning that the user would not be required to perform an intrusive authentication request when they access an application. In our simulation these values are 13%, 2% and 0.6%, for the infrequent, moderate and frequent user respectively. The infrequent user experiences a higher intrusive request because it will probabilistically have fewer samples in the system and the system decreases the SS level if the device is not used for 10 consecutive minutes. Therefore, when this user want to access an application, it is more likely that its SS will not be sufficient to be granted immediate access. Throughout the complete 720 minute simulation the device was never incorrectly blocked for the authorized user. Further analysis of the results demonstrates for a level 5 app (which is arguably sensitive enough to warrant authentication of the user), this transparent approach results in a 97.5% reduction in intrusive authentication requests (for a frequent user).

The simulation results of the imposter scenarios showed that the security system blocks the imposter from using the mobile device after few minutes in both cases (as illustrated in Table 4). The reasons for this is that when the imposter tried to access an application that required a security level greater than 0, the system requested the imposter to authenticate themselves using an intrusive technique three times. There is a really small chance for the imposter to successfully authenticate, so after three requests the device will be blocked. As expected, the system will take more time to block the device if the imposter starts using the device when the SS is high.

Discussion

The simulations show how the proposed framework can provide a good compromise between improving the level of security provided and without increasing the user convenience. Indeed, it can be argued that user convenience under this model is also significantly improved over existing approaches. However, further investigations are required in order to better examine the values of the parameters. For example, it seems clear that the verification time does play an important role of providing security and user convenience. By regularly authenticating the user, the user will suffer more intrusive authentication requests but the system will be able to recognize an imposter in a relatively short period of time. On the other hand, users will find the device more convenient to use with longer time periods between user authentications but the system will take longer to recognize an imposter and lock down the system. In our simulation the verification time was 10 minutes. However, this may not be the optimum compromise between convenience and security.

Similarly, decreasing SS level was not examined, but it is expected to play a relevant role in the system. The infrequent user will experience less challenges from the intrusive authentication technique when the time period of the degradation function gets longer. However, the imposter will have more chance of accessing a high level application in cases where the device was initially left with a high level SS. In this simulation, a linear function is used to decrease the SS level but it is suggested that the function for degrading the SS level should be implemented using an exponential function as it decrease slowly at first and then more rapidly.

Conclusions & Future Work

The first part of this paper presented a feasibility study that demonstrated the ability of utilizing text-based entry to authenticate users. The use multimodal biometrics, specifically the combination of linguistic profiling, behavior profiling and keystroke dynamics showed an excellent level of recognition performance, validating the feasi-bility that multimodal text-based has the ability to authenticate user on mobile devices.

The novel multimodal authentication framework subsequently presented to support text-based biometrics was designed to add additional security to a mobile handset, providing transparent and continuous authentication. The system is designed using a variety of single and multimodal biometric techniques without any additional hardware. The users can benefit from the framework in terms of both device security and convenience of use. By setting various security requirement levels for different applications/services based upon their risk, the framework is capable of controlling the impact on each application/service. The simulation results clearly showed that the proposed authentication framework is able to provide continuous and transparent authentication to protect mobile devices.

Future work will focus upon the development of a more representative and larger biometric corpus from which to further examine the level of recognition performance that can be achieved. To accompany this work, an operational prototype will also be developed to enable an end-user evaluation to be undertaken so that user acceptance and operational performance can be established.

Fig. 1 .

 1 Fig. 1. Text-based multimodal framework

Table 1 .

 1 Final dataset used in the experiments

		Training size	Testing size
	Linguistic profiling	316	171
	Keystroke dynamics	3339	171
	Behavior profiling	1178	171

Table 2 .

 2 Experiment results for text-based authentication

			Equal Error Rate (EER)%
		Average	Best Case	Worst Case
	Linguistic Profiling (LP)	12.8	0.0	40.0
	Behavioral Profiling (BP)	9.2	0.0	50.0
	Keystroke Dynamics (KA)	20.8	0.0	50.7
	Fusion by Sum
	Multimodal (LP+BP)	5.5	0.0	30.6
	Multimodal (KA+BP)	6.2	0.0	20.0
	Multimodal (LP+KA)	11.2	0.0	45.0
	All techniques	4.4	0.0	18.1
	Fusion by Matcher Weighting
	Multimodal (LP+BP)	3.6	0.0	20.0
	Multimodal (KA+BP)	5.3	0.0	20.2
	Multimodal (LP+KA)	8.5	0.0	44.7
	All techniques	3.3	0.0	19.3

Table 3 .

 3 Simulation results for different types of authorized user

		Infrequent User	Moderate User	Frequent User
	App	#App	#Intrusive	#App	# Intrusive	#App	# Intrusive
	Level	Request	Request	Request	Request	Request	Request
	5	7.2	4.2	16.2	1.5	60.0	1.50
	4	5.1	0.4	17.9	0.5	60.1	0.50
	3	7.3	0.3	20.0	0.2	61.3	0.30
	2	5.9	0.2	16.8	0.3	59.6	0.10
	1	6.0	0.0	19.5	0.2	55.2	0.00
	0	6.7	0.0	19.3	0.0	57.6	0.00
	Total	38.2	5.1	109.7	2.7	353.8	2.40

Table 4 .

 4 Simulation results for imposter user start using device at SS=0 and 5

		Device at SS= 0	Device at SS= 5
	App	#App	# Intrusive	#App	# Intrusive
	Level	Request	Request	Request	Request
	5	0.6	0.4	1.0	0.2
	4	0.3	0.1	1.8	0.6
	3	0.4	0.4	1.5	0.0
	2	0.4	0.2	1.3	0.1
	1	0.3	0.1	1.9	0.1
	0	0.4	0.0	1.0	0.0
	Total	2.4	1.2	8.5	1.0
	Time In Use	5.0 minutes	14.7 minutes

The boundaries defined on the numerical scale are only provided as a suggestion. In practice, these values maybe redefined.