Yannick Benezeth
email: yannick.benezeth@orange-ftgroup.com

Hélène Laurent
email: helene.laurent@ensi-bourges.fr

Bruno Emile
email: bruno.emile@univ-orleans.fr

Christophe Rosenberger
email: christophe.rosenberger@greyc.ensicaen.fr

Towards a sensor for detecting human presence and activity

Keywords: human detection, presence sensor, occupancy number detection, activity characterization, people localization

Introduction

The building sector is now one of those that consumes most energy. For example, in France, the building sector is responsible for 21% of the CO2 emission and for 43% of the total energy use. To economize energy, there are several solutions: first ted by humans of wavelengths between 6 and 14 µm. When a person moves in the detector field of view, the infrared radiation is focused by the Fresnel lens on the pyroelectric sensor. The corresponding moving hot spot causes the electronics connected to the chip to activate the detection. This technology is now well known and commonly used for lighting management, automatic door openers etc. However, it has several major flaws:

• motionless people can not be detected,

• the sensor is sensitive to shifts in air flow or sunshine radiations,

• the sensor is not able to distinguish between pets and humans.

The technological limits of these sensors, which are more motion than presence detectors, hinder the development of innovative solutions for energy consumption management. Conventional systems relying on a single occupancy sensor often suffer from a lack of data analysis of the measured sensor signals and cannot moreover differentiate between one or more occupants in the monitored space. In order to overcome these limits, several works have been conducted. They can mainly be gathered into two groups. The first one recommends the use of multiple low-cost, non-intrusive, environmental occupancy sensors, privileging the use of an independent distributed detectors network combined with a probabilistic data analysis. The second one applies for more expensive sensors such as video cameras.

The approaches belonging to the first group, that fuse together information from multiple sources, result in virtual sensors which are intended to be more powerful than single physical sensors [START_REF] Dodier | Building occupancy detection through sensor belief networks[END_REF][START_REF] Dong | An information technology enabled sustainability test-bed (ITEST) for occupancy detection through an environmental sensing network[END_REF]. One proposal consists in combining, at occupied areas in the work space, three traditional inexpensive PIR occupancy sensors complemented with a sensor that determines when the telephone is off-hook [START_REF] Dodier | Building occupancy detection through sensor belief networks[END_REF]. If the use of probabilistic models offers improved capability of detecting occupant presence, the fundamental dependance on motion still remains. In order to address the problem of discerning the actual number of people in a room, complex sensor networks have been proposed. A second alternative, composed of a wireless ambient-sensing system complemented with a wired carbon dioxide sensing system and a wired indoor air quality sensing system, is considered to determine which parameters have the greatest correlation with the occupancy level [START_REF] Dong | An information technology enabled sustainability test-bed (ITEST) for occupancy detection through an environmental sensing network[END_REF]. The conducted tests show that, for the considered open office plan, CO 2 and acoustic parameters have the largest correlation with the number of occupants, complications arising however with acoustics because of the affect of sound by activities in nearby bays. Even if the proposed system achieves reasonable tracking of an actual occupancy profile, the achieved accuracy does not exceed 75% and, for certain days, it remains relatively low (e.g. 60%). Moreover, further exploration of sufficient training set sizes is needed.

Video cameras are also common especially when access to people activity or recognition are pursued [START_REF] Han | Fusion of color and infrared video for moving human detection[END_REF][START_REF] Turaga | Machine Recognition of Human Activities: A Survey[END_REF]. The main drawbacks of this solution are the need of large amounts of data storage and above all to interfere with privacy concerns. That is why several works propose to work with low-resolution cameras [START_REF] Amin | Automated peoplecounting by using low-resolution infrared and visual cameras[END_REF] or even develop "reduced" sensor from camera with a very different appearance from conventional video camera, allowing to obtain enough information to detect person's position and movement status but reducing the psychological resistance of having a picture taken [START_REF] Nakashima | Development of privacy-preserving sensor for person detection[END_REF].

Other approaches focus on occupancy location detection using ubiquitous and pervasive computing environments, often requiring non-ambient sensors such as wearable devices for tracking inhabitant activity [START_REF] Chan | A review of smart homes -Present state and future challenges[END_REF]. If the major drawback of users psychological resistance to image capture can be overcome, the use of video camera remains the single sensor allowing to extract at the same time a wide range of information from low-level to high level interpretation. We can finally notice that most of the approaches privileging the use of multiple low-cost detectors exploit a camera network to establish the true occupancy information. The true occupancy numbers are then manually counted from the camera pictures [START_REF] Dodier | Building occupancy detection through sensor belief networks[END_REF][START_REF] Dong | An information technology enabled sustainability test-bed (ITEST) for occupancy detection through an environmental sensing network[END_REF]. In order to at least facilitate the validation of new designed occupancy sensors, whatever can be the chosen technology, the design of an automated occupancy detector exploiting movies is needed.

The works presented in this article take place within the CAPTHOM project which fits with the theme "Energy Management in Building" and aims at developing a reliable and efficient sensor to detect the presence of humans in indoor environments, using a static camera. The foreseen concerned sectors could be residential or tertiary areas. The main objectives of such a system are the power consumption management and the increase of comfort for residents, including for example heating adjustment considering their activity. Adaptability is also pursued. The CAPTHOM component must be easily integrated into other application areas related to security or supervision and assistance for elderly or disabled people, at home or in institutions.

The sensor must be able to detect the presence of a person in its environment without being disturbed by the presence of animals, other moving objects or by the morphology or activity of people. The sensor must be robust to light changes, heat sources and be able to detect people up to 15 meters. The complexity of the proposed algorithms, the used memory must be consistent with material constraints so that the treatment could be carried out in an embedded architecture. The developed system must therefore be an optimal compromise between false detection rate and algorithmic complexity. The proposed solution must be cheap, have a short time response and respect the European directive 2005/32/EC of 6 July 2005 establishing a framework for the setting of eco-design requirements for energy-using products. Energy consumed by the sensor must be very low. Finally, the use of cameras imposes the respect of privacy and also implies the acceptance problem of this sensor by users. These issues were considered in the CAPTHOM draft and it was decided that the camera and its processing unit will only return useful information for the building management system. For the application, none image will be transmitted by the sensor to external devices.

We propose in this article, algorithmic solutions to detect people from image sequences. Several chal-lenges must be settled :

• first, an image is a 2D representation of a 3D scene. The same object, observed from different views, may look very different,

• secondly, the image acquisition conditions may change from one environment to another. They can also vary all time long,

• thirdly, the backgrounds can be very complex.

The possibilities of false detections are numerous and the contrast between people and background may possibly be very low,

• fourthly, many occlusions may appear between the person and the environment or among several individuals,

• finally, the main difficulty encountered for people detection is the very high intra-class disparity.

Through their clothes, size, weight, outline, haircut etc., two individuals may appear very different. Moreover, the human body being highly articulated, the number of possible postures is great and the characteristics will vary in time.

In order to develop a system able to manage many of these situations, we tried to take into account all these difficulties. We developed a system using video analysis to interpret the content of a scene without doing strong assumptions about the nature of objects that could be present. Objects nature is determined by statistical tools derived from object detection. The next section describes the proposed algorithm using tools classically dedicated to object detection in still images in a video analysis framework. We then present various extensions of the project including its potential ability to recognize people activity. Finally, some conclusions and perspectives are given.

Presence sensor

In this section, we describe the human detection system proposed for the CAPTHOM project. It is based on video analysis obtained from a camera. This method has three main steps: change detection, moving objects tracking and classification. Figure 1 sums up the defined process for human detection.

Change detection

Working with static camera, the search space can be reduced by detecting regions of interest in the image where there is a high probability to find a person. This first step is achieved through a background subtraction: from an environment model and an observation, we try to only detect what has changed.

According to the results obtained in the comparative study of background subtraction algorithms [START_REF] Benezeth | Review and Evaluation of Commonly-Implemented Background Subtraction Algorithms[END_REF], we decided to model each pixel of the background by a Gaussian probability density function [START_REF] Wren | Pfinder: Real-time tracking of human body[END_REF]. This quite simple model is a good compromise between quality of detection, computation time and memory requirement.

Since the scene is never completely static, the model must be designed to adapt to different environment changes, such as:

1. slow variation in lighting conditions, caused for example by natural change of daylights, 2. sudden and significant variation due for example to artificial extra lighting adding, 3. addition or removal of static objects.

The background model is consequently updated at three different levels: the pixel level updating each one with a temporal filter allowing to consider long time variations of the background, the image level to deal with global and sudden variations needing to reset the whole model and the object level to deal with the entrance or the removal of static objects. Performing these different updates at various levels, allows to manage the most common variations of the environment.

Tracking

After detecting the foreground pixels, the first step of tracking consists in gathering them into connected components, also called blobs afterwards, one blob ideally corresponding to one object (human or not) of the scene. Figure 2 presents an example of result which can be obtained after connected components gathering where one specific color has been attributed to each blob. The objective of this step is to collect a history of movements for each blob. A blob potentially cor-responding to one object, we would like to isolate each object of the scene and label it consistently over time. This history will be very useful to increase the overall system performances by smoothing in time misclassifications. In order to respect the constraints on computation time and to spare memory space, we decided to avoid complex model of tracking objects. The tracking process is then simply initialized with the connected components detected with the background subtraction. At every time t, we have to pair the list of detected blobs and the list of objects tracked in previous frames. To make the correspondence between these two lists, we use the matching matrix H t defined as:

H t =    β 1,1 . . . β 1,N . . . . . . . . . β M,1 . . . β M,N    ( 1
)
where M is the number of tracked objects and N the number of blobs present at time t. If the tracked object i corresponds to the connected component j, β i,j is set to 1, otherwise β i,j = 0. Each object is characterized by a set of interest points that are tracked frame by frame. The tracking of interest points is carried out with the pyramidal implementation of the Lucas and Kanade tracker [START_REF] Lucas | An iterative image registration technique with an application to stereo vision[END_REF][START_REF] Bouguet | Pyramidal implementation of the lucas kanade feature tracker: Description of the algorithm[END_REF] with two additional constraints:

1. a tracked point must belong to the foreground; otherwise, the considered point is removed from the list of points and a new one is created, 2. when creating a new point, a distance constraint to other interest points is imposed in order to have an homogeneous distribution of points on any subject.

The correspondence between tracked objects and blobs is made if a minimum fixed percentage of interest points present on a blob is associated with an object. The use of interest points also allows to manage some difficulties implied by our tracking method directly based on connected components. For example, when two distinct objects are very close, they form only one connected component and at the opposite, the same object can be represented by several blobs if there is a partial occlusion. The implemented tracking of interest points allows to deal with these common cases [START_REF] Benezeth | Vision-based system for human detection and tracking in indoor environment[END_REF]. Figure 3 presents one example of results obtained after tracking. Partial occlusion is present when the two persons cross each other. We can observe from this example that the label of each person is consistent in time.

Recognition

Once regions of interest are detected and monitored, we have to detect their nature, namely if they correspond to a human or not. The classification method used in the proposed algorithm mainly relies on the one introduced by Viola and Jones [START_REF] Viola | Rapid object detection using a boosted cascade of simple features[END_REF], based on Haar-like filters and a cascade of boosted classifiers built with several weak classifiers trained with a boosting method [START_REF] Schapire | The boosting approach to machine learning: An overview[END_REF].

Humans are detected in a sliding window framework. An area of interest is defined around the tracked object with a margin d on each side of its bounding box. This area of interest is analyzed by the classifier with various positions and scales. Figure 4 presents the bounding box of one detected object and the area of interest surrounding it. In a practical way, the classifier analyzes the area of interest with a constant shift in the horizontal and vertical directions. As the size of the person potentially present is not a priori known and the classifier has a fixed size, the area of interest is analyzed several times by modifying its scale. The size of the area of interest is divided by a fixed factor between two scales. By using a sliding window on several scales and positions, there are logically several overlapping detections which represent only one person. To fuse overlapping detections, we use, in order to have a fast computation, a simple average of results which intersect. The criterion of the Pascal competition [START_REF] Everingham | The PASCAL Visual Object Classes Challenge[END_REF] is used to detect the intersections. Figure 4 illustrates the multiple detections.

As in indoor environment, partial occlusions are frequent, it is clearly not sufficient to scan the area of interest only looking for forms similar to the human body in its whole. The upper part of the body (head and shoulders for example) is often the only visible part. It is possible to use a multiple parts representation of the human body in order to increase the robustness of the global system and manage partial occultation [START_REF] Mikolajczyk | Human detection based on a probabilistic assembly of robust part detectors[END_REF]. In practice, we used four classifiers: It is important to use multiple classifiers for the upper body. Indeed, we empirically observed that a single classifier for the head and shoulders, under all points of view, was not sufficiently robust.

A confidence index I i,t is then built for each tracked object i at time t depending on the confidence index obtained at previous frame and on confidence indexes corresponding to the detection result of each of the four classifiers. The final decision concerning the nature of the tracked object i is done using a simple thresholding.

Validation

In order to validate the proposed system, we first of all defined an experimental protocol including the definition of a test database, the implementation of reference algorithms to evaluate the relative performances of the proposed method and the choice of a comparative metric. These different sets and the obtained experimental results are presented in the next sections.

Test database

The consortium partners expressed their specific needs through a set of reference scenarios for which the sensor, namely the proposed algorithm, must respond appropriately. An extract of a scenario example is presented in figure 5. At each location, a set of charateristics (temperature, speed, posture, activity...) is associated with the formalism defined within the CAPTHOM project [START_REF] David | A Sensor Placement Approach for the Monitoring of Indoor Scenes[END_REF].

Three classes of scenarios constitute the evaluation database:

1. scenarios corresponding to a normal use of a room. In these scenarios, you can find one or more individuals that are static, moving, sitting or standing. These scenarios represent 14 videos realized in 9 different locations (offices, meeting rooms, corridors and dining rooms), 2. scenarios of unusual activities (slow or fast falls, abnormal agitation). 7 videos correspond to these situations, 3. scenarios involving all the stimuli of false detections identified by the consortium partners (variation of illumination, moving objects etc.). These situations represent 8 videos.

The total dataset is then composed of 29 videos taken in 10 different locations. The videos have a resolution of 320 × 240 and have an "average" quality since they were acquired with a simple webcam. Figure 6 presents examples of results corresponding to various scenarios.

Selected methods from the state of the art

In order to evaluate the interest of the proposed system to provide information on the presence or ab-sence of human face to existing algorithms, we compared it with three reference systems:

• IRP: an existing person detector based on passive infrared technology,

• Haar-Boost: the detection system of Viola and Jones used with a sliding window scanning each image,

• Haar-Boost + BS: the previous method in which the search space of the classifier is reduced with a background subtraction.

Comparative metric

The results are presented using the confusion matrix (cf table 1), where:

• a is the number of correct detections (true positives),

• b is the number of missed detections (false negatives),

• c is the number of false detections (false positives),

• d is the number of true negatives.

Percentages are then computed.

Results extracted from a corridor scene with one or several individuals walking.

Results extracted from a meeting room scene with partial occlusions.

Results extracted from a laboratory scene with sudden illumination changes.

Table 1: Example of confusion matrix (1) and presentation of results in percentages (2).

Experimental results

The performances obtained with the vision methods being highly dependent on the chosen scale factor, the algorithms have been tested with different values of this parameter. Only the best results for each method are presented here. Table 2 gathers the average results obtained on all scenarios.

We can first notice that the IRP detector presents quite low performances. Its main drawback is that it can only detect changes in temperature and therefore the movement of people. This characteristic induces many missed detections (false negatives) for many scenarios. Then, with Haar-Boost, even if the results are significantly better, the outcomes do not make a sufficient gap with commercial detectors. The number of false negatives and false positives remains too high. With Haar-Boost + BS, the number of false positives is significantly reduced. Indeed, with this method, the background subtraction can reduce the classifier search space and consequently the possible false detections. Finally, with the proposed method, we access to a history of people movements. We are able to average in time detections and therefore de- tect a person even if, at a given time, the classifier can not recognize a person (laying person, poor contrast). These results illustrate the benefits of jointly using background subtraction and tracking. The performance of the proposed method is good with a detection rate of 97% and a false detection rate of about 3%.

Applications

While it is important to have some information on the presence or absence of persons in an environment, it is not necessarily sufficient and computer vision can also help in collecting other useful information for the management system. We present in this section some examples of applications integrated into the CAPTHOM draft.

People counting

Improved building operation with respect to energy management and indoor environmental quality will be possible with an accurate detection of building occupancy resolved in space and time. Occupancybased switching for power management of office equipment is one of the goal explicitly mentioned in the CAPTHOM project. In order to develop a demand-controlled ventilation or heating, it can be interesting to access, through the proposed sensor, to the current occupancy number of a supervised area. This information can be derived from the CAPTHOM sensor.

As an example, figure 7 presents the occupancy results obtained on two videos: the first one corresponds to an office scene ("Office" video), the second one to a corridor scene ("Corridor" video). The x-axis corresponds to time samples and the yaxis is the number of occupants in the space. The blue line is the actual occupancy profile and the red line is the estimated number of occupants, simply derived from the CAPTHOM sensor through a temporal smoothing. The profiles illustrate that the estimations track changes in occupancy fairly well. The obtained results describe, with a small delay, the major changes in occupancy. For an occupancy-based control scheme, this smoothed behavior is sufficient because abrupt fluctuations of short duration are rather

Results extracted from the "Office" video.

Results extracted from the "Corridor" video. insignificant. The total accuracy (number of correctly estimated points divided by the total number of points) is around 93% for the "Office" video and 83% for the "Corridor" video. Both videos present one or two persons walking or sitting, with temporary partial occlusion. Interpreted images extracted from these two videos are presented in figure 8. The lower performances obtained for the second video are mainly due to the bad estimation done during the [60s-80s] period where only one person is detected while two are present. During this lapse of time, two persons enter the corridor in close succession, the first one occulting the second one quite entirely during about 20 seconds. With only one sensor, it is then impossible to distinguish one person from another. The second image presented in figure 8 for the "Corridor" video illustrates this situation. The use of two CAPTHOM sensors could allow to overcome this problem.

Activity characterization

Easily derived from the CAPTHOM sensor, it is possible to access a simple quantification of people activity which could be useful, for example, to automatically regulate the heating. One can indeed imagine that the heat input that regulates the room temperature could differ depending on the number and activity of detected people. The foreseen activity characterization does not here include the semantic level of activity but simply a measure of restlessness.

The proposed test is based on the ratio between the number of pixels in motion and the number of pixels in the foreground. Since foreground pixels are available at each time t through the background subtraction step, we only need to calculate motion detection. Let A s,t be the result of movement detection defined by:

A s,t = 1 if d 2 (I s,t , I s,t-η ) > τ A 0 otherwise, (2)
where d 2 (I s,t , I s,t-η ) represents the Euclidean distance between the pixel s at time t and the same pixel at time tη and τ A is a threshold. A s,t = 1 means that the pixel s is in a motion area. Figure 9 presents an example of foreground (X s,t = 1) and corresponding motion picture (A s,t = 1) obtained from a corridor scene. The measure of activity at time t, is performed by calculating the ratio between the number of pixels in motion and the number of pixels in the foreground: where S is the number of pixels in the image. A time filtering can be used to smooth over time the activity.

κ t = s∈S A s,t s∈S X s,t (3) (a) (b) (c)
To validate this measure, we used this activity test on two groups of videos (extracted from the video dataset described in section 3.1). Group 1 gathers 21 videos with low physical activity (stage office, meeting etc). Group 2 gathers 6 videos with greater activity (corridor scenes or restless people). Figure 10 presents the evolution over time of the activity measure in two areas with distinct activities. The first case illustrates a corridor scene where each peak of the κ measure corresponds to the passage of a person. The second case corresponds to a meeting room where the two main peaks in the κ measure correspond to entrance and departure of people. Table 3 presents the results of activity measure into two classes "active" or "quiet". We can then observe that despite the simplicity of this measure, it is pos-sible to obtain, with an interesting confidence level, a measure of the overall activity of humans. We get 91% of quiet response when the content of the scene is actually quiet and 100% of right answer for scenes with greater activity. quiet active quiet 0.91 0.09 active 0.00 1.00

Table 3: Confusion matrix over the classification of the scenes content between "quiet" and "active".

These results are of course dependent on the relative subjectivity of the activity concept. However, the proposed criterion of equation ( 3) allows to simply quantify the activity of people in a room. This measure of activity has two main advantages. First of all, it is very simple to calculate, especially since the foreground mask has already been calculated during the detection of persons. This criterion can be consequently easily implemented in an embedded hardware. Second, this measure does not depend on the camera point of view or on the distance between the humans and the camera. Despite of its simplicity, this information can be useful to automatically regulate heating.

People localization in a known environment

For home care applications, it may be interesting to know the position in space and posture of the detected individuals. Combining this information, we can detect abnormal situations: a person lying on his bed is a common situation, a person lying on the ground can certainly reflect a distress one.

First of all, two CAPTHOM sensors can be combined and mountained side by side. Each video stream of the stereovision system will then be independently processed based on the proposed algorithm before their results are merged together through a fusion step. Knowing the epipolar geometry of a stereovision system, each point observed in one image corresponds to an epipolar line in the other image. The so-called fundamental matrix can typically be used to determine such correspondance, the most commonly implemented method proposed to estimate it, being the 8-points algorithm [START_REF] Hartley | Multiple view geometry in computer vision[END_REF]. The fundamental matrix can also be obtained by combining the extrinsic and calibration matrices of each camera allowing to estimate the 3D position of each detected person. This information can reveal itself particularly interesting for the foreseen application.

It is then possible to locate humans in 3D and so to verify their activities. Figure 11 presents the estimated path of a person drawn into the floor map. In this figure, the individual enters from the right door, stays for a while near the shelf, and then leaves through the same door. We can note that this information is sufficient for home care applications where a more precise location would not be useful. Possible improvements can be obtained combining different sensors. Most of the methods presented above were meant to work on daylight cameras (or visible). However, as their cost keep decreasing, farinfrared (FIR) cameras (often called IR or thermic cameras) gain more interest for human detection [START_REF] Bertozzi | Infrared Stereo Vision-based Pedestrian Detection[END_REF], [START_REF] Xu | Pedestrian Detection and Tracking With Night Vision[END_REF], [START_REF] Benezeth | A Real Time Human Detection System Based on Far-Infrared Vision[END_REF] as they provide numerous advantages (night vision, relatively uniform backgrounds, etc.). However, as opposed to daylight cameras, FIR cameras fail at detecting humans in hot summer days and often suffer from floor reflection. If one can link a point in one image to its corresponding epipolar line in the second image, this correspondence can also be used to confirm every human shapes detected in one camera with those detected in the other camera. Lets consider that M human shapes have been detected in the first image and N have been detected in the second image. We consider each top-left and bottomright points of the i th human shape (represented by a bounding box) in camera 1 and construct the re-spective epipolar lines in the camera 2 image using the fundamental matrix. As shown in figure 12, in our method, a detected shape i ∈ [1; M ] in camera 1 is kept if and only if there is a shape j ∈ [1; N ] such that the distance between the top-left and bottomright points of the j th shape and the corresponding projected epipolar lines is smaller than a predefined threshold (obtained empirically). In figure 12, two human shapes have been detected in camera 1 and only shape 1 has been kept. Of course, this algorithm is used both ways such that the shapes in camera 1 are confirmed with those in camera 2 and vice versa. FIR image and a daylight image with false positives. On the second row, detections have been fused with our method and false positives (the reflection on the floor on the left and the chair on the right) have been deleted. Precision/Recall curves obtained with this fusion process put into obviousness the improvement of human detection performances in both spectrums. Note that our fusion procedure is very fast since it only requires two projections per detection.

Conclusion

We have presented in this article a vision algorithm to detect human presence in an indoor environment. This algorithm combines background substraction, tracking and recognition. The evaluation of the proposed sensor, in many scenarios, gives a detection rate of 97%. The few remaining errors mainly come from three sources. A possible error is when a person is not detected. Through objects tracking, this case is relatively rare because the detections are smoothed in time with the confidence index. However, it is possible that a person remains in a static configuration that the classifier does not recognize. These misdetections are mainly encountered when the contrast between the person and the background is not very distinctive or when the person takes a unusual posture. Then, when a person remains static for a long time, it is gradually included in the background model. If the setting speed of the background updating is properly fixed, this is not a problem. However, when the person moves again, there will be a "ghost" at the corresponding location. This ghost will be included in the background model through the object level update, but, the time lag between the departure of the person and the updated model of the background can lead to false detection. The third source of error directly comes from a possible failure of the background subtraction. Due for example to an illumination change of the scene, false detections can occur. Nevertheless, the different levels of background model updating restrict the appearance of such cases. Some applications, including occupancy and activity characterization, have been presented. Initially intended for controlling office ambient conditions, many other developments can be envisaged. The vision can also be used to detect distress situations, such as the fall, without using a specific device but incorporating an additional module to the CAPTHOM sensor. An accurately known occupancy, both in time and space, can also allow to develop operational strategies for a better allocation of emergency personnel and resources in critical situations where every second counts. As part of the support, it can finally be useful to know the identity. Indeed, it may be advantageous to be able to distinguish between caregivers and patients. Similarly, to alert when there are people in places where they are not supposed to be, you need to know their identity. The use of cameras, with biometric technology, could be an interesting contactless solution for remote identification.

Figure 1 :

 1 Figure 1: Process for human detection and activity characterization in video sequences. Illustration of the different intermediate results obtained all along the human detection chain: original image, change detection, tracking and recognition.

Figure 2 :

 2 Figure 2: From the left to the right: original image, result obtained after background subtraction and finally after connected components gathering.

Figure 3 :

 3 Figure 3: Illustration of tracking results with transient partial occultation. The first line corresponds to input images with interest points associated with each object (one color per object), the second line presents the tracking result with the label obtained for each tracked object.

1 .

 1 the whole body (regardless of view point), 2. the upper-body (head and shoulders) from front or back views, 3. the upper-body (head and shoulders) from left view, 4. the upper-body (head and shoulders) from right view.

Figure 4 :

 4 Figure 4: From the left to the right: search area analyzed by the classifier and resulting multiple detections.

Figure 5 :

 5 Figure 5: Extract of a scenario example defined by the industrial partners involved in the CAPTHOM project.

Figure 6 :

 6 Figure 6: Examples of results corresponding to various scenarios.

Figure 7 :

 7 Figure 7: Occupancy estimation results on two videos respectively corresponding to an office and a corridor scene.

Figure 8 :

 8 Figure 8: Examples of results extracted from the "Office" and "Corridor" videos.

Figure 9 :

 9 Figure 9: Examples of images used to measure the activity (a) input image (b) foreground (c) motion picture.

Figure 10 :

 10 Figure 10: Time evolution of the proposed activity measure in the case of a frequent passage zone (a) and (c) and in the case of a quiet meeting area (b) and (d).

Figure 11 :

 11 Figure 11: People localization and path estimation.

Figure 13

 13 presents on the first row, detections in a

Figure 12 :

 12 Figure 12: Example of detections fusion using the epipolar geometry (a) detections in camera 1 (b) detections in camera 2 and epipolar lines obtained related to camera 1 (c) detections in camera 1 kept after fusion.

Figure 13 :

 13 Figure 13: First row: detection examples without fusion step. Second row: detection examples with the stereovision system.

Table 2 :

 2 Confusion matrix obtained on all scenarios.

		+	-		+	-		+	-	+	-
	+	0.40 0.60	+	0.77 0.23	+	0.77 0.23	+	0.97 0.03
	-	0.31 0.69	-	0.58 0.42	-	0.03 0.97	-	0.03 0.97
		IRP			Haar-Boost		Haar-Boost + BS	Proposed method

Acknowledgements

This work was made possible with the financial support of the Regional Council of Le Centre, the French Industry Ministry within the CAPTHOM project of the Competitiveness Cluster S2E2 (Sciences and Systems of Electrical Energy).


New Soft Biometric Approach For Keystroke Dynamics Based On Gender Recognition

	L'archive ouverte pluridisciplinaire HAL, est
	destinée au dépôt et à la diffusion de documents
	scientifiques de niveau recherche, publiés ou non,
	émanant des établissements d'enseignement et de
	recherche français ou étrangers, des laboratoires
	publics ou privés.

A Romain Giot, Christophe Rosenberger To cite this version: Romain Giot, Christophe Rosenberger. A New Soft Biometric Approach For Keystroke Dynamics Based On Gender Recognition. International Journal of Information Technology and Management (IJITM) Special Issue on: "Advances and Trends in Biometrics". Dr Lidong Wang (IF 0.727), 2012, 11, pp.1-16. 10.1504/IJITM.2012.044062. hal-00991142


Mohamad El-Abed
email: mohamad.elabed@greyc.ensicaen.fr

Romain Giot
email: romain.giot@greyc.ensicaen.fr

Baptiste Hemery
email: baptiste.hemery@greyc.ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@greyc.ensicaen.fr

Jean-Jacques Schwartzmann
email: jeanjacques.schwartzmann@orange-ftgroup.com

Towards the Security Evaluation of Biometric Authentication Systems

Keywords: Biometrics, security evaluation, threat, vulnerability, risk factor. I

Despite the obvious advantages of biometric authentication systems over traditional security ones (based on tokens or passwords), they are vulnerable to attacks which may considerably decrease their security. In order to contribute in resolving such problematic, we propose a modality-independent evaluation methodology for the security evaluation of biometric systems. It is based on the use of a database of common threats and vulnerabilities of biometric systems, and the notion of risk factor. The proposed methodology produces a security index which characterizes the overall security level of biometric systems. We have applied it on two different biometric systems (one research laboratory implementation of keystroke dynamics and a commercial system for physical access control using fingerprints) for clarifying its benefits.

INTRODUCTION

Biometric-based authentication methods constitute one of the most promising candidate for either replacing or enhancing traditional methods based on secret (e.g., password) and/or token (e.g., card). They have many applications [START_REF] Jain | Biometrics: A grand challenge[END_REF]: border control, e-commerce… The main benefits of this technology [START_REF] Uludag | Attacks on biometric systems: A case study in fingerprints[END_REF] are to provide a better security and to facilitate the authentication process for a user. In spite of their numerous advantages, biometric systems present several drawbacks which may considerably decrease their security.

Ratha et al. [START_REF] Ratha | An analysis of minutiae matching strength[END_REF] have identified eight possible attack points to biometric authentication systems as illustrated in Figure 2 (points 1 to 8): 1) involves presenting a fake biometric data to the sensor such as a dummy finger; 2) in a replay attack, an intercepted biometric data is submitted to the feature extractor bypassing the sensor; 3) the feature extractor is replaced with a Trojan horse program that functions according to its designer specifications; 4) in the fourth type of attack, genuine extracted features are replaced with other features selected by the attacker; 5) the matcher is replaced with a Trojan horse program; 6) involves attacks on the template database; 7) the templates can be altered or stolen during the transmission between the template database and the matcher; and 8) the matcher result (accept or reject) can be overridden by the attacker. Schneier [START_REF] Schneier | Inside risks: the uses and abuses of biometrics[END_REF] compares traditional security systems with biometric systems. The study presents several drawbacks of biometric systems including: i) the lack of secrecy: everybody knows our biometric traits such as iris and ii) the fact that a biometric trait cannot be replaced if it is compromised. Matloni et al. [START_REF] Maltoni | Handbook of Fingerprint Recognition[END_REF] described typical threats of a generic biometric authentication application: i) circumvention: an attacker gains access to a part of the system protected by the authentication application. In this case, the attacker may manipulate the data or even read them in an illegal way (e.g., medical records of other users); ii) repudiation: a legitimate user may deny accessing the system. For example, a bank clerk modifies the financial records and later claims that his biometric data was stolen and denies that he is responsible; iii) contamination: an attacker illegally obtains biometric data of a genuine user and uses it to access the system (e.g., lifting a latent fingerprint from a material surface); iv) collusion: a user having high privileges (e.g., system administrator) illegally modifies system policy and rules and v) coercion: an attacker forces a legitimate user to access the system (e.g., using iris to access ATM at a gunpoint). Moreover, as biometrics technology becomes more widely used in our daily life, the incentives of its misuse or attack will grow. Therefore, it is important that biometric systems be designed to withstand different sources of attacks on the system when employed in securitycritical applications. Towards this goal, we propose in this paper a modality-independent evaluation methodology for the security evaluation of biometric systems. It is based on the use of a database of common threats and vulnerabilities resulting to the results of desk research and laboratory testing [6] [7]. The proposed methodology produces a security index which characterizes the overall security level of biometric systems. Such kind of evaluation is beneficial, since it allows easily (i.e., in a quantitative way) to compare the security level of biometric systems.

The outline of the paper would be as follows. We present related previous research on security evaluation of biometrics in section II. Section III details the proposed method and the computation of the associated security index. We present in section IV an illustration of the developed method on two different biometric systems (a research keystroke dynamics system and a commercial fingerprint embedded system). Section V gives a conclusion and some perspectives of this work.

II. BACKGROUND

The security evaluation of biometric systems is receiving more and more attention in biometrics community. The international standard ISO/IEC FCD 19792 [START_REF]Information technologysecurity techniques -security evaluation of biometrics[END_REF] addresses the aspects of security evaluation of such systems. The report presents an overview of biometric systems vulnerabilities. In addition to the threats presented by Maltoni et al. [START_REF] Maltoni | Handbook of Fingerprint Recognition[END_REF], the report addresses a threat related to system performance and the quality of the acquired biometric characteristics during the enrollment. For example, a system having a high False Acceptance Rate (FAR), may be attacked by presenting several impostor attempts. If low images are accepted during the enrollment then the attacker may hope to break the system as in the case of noisy images. The report also argues that privacy issues (e.g., access to the stored templates) should be taking into account within the evaluation process. The Common Criteria Biometric Evaluation Working Group [START_REF]Common criteria for information technology security evaluation[END_REF] presents 15 threats that may need to be considered when evaluating biometric systems for vulnerabilities. Dimitriadis et al. [START_REF] Dimitriadis | Application of multi-criteria analysis for the creation of a risk assessment knowledgebase for biometric systems[END_REF] present a study for evaluating the security level of an access control system for stadiums based on biometric technologies. They present a list of 12 vulnerabilities of biometric systems. Their method quantifies a risk factor to each vulnerability. However, other threats and vulnerabilities should be take into account nowadays in order to enhance the reliability of the assessment method. Attack tree technique introduced by Schneier [START_REF] Schneier | Attack trees[END_REF], provides a structure tree to conduct security analysis of protocols, applications and networks. However, attack trees are dependent from the intended system and its context of use. Therefore, it is infeasible to be used for a generic evaluation purpose. An example of its use for the security evaluation of fingerprint recognition systems is presented by Henniger et al. [START_REF] Henniger | On security evaluation of fingerprint recognition systems[END_REF]. Matyás et al. [START_REF] Matyás | Biometric authentication -security and usability[END_REF] propose a security classification of biometric systems along similar lines to Common Criteria [START_REF]Common criteria for information technology security evaluation[END_REF] and FIPS 140-1/2 [START_REF]Security requirements for cryptographic modules[END_REF]. Their proposal classifies biometric systems into four categories according to their security level. However, their model could not be considered as discriminative to compare the security level of biometric systems.

Discussion

Existing works (such as Uludag et al. [START_REF] Uludag | Attacks on biometric systems: A case study in fingerprints[END_REF]) show the vulnerabilities of biometric systems which can considerably decrease their security. In order to be used in a reliable context, the security evaluation of biometric systems should be carefully taken into account when designing such systems. Jain et al. [START_REF] Jain | Biometrics: A grand challenge[END_REF] categorize the fundamental barriers in biometrics into four main categories: (i) accuracy in terms of errors, (ii) usability in terms of acceptance, and (iii) security. On the other hand, the state-of-the-art shows that only few partial security analysis studies with relation to biometric authentication systems exist. Also, recently addressed vulnerabilities and threats [8] [15] should also be taken into account within the evaluation process. In order to contribute in enhancing the security evaluation of biometric systems, we propose a modality-independent evaluation methodology for the security evaluation of such systems. It is based on the use of a database of common threats and vulnerabilities of biometric systems resulting to the results of desk research and laboratory testing [START_REF] Giot | Greyc keystroke : a benchmark for keystroke dynamics biometric systems[END_REF] [START_REF] El-Abed | A study of users' acceptance and satisfaction of biometric systems[END_REF], and the notion of risk factor. The proposed method produces a security index (between 0 and 100) for the overall system, which allows easily the comparison of biometric systems in term of security.

III. DEVELOPED METHOD

The security evaluation of biometric systems is generally divided into two complementary assessments [START_REF]Information technologysecurity techniques -security evaluation of biometrics[END_REF]: 1) assessment of the biometric system (devices and algorithms) and 2) assessment of the environmental (for example, is the system is used indoor or outdoor?) and operational conditions (for example, tasks done by system administrators to ensure that the claimed identities during enrolment of the users are valid). The objective of this work is to define a type 1 assessment method for the security evaluation of biometric systems. We intend to develop a generic approach (i.e., modality-independent) for quantifying the security level of a biometric system. The proposed methodology principle is illustrated in Figure 1: It takes the characteristics/architecture of a biometric system and produces, using a black box, a security index between 0 and 100 (the highest score 100 corresponds to a particularly unsecure system). The black box process works as follows: using a list of common threats/vulnerabilities and three predefined criteria (section III-B), a risk identification process is deployed in order to identify the list of threats and vulnerabilities of the intended biometric system. The security index of the system is then computed using its calculated risk factors.

The rest of this section is organized as follows. We present in section A the list of common threats and vulnerabilities of a generic biometric system. Section B presents the risk identification process deployed in order to produce a list of risks of the intended biometric system, and section C presents the security index computation of the intended system.

A. Common threats and vulnerabilities of biometric systems

We intend in this section to give a list of common threats and vulnerabilities of a generic biometric system. The proposed list was created to the results of desk research. It also noted threats and vulnerabilities that we found it valuable when collecting the GREYC-Kesytroke database [START_REF] Giot | Greyc keystroke : a benchmark for keystroke dynamics biometric systems[END_REF], and during the usability study [START_REF] El-Abed | A study of users' acceptance and satisfaction of biometric systems[END_REF] of biometric systems. The list is based on an extended model to Ratha et al. [START_REF] Ratha | An analysis of minutiae matching strength[END_REF] model as illustrated in Figure 2, and it is divided into two sets:

1) Set I Architecture threats  Sensor (location 1)  Attacker presents a fake biometric data to the sensor (e.g., prosthetic fingers created out of latex). Such kind of attack is called spoofing;  Attacker exploits the similarity due to blood relationship to gain access (e.g., case of identical twins and biometric systems using specific modalities such as face and DNA);  Authorized users willingly provide their biometric sample to attacker;  Attacker provides own biometric sample as a zeroeffort attempt to impersonate an authorized user;  Attacker modifies its own behavior (e.g., voice) or physiology (e.g., fingerprint) to impersonate a selected weak biometric template;  Attacker exploits a residual biometric image left on the sensor to impersonate the last authorized user.

 Communication links (locations 2 and 4)

 Attacker reads an authorized biometric sample from a communication channel;  Attacker intercepts an authorized biometric sample from a communication channel in order to be replayed (replay attack), bypassing the biometric sensor, at another time for gaining access;  Attacker cuts the communication link in order to make the system unavailable to its intended authorized users (Denial of Service attack);

 Attacker alters the transported information from a communication channel (Denial of Service attack);  Attacker attempts continuously to enter the system (known as hill-climbing attack), the input image/template is conveniently modified until a desired matching score is attained. The attempts are made, by injecting samples on the communication link, to the feature extractor input (image) [START_REF] Soutar | Biometric system security[END_REF] or the matcher input (template) [START_REF] Uludag | Attacks on biometric systems: A case study in fingerprints[END_REF].  Biometric system components may be replaced with a Trojan horse program that functions according to its designers' specifications.



2) Set II System overall vulnerabilities  Performance limitations (point 9)

By contrast to traditional authentication methods based on "what we know" or "what we own" (0% comparison error), biometric systems is subject to errors such as False Acceptance Rate (FAR) and False Rejection Rate (FRR). This inaccuracy illustrated by statistical rates would have potential implications regarding the level of security provided by a biometric system. Doddington et al. [START_REF] Doddington | Sheep, goats, lambs and wolves: A statistical analysis of speaker performance in the nist 1998 speaker recognition evaluation[END_REF] assigns users into four categories: i) sheep: users who are recognized easily (contribute to a low FRR) ii) lambs: users who are easy to imitate (contribute to a high FAR), iii) goats: users who are difficult to recognize (contribute to a high FRR) and iv) wolves: users who have the capability to spoof the biometric characteristics of other users (contribute to a high FAR). A poor biometric in term of performance, may be easily attacked by lambs, goats and wolves users. Therefore, it is important to take into consideration system performance within the evaluation process. To do so, we use the Half Total Error Rate (HTER) as a performance measure of the system. It is defined as:

 Quality limitations during enrollment (point 10)

The quality of the acquired biometric samples is considered as an important factor during the enrollment process. The absence of a quality test increases the possibility of enrolling authorized users with weak templates. Such templates increase the probability of success of zero-effort impostor, hill-climbing and brute force attempts [START_REF] Uludag | Attacks on biometric systems: A case study in fingerprints[END_REF]. Therefore, we added this measure in the computation of the security index.

B. Risk identification

Risk identification is considered as a significant step towards the design of useful information technology systems. The objective of risk identification [START_REF] Stoneburner | Risk management guide for information technology system[END_REF] is to identify risks that could affect the functionality of the intended biometric system. This step depends on the risk methodologies used. Most of the existing methods rely on the combination on knowledge extracted from questionnaires and interviews [START_REF] Alberts | Introduction to the OCTAVE approach[END_REF] [START_REF] Yazar | A qualitative risk analysis and management tool -CRAMM[END_REF]. Others [START_REF] Dimitriadis | Application of multi-criteria analysis for the creation of a risk assessment knowledgebase for biometric systems[END_REF] [21], use predefined risk factors for each identified vulnerability, based on the estimation of experts who studied the likelihood of occurrence of vulnerability exploits. A risk factor, for each identified threat and vulnerability, is considered as an indicator of its importance. According to the proposed model illustrated in Figure 2, the risk factors are calculated as follows:

1) Risk factors computation of the identified threats

In order to calculate the risk factor of each identified threat, we use a quantitative approach inspired from the Multi-Criteria Analysis (MCA) [START_REF]Multi-criteria analysis: a manual[END_REF]. More specifically, we use three criteria to compute the risk factor of each identified threat (risk score=C For each identified threat, the three predefined criteria are rated subjectively. An example of subjective-based rating is used in the security assessment tool COBRA [START_REF]Consultative, objective and bi-functional risk analysis (cobra)[END_REF], which rates its predefined criteria based on the estimation of experts who studied the likelihood of occurrence of vulnerability exploits.

2) Risk factors computation of system overall vulnerabilities

Table I illustrates a general scheme for the risk computation of system overall vulnerabilities (Section III-A set 2). For the system performance, we multiply by 2 since a biometric system providing a HTER more than or equal to 50% is not considered as important (for such systems, we put its risk factor to 1000). For the quality, we define four rules according to whether the system implements quality checks during the enrollment step.

C. Security index computation

The overall security level of a biometric system, is typically made up of several areas of variable risk. If any of these areas are omitting during the evaluation process, then an unreliable result will be concluded. At this time, such kind of evaluation is considered as a complicated task since the number of actors involved within the process is important. Therefore, an agreed methodology for illustrating the overall system security of a biometric system by an index would facilitate the evaluation of such systems [START_REF] Ashbourn | Vulnerability with regard to biometric systems[END_REF]. In order to produce a security index for a biometric system, we use the notion of the Area Under Curve (AUC) of the curve resulting from the retained risk factors. It is calculated using the trapezoid rule. The main benefit of using this approach is it permits to take into account all vulnerabilities of a biometric system and their relationships in the processing chain. The security index is then defined as follows:

where n = number of locations (according to our model, n is equal to 10); f (x) is the curve resulting from a set of risk factors retained from each location (the maximal risk factor is retained from each location); and g (x) is the curve resulting from a set of the highest risk factors we can have from each location (according to our model, they are equal to 1000).

IV. EXPERIMENTAL RESULTS

We have applied the proposed method on two different biometric systems. The first one is a keystroke dynamics application developed in our research laboratory [START_REF] Giot | Greyc keystroke : a benchmark for keystroke dynamics biometric systems[END_REF]. The second one is a commercial fingerprint lock to manage physical access to the development room in our laboratory. The architecture and the main characteristics of the keystroke dynamics system are:

 The system implements a score-based method as presented in [START_REF] Hocquet | User classification for keystroke dynamics authentication[END_REF]. The system provides a Half Total Error Rate (HTER) equal to 10.1%;  System architecture is not distributed (all system's components including template database are implemented within the same PC);  There is no data protection neither encryption schemes applied on the template database;  There is no quality check during enrollment phase;  The PC used is connected to the Internet.

The architecture and the main characteristics of the fingerprint lock system are:

 The system provides a FAR of 0.0001% and a FRR of 0.1%. We believe, after a period of use (1 year), that these rates are optimistic (especially the FRR). Nevertheless, we did not modify them since this is not the main interest of the paper. The Half Total Error Rate (HTER) is then equal to 0.05%;  There is no data protection neither encryption schemes applied on the template database, but it is physically protected;  System architecture is not distributed (all system components including template database are implemented within the same material);  The material is not connected to the Internet and there is no USB port;  There is no quality check during enrollment phase;  The material power supply is 4 * 1.5V AA batteries with a life span of 1-2 years.

Tables II and III represent an analysis of the keystroke dynamics and fingerprint lock systems, respectively. We put the mark "x" in the last two lines of both tables, since the risk factors of system overall vulnerabilities are not computed using the three predefined criteria (i.e., they are computed according to the set of rules presented in Table I).

The risk factors are computed subjectively according to the results of desk research and laboratory testing. For example, the three criteria for the "presentation of prosthetic fingers" threat to fingerprint lock system (table III, point 1) are subjectively rated as follows: for effectiveness criteria, we put 10 since if the attacker succeeds in presenting a fake finger, he will be allowed to access the room that contains costly materials; for easiness criteria, we put 8 since the system has a low FAR rate (we did not put lowest than 8 since the sensor does not integrate any module to detect fake fingers); for cheapness criteria, we put 9 since the materials/products required to make a fake are cheap. However, the evaluator may rates differently these criteria according to the intended system and its context of use. Figure 3 illustrates a comparative study (of the maximal value of risk factor at each location) between both systems. However, the evaluator may also compare other factors such as number of threats at location i. From Figure 3, we can conclude several results such as: fingerprint lock system is much more vulnerable at location 1 than the keystroke dynamics system, keystroke dynamics system is much more vulnerable at locations 2, 3, 5, 6, 7, 8 and 9 than fingerprint lock system, both systems are not vulnerable at location 4. Using equation 2, the security index (total risk) of keystroke dynamics system is equal to (47.91%), while for the fingerprint lock system it is equal to (7.34%). These security indexes show clearly that the overall security of keystroke system is less important than the fingerprint lock system against attacks. Because the fingerprint lock system is a black box, we cannot say a lot of things for different locations. Even if we have not presented security problems for these locations, an attacker could be able to find them, thanks to reverse engineering (hardware and software). However, the use of the commercial system in this study was taken as an illustration case for the comparison. More generally speaking, during the security evaluation process of an IT system, system designers should provide all the details/characteristics of the intended system for the evaluators.

V. CONCLUSION AND PERSPECTIVES

The security evaluation of biometric systems is considered as an important factor to take into account when designing and evaluating them. Nowadays, such kind of evaluation is considered as a complicated task since the number of actors involved within the process is important. However, an agreed methodology for illustrating the overall system security of a biometric system by an index would facilitate the evaluation of such systems [START_REF] Ashbourn | Vulnerability with regard to biometric systems[END_REF]. Towards this goal, we present in this paper a modality-independent evaluation methodology for the security evaluation of biometric systems. It uses a database of common threats and vulnerabilities of biometric systems resulting to the results of desk research and laboratory testing [6] [7], and the notion of risk factor. The proposed method produces a security index (between 0 and 100, the highest score 100 corresponds to an unsecure system) which allows easily to compare the security level of biometric systems. We have applied it on two different biometric systems (the first one is based on morphological analysis and the other one on behavioral analysis) for clarifying its benefits.

For the perspectives, many efforts should be more done in order to extend the presented database of threats and vulnerabilities of a generic biometric system. We believe that this step is indispensable in order to take into account the future (e.g., new modalities) biometric systems, and the new threats that will be identified by researchers and hackers. We intend to develop a web-based software embedding the known threats and vulnerabilities for each biometric modality that would be used for the scientific community. A list of countermeasures (such as liveness detection, cryptographic storage and transport…), for each modality, will be also embedded for risk reduction. In addition, the proposed method quantifies the biometric system (devices and algorithms) without taking into account the environmental and operational conditions of a biometric system. Therefore, we intend also to work on this complementary evaluation part.

TERMS AND DEFINITIONS

Attacker: The agent causing an attack (not necessarily human). Vulnerability: A weakness in the system that can be exploited to violate its intended behavior. Threat: A potential event that could compromise the security integrity of the system. Enrollment: The process of collecting biometric samples from a person and the subsequent preparation and storage of biometric reference templates representing that person's identity.

False Acceptance Rate (FAR): Rate at which an impostor is accepted by an authentication system. False Rejection Rate (FRR): Rate at which the authorized user is rejected from the system. Half Total Error Rate (HTER): This error rate corresponds to the average of both FAR and FRR error rates.

Figure 1 .

 1 Figure 1. Methodology principle.

Template database (location 6 )

 6 Attacker modifies (adding/replacing) biometric templates from storage;  Attacker deletes biometric templates from storage;  Attacker steals the template database.  Communication link (location 7)  Attacker reads biometric templates from a communication channel;  Attacker alters the transported information from a communication channel (Denial of Service attack).  Software modules (locations 3, 5 and 8)

Figure 2 .

 2 Figure 2. Proposed model (extended to Ratha et al. model [3]):vulnerability points in a general biometric system.



  Effectiveness ( C 1 ): represents the impact of the attack in term of criticality. It is defined between 0 and 10 (the highest score 10 corresponds to a heavy/danger attack);  Easiness (C 2 ): represents the difficulty to exploit the vulnerability and make a successful attack. It is defined between 0 and 10 (0 corresponds to an impossible attack and the highest score 10 corresponds to an easy attack);  Cheapness ( C 3 ): represents the cost in terms of specific equipment required to make an attack. It is defined between 0 and 10 (the highest score 10 represents the lowest cost).

Figure 3 .

 3 Figure 3. A comparative illustration of both systems among the 10 tested points in our model.

TABLE I .

 I GENERAL SCHEME OF RISK COMPUTATION FOR THE SYSTEM OVERALL VULNERABILITIES.

	Point	Description		Conditions	Risk factor
	9	System performance	Sufficient panel of users	2 * 10 * HTER (limited to 1000)
	10	Template quality during enrollment	   	Multiple captures with quality assessment One capture with quality assessment Multiple captures without quality assessment One capture without quality assessment	0 400 600 1000

TABLE II .

 II SECURITY ANALYSIS OF THE KEYSTROKE DYNAMICS APPLICATION.

	Point 1 2	      	Description attacker modifies own behavior to impersonate a weak template zero-effort impostor attempt artificial generation of key events cutting communication link alteration of the transported key events (DoS) injecting of key events (hill-climbing and brute-force attacks) listening then replay of previous key events (events belonging to authorized	Effectiveness 10 10 10 3 7 10 10	Easiness 1 1 6 10 6 6 8	Cheapness 10 10 7 10 8 8 8	Risk factor 100 100 420 300 336 480 640
	3 5 6 7 8	         	users) modification of program in memory modification of program in memory reading the SQL database (privacy violation) modification (suppressing) of the SQL database modification (adding/replacing) of the SQL database listening to the template (privacy violation) alteration of the transported template (DoS) injecting of templates (hill-climbing and brute-force attacks) listening then replay of previous templates modification of program in memory	10 10 3 8 10 3 7 10 10 10	8 8 8 5 5 8 6 6 8 8	8 8 8 8 8 8 8 8 8 8	640 640 192 320 400 192 336 480 640 640
	9	system performance	X	X	X	202
	10	multiple captures without quality assessment	X	X	X	600

TABLE III .

 III SECURITY ANALYSIS OF THE FINGERPRINT LOCK SYSTEM.

	Point 1	   	Description exploitation of the residual biometric image left on the sensor zero-effort impostor attempt removing the battery (DoS) presentation of prosthetic fingers	Effectiveness 10 4 10 10	Easiness 1 8 8 8	Cheapness 10 10 8 9	Risk factor 100 320 640 720
	9	system performance	X	X	X	1
	10	multiple captures without quality assessment	X	X	X	600

ACKNOWLEDGMENT

The authors would like to thank the French Research Ministry for their financial support of this work.