Interférométrie holographique numérique développée pour l'étude des écoulements instationnaires (du subsonique au transsonique)

Jean-Michel DESSE ONERA, The French Aerospace Lab, 5, Boulevard Paul Painlevé, BP 2161, 59014 LILLE Jean-Michel.Desse@onera.fr Le département de l'Aérodynamique Appliquée de l'ONERA a développé et mis en oeuvre une méthode optique basée sur l'interférométrie holographique numérique pour l'étude des écoulements aérodynamiques instationnaires. Après avoir rappelé les principes fondamentaux de la méthode holographique appliquée à l'étude d'objets transparents, l'auteur présente, dans un premier temps, la méthode développée pour l'étude des écoulements subsoniques à base d'un interféromètre de type Michelson. Il présente notamment la comparaison entre l'holographie couleur utilisant des plaques holographiques en transmission et en réflexion et l'holographique numérique couleur appliquée à l'étude de l'écoulement instationnaire en aval d'un cylindre à Mach 0,45. Le traitement des interférogrammes est réalisé par transformation de Fourier bidimensionnelle directe et inverse avec reconstruction de l'amplitude et la phase obtenues par filtrage et sélection de l'ordre 1. Les cartes de phase sont obtenues avec et sans écoulement, ce qui permet de calculer la différence d'épaisseur optique connaissant la largeur de la veine d'expériences. La relation de Gladestone-Dale permet d'accéder à l'évolution de champ de la masse volumique en fonction du temps. Pour l'analyse des écoulements en haut subsonique et transsonique, le montage holographique a évolué et il a été remplacé par un montage de type Mach-Zehnder avec comme source lumineuse de l'interféromètre, un laser pulsé ayant une longueur de cohérence adaptée. Les interférogrammes holographiques obtenus à Mach 0,73 montrent la complexité de l'écoulement qui présente de nombreuses ondes de choc. Le dépouillement des interférogrammes fait apparaître une diminution importante de la masse volumique au centre des tourbillons pouvant atteindre 90% de la masse volumique génératrice de l'écoulement [2]. Les applications futures de la technique optique concernent actuellement l'analyse des écoulements 3D instationnaires par tomographies multi-directionnelles basées sur l'holographie numérique, le but étant à court terme de comparer les mesures holographiques avec celles obtenues par la BOS et la CBOS.

1 Bases théoriques de l'interférométrie holographique numérique restent quasi constants dans le champ de mesure. Les méthodes d'évaluation de la phase sont diverses et variées et elles ont chacune leurs points forts qui les rendent plus efficaces pour certaines applications, sans qu'une seule de ces méthodes soit la méthode universelle et optimale. Dans notre application nous utiliserons une méthode adaptée dite de « démodulation de phase avec porteuse spatiale » présentée ci-dessous.

Démodulation de phase à porteuse spatiale

Dans cette méthode, le dépouillement des interférogrammes se fait par transformée de Fourier, cette méthode de reconstruction est très adaptée pour cette application (objet de phase transparent) et facile à utiliser avec l'avènement des algorithmes FFT2, adaptés aux cas bidimensionnels. L'intensité lumineuse de la figure de franges sans porteuse spatiale enregistrée par le détecteur s'écrit :

) cos( ) , ( ) , ( ϕ ∆ + = y x b y x a E (3) où a(x, y) est l'intensité moyenne, b(x, y) l'intensité
) cos( ) , ( ) , ( i v y x b y x a E + ∆ + = ϕ avec i=x,y,xy (4)
où u o et v o sont les fréquences porteuses de la modulation. Dans chacun des trois cas, on obtient dans le plan de Fourier un spectre tri-modal symétrique par rapport à l'origine. Cette méthode présente l'avantage de réduire efficacement le niveau de bruit de la carte de phase démodulée.

Dans la suite, on s'intéresse au cas ν i = ν xy. L'intensité lumineuse peut alors s'écrire :

) 2 2 cos( ). , ( ) , ( 0 0 y x u y x b y x a E πν π ϕ + + ∆ + = (5)
En introduisant les exponentielles complexes et en tenant compte de la dépendance spatiale, on peut calculer la transformée de Fourier de l'équation (5), ce qui donne :

) , ( ) , ( ) , ( ) , ( * ~o o o o v v u u C v v u u C v u A v u E + + + - - + = (6) où A(u, v) = TF[a(x, y)](u, v) et C(u, v) = TF[c(x, y)](u, v).
Si les spectres de fréquences spatiales sont peu étalés par rapport aux fréquences porteuses u o et v o , on observe trois lobes bien séparés dans le plan de Fourier de l'interférogramme. Les deux lobes symétriques centrés aux fréquences (+u o , +v o ) et (-u o , -v o ) contiennent la même information de phase. Ils sont simplement complexes conjugués l'un de l'autre. Le filtrage du lobe centré sur la fréquence (+u o , +v o ), par un filtre numérique passe bande bidimensionnel, permet de ne conserver que l'information de phase qui nous intéresse et conduit donc aussi à un filtrage de la composante continue a(x, y). Ensuite, on calcule une transformée de Fourier inverse appliquée au lobe sélectionné, ce qui permet de déduire la phase optique et l'amplitude. La sélection spectrale du lobe nécessite une interaction forte avec l'utilisateur pour que la sélection soit fiable. L'automatisation totale du traitement n'est donc pas chose facile. La porteuse spatiale est introduite la plupart du temps par un basculement contrôlé de l'une des surfaces d'onde de l'interféromètre, il est alors possible de choisir l'orientation de la porteuse (x, y ou xy). La connaissance de la variation de phase permet de calculer la variation de chemin optique qui code le mesurande. Ainsi, si on désigne par δ la variation de chemin optique, alors :

δ λ π ϕ 2 = ∆ (7) et ϕ π λ δ ∆ = 2 (8)
où λ est la longueur d'onde utilisée. La différence de marche δ sera à diviser par un facteur 2 si le montage est à double traversée de la veine d'expériences. On voit dans ce montage que le faisceau de référence est renvoyé successivement par plusieurs miroirs plans pour descendre en dessous de la veine d'expériences, puis remonter à la hauteur de l'axe optique de l'onde de mesure. Il s'en suit une rotation de la polarisation de l'onde de mesure qui doit être corrigée en insérant une lame λ/2 devant le filtre spatial de l'onde référence. Le contraste des franges d'interférences peut ainsi être optimisé sur l'interférogramme. Sur le trajet de l'onde de mesure, on insère une lentille de 70 mm de distance focale qui permet de reformer l'image de la veine d'expériences sur le capteur et on place un écran de protection dans le trajet du faisceau de référence juste derrière le cube séparateur pour bloquer le faisceau de mesure. Les essais ont été réalisés pour plusieurs orientations du réseau de franges d'interférences. Les meilleurs résultats ont été obtenus lorsque les franges d'interférences sont placées à 45° par rapport à la direction de l'écoulement amont.

Application à l'interférométrie holographique numérique couleur

Dans ce cas les ondes de choc ou les couches de cisaillement sont très rarement parallèles à la direction des franges et les sauts de phase résiduels sont pratiquement inexistants. La figure 7 montre un des interférogrammes de mesure et le spectre de Fourier 2D correspondant. On voit que les spots sont localisés sur une diagonale de coordonnées (x=0,11 et y=0,11). La carte de phase modulo 2π et la carte de différence de phase déroulée montrent qu'il ne reste que deux ou trois zones qui présentent des sauts de phase. En particulier, on voit que les deux ondes de choc verticales émises à l'intrados et l'extrados sont correctement dépouillées, ce qui n'aurait pas été le cas si les franges avaient été placées verticalement.

Interférogramme de mesure Spectre 2D et zone de filtrage

  du fondamental et ∆ϕ la phase optique codant le mesurande. Le calcul de la transformée de Fourier de cet interférogramme nous donne un spectre uni modal centré en zéro. Cependant, afin de faire un traitement numérique de notre figure de frange, il est nécessaire d'introduire une porteuse spatiale dans le terme de phase, ceci se traduit par l'introduction d'une inclinaison des fronts d'onde des deux faisceaux arrivant sur la caméra. On peut choisir d'introduire une porteuse suivant x, suivant y ou suivant les deux directions. Si l'on désigne par ν x =2πu o x , ν y =2πv o y et ν xy = 2πu o x+2πv o y, les modulations de phase spatiale respectives suivant x, suivant y et suivant xy, l'intensité lumineuse s'écrit :

Figure 1 :

 1 Figure 1 : Interféromètre holographique numérique à 3 longueurs d'onde Lorsque les points de focalisation des ondes de références et des ondes de mesure sont superposés dans le diaphragme qui est placé devant la caméra, on peut observer trois teintes de fond (rouge, verte et bleue) sur le CCD. Si on déplace le point de focalisation des faisceaux de référence dans le plan du diaphragme, on introduit des franges d'interférences rectilignes dans le champ d'observation. Ceci est obtenu très simplement en tournant le miroir concave. A ce stade, on enregistre sur le CCD les interférences lumineuses qui permettront de calculer les trois hologrammes de référence et notamment les cartes de phase de référence. Ensuite, la soufflerie est mise en route et les trois ondes de mesure sont déformées par le phénomène aérodynamique, ce qui provoque une déformation des micro franges d'interférences. Celles-ci sont enregistrées de nouveau par le capteur CCD pour calculer les cartes de phase liées à la mesure. La figure 2 montre deux images des micro franges d'interférences enregistrées avec et sans écoulement. Dans la partie zoomée, on peut voir comment se déforment les micro franges d'interférences à l'extrados du cylindre.

Figure 2 :

 2 Figure 2 : Enregistrement des micro franges avec et sans écoulement -Mach 0,45 La figure 3 montre les spectres bidimensionnels de Fourier pour l'image de référence et pour l'image de mesure pour la voie bleue. Les spectres de Fourier obtenus sur chaque voie sont filtrés des ordres zéro et -1 car la carte de phase n'est reconstruite qu'avec l'ordre +1. Cela est ici facile car les informations fréquentielles relatives à l'ordre +1 sont bien identifiées et non parasitées du fait du choix de la caméra équipée de 3 CDD différents.

Figure 3 :

 3 Figure 3 : Localisation fréquentielle du signal et filtrage -Voie Bleue Ensuite, les cartes de phase et d'amplitude sont calculées en utilisant les parties des spectres filtrés. A noter que les zones de filtrage peuvent être choisies indépendamment pour la voie rouge, verte et bleue. La figure 4 montre les cartes de différence de phase modulo 2π et déroulée obtenues pour la voie bleue (différence entre la phase de mesure et la phase de référence). On peut distinguer qu'à l'endroit de l'émission des lignes tourbillonnaires issues de l'intrados et de l'extrados du cylindre, les sauts de phase ne sont pas très bien résolus localement. Cela est dû soit au temps de pose du cliché de 1 µs qui est un peu long devant le temps du phénomène, soit à l'orientation des micro franges d'interférences. Les cartes d'épaisseur optique et d'indice de réfraction sont calculées à partir des cartes de différences en prenant en compte la valeur de la longueur d'onde sur chaque plan.

Figure 5 :

 5 Figure 5 : Comparaison entre un hologramme analogique et numérique Il ressort de cette comparaison entre les deux méthodes optiques que l'interférométrie holographique numérique utilisant trois longueurs d'onde comme source lumineuse et une caméra 3CCD pour l'enregistrement des interférogrammes peut avantageusement remplacer l'interférométrie holographique numérique utilisant des plaques holographiques par transmission ou par réflexion. Les résultats obtenus en holographie numérique ont été validés sur l'étude de l'écoulement subsonique au voisinage d'un cylindre placé transversalement dans la veine d'expériences. Le montage optique permet facilement d'introduire des fréquences porteuses spatiales qui sont analysées avec et sans écoulement. Les spectres de Fourier obtenus sur chaque voie peuvent être filtrés aisément car les fréquences spatiales sont bien identifiées et non parasitées. La reconstruction des cartes de différence de phase permet d'obtenir des cartes d'indice de réfraction de très bonne qualité.

Figure 6 :

 6 Figure 6 : Montage Mach-Zehnder d'interférométrie holographique numérique à laser pulsé

1.1 Principe de l'holographie numérique L

  'interférométrie holographique résulte de la superposition entre une onde de référence et une onde de mesure, issues d'une même source lumineuse cohérente spatialement et temporellement (laser), et de différence de chemin optique inférieure à la longueur de cohérence de la source. Contrairement à ce qui se fait en holographie image où les hologrammes sont enregistrés sur des plaques holographiques, les franges d'interférences sont ici enregistrées sur des capteurs CCD ou CMOS. Le choix de l'angle θ entre les faisceaux de référence et de mesure est important pour cette application car la période des franges (interfrange i) doit vérifier le critère de Shannon. Si on considère une application où le pas des pixels est de 6,45 µm et une longueur d'onde rouge λ = 647 nm, on trouve une valeur θ ≤ 2,87°. On voit tout de suite que l'angle entre le faisceau de référence et le faisceau de mesure est très faible, ce qui sera à prendre en compte pour le montage optique. La phase de l'objet à étudier permet de distinguer deux types de

reconstructions, la reconstruction par transformée de Fresnel, pour des objets de phase diffusants et la reconstruction par transformée de Fourier pour des objets de phase transparents. Dans le cas de notre étude, on ne s'intéressera qu'à l'analyse d'objets transparents, et donc une reconstruction de l'objet de phase par transformée de Fourier.

1.

2 Démodulation de la phase en interférométrie holographique numérique

  Un grand nombre de techniques de mesures optiques plein champ repose sur le phénomène d'interférences qui code le « mesurande » dans la phase d'un signal d'intensité périodique. Le signal interférométrique bidimensionnel qui est alors enregistré par l'intermédiaire d'un capteur de type CCD ou CMOS est alors appelé « figure de franges ». Ces franges apparaissent usuellement comme des bandes alternativement brillantes et sombres qui représentent en fait les lignes de Les techniques optiques dont le signal utile est une figure de franges donnent une information spatiale instantanée, contrairement à un grand nombre de procédés qui ne fournissent l'information qu'en un seul point et éventuellement une matrice très limitée de points. La figure de franges donne une information dans laquelle les franges constituent des lignes d'égale variation de phase optique. Dans la plupart des applications, le système optique est conçu de sorte que le fond moyen

	contour du mesurande. La formulation mathématique de ce champ d'interférences peut être définie
	à l'aide de coordonnées spatiales (x, y, z) et de la coordonnée temporelle t, au niveau du plan
	image de démodulation. Ainsi, on écrira
												I	(	x	,	y	,	z	,	t	)	=	I	o	(	x	,	y	,	z	,	t	1 )(	+	m	(	x	,	y	,	z	,	t	)	f	(	ϕ ∆	(	x	,	y	,	z	,	t	)))	(1)
	où (contraste), , , ( y x I o	) ϕ t ∆ , z	est l'intensité moyenne, ) , , , ( t z y x , la phase optique codant le mesurande et ƒ(…), une fonction définissant ) , , , ( t z y x m , la modulation de la figure des franges
	le profil des franges : sinusoïdale pour des interférences à deux ondes. L'écriture sous forme
	harmonique de cette intensité donne
										I	(	x	,	y	,	z	,	t	)	=		a	(	x	,	y	,	z	,	t	)	+	∑ ∞ 1 n =	b	n	(	x	,	y	,	z	,	t	)	cos(	n	∆ ϕ	(	x	,	y	,	z	,	t	))	(2)
	Avec maintenant	a	(	x	,	y	,	z	,	t	)		l'intensité moyenne (fond) et	b n	(	x	,	y	,	z	,	t	)	l'intensité de l'harmonique
	de rang n. ) , , , ( t z y x I o	et le contraste		m	(	x	,	y	,	z	,	t	)

  La lumière diffractée par le verre dépoli interfère sur le capteur d'enregistrement avec trois ondes de référence. Dans ce cas, le capteur enregistre une image de speckle en couleur et la phase des trois hologrammes rouge, vert et bleu est calculée par transformation de Fresnel dans l'ordinateur. Le problème est que la taille et la localisation des images dans le plan de Fresnel dépend de la longueur d'onde. Il n'est donc pas simple de les superposer pour obtenir une information couleur.La seconde consiste à former directement des micro franges d'interférences sur le capteur produites par les trois ondes de mesure qui ont traversé la veine d'expériences et les trois ondes de références. Ces micro franges d'interférences seront utilisées comme fréquences porteuses spatiales de l'information. C'est cette solution qui a été choisie. Ensuite, la transformée de Fourier 2D est calculée sur les trois plans séparément et un filtrage spatial adapté aux trois longueurs d'onde est appliqué pour reconstruire les cartes de phase et d'amplitude de l'image de référence (sans écoulement) et de l'image de mesure (avec écoulement). Les essais ont été réalisés ici avec un capteur 3CCD de chez Hamamatsu car c'est celui qui donne les meilleurs résultats[1]. Le filtre spatial positionné à la distance focale de la grande lentille achromatique permet d'éclairer la veine d'expériences en trois faisceaux de lumière parallèle. Le miroir plan placé juste derrière la veine renvoie les faisceaux sur le cube séparateur qui les retourne vers la caméra. La seconde lentille achromatique forme l'image sur le CCD et sa distance focale fixe la dimension du champ enregistré.

	Laser argon-krypton
	Lasers DPSS	Lentille	Miroir plan
		achromatique

Ce paragraphe concerne l'étude des écoulements subsoniques par interférométrie holographique numérique à trois longueurs d'onde (rouge, verte et bleue). Il existe deux possibilités pour analyser les objets transparents en mécanique des fluides par une méthode d'interférométrie holographique numérique couleur. La première consiste, tout comme en mécanique des solides, à former l'image des ondes de mesure traversant la veine d'expériences sur un verre dépoli.

2.1 Descriptif du trajet lumineux

Le schéma optique du montage est présenté sur la figure 1. Un cube séparateur sépare les trois faisceaux incidents pour former les trois ondes de référence renvoyées par le miroir concave sur la caméra et les trois ondes de mesure qui traversent la veine d'expérience.

3 Application à l'interférométrie holographique utilisant un laser pulsé

	Lorsqu'on veut étudier des écoulements variant très rapidement et à forts gradients d'indice, des
	problèmes importants apparaissent, comme la résolution spatiale du capteur, la résolution
	temporelle de la source lumineuse et l'effet d'ombroscopie généré par les forts gradients d'indice
	[3]. Les solutions adoptées ont été les suivantes : enregistrement de l'information à l'aide d'un
	capteur à très haute résolution spatiale (1920x1440 pixels de 3,65 µm²), résolution temporelle
	accrue en changeant de source lumineuse : mise en place d'un laser pulsé (9ns) ayant une
	longueur de cohérence adaptée (supérieure à 2m). Le temps de pose qui, auparavant, était fixé
	par la cellule acousto-optique (300ns), est réduit fortement, ce qui permet de figer le réseau de
	franges dans les structures tourbillonnaires. Enfin, la défocalisation de l'hologramme enregistré a
	été minimisé pour diminuer l'effet d'ombroscopie. Cette partie présente les résultats obtenus
	autour du même cylindre à Mach 0,73.
	3.1

Résultats obtenus avec le montage de type Mach-Zehnder Dans

  le montage de type Mach-Zehnder présenté sur la figure6, le faisceau de mesure ne traverse qu'une seule fois la veine d'expériences et le faisceau de référence passe à l'extérieur de la veine. La sensibilité par rapport au montage Michelson est donc divisée par 2. Un cube séparateur 50/50 est inséré juste en aval des deux cubes à séparation de polarisation pour former le faisceau de référence et le faisceau de mesure. Dans notre soufflerie, le faisceau de référence passe en dessous de la veine d'expériences. Cette fois, la veine d'expériences est encadrée par deux lentilles achromatiques de 800 mm de distance focale. C'est la distance focale de la seconde

Différence de phase non déroulée

Différence de phase déroulée

Conclusion

L'interférométrie holographique numérique utilisant une source laser pulsée a été mise en oeuvre pour augmenter la résolution temporelle dans deux montages optiques, l'un de type Michelson, l'autre de type Mach-Zehnder. La résolution spatiale a été obtenue en utilisant une caméra ORCA Flash 2.8 qui possède des pixels carrés de 3,65 µm de côté. L'écoulement instationnaire à Mach 0,73 autour d'un cylindre a été utilisé comme cas test.

Globalement, les résultats obtenus sont bien meilleurs lorsqu'une source laser pulsée est utilisée, mais l'orientation des franges d'interférences conditionne le dépouillement des interférogrammes. En particulier, il est difficile de résoudre les sauts d'indice de réfraction lorsque les ondes de choc ou les couches de cisaillement deviennent parallèles à l'orientation des franges d'interférences.

Néanmoins, les cartes de phase obtenues permettront de quantifier l'évolution du champ de la masse volumique en fonction du temps car les interférogrammes peuvent être synchronisés sur le signal du capteur de pression instationnaire implanté sur le cylindre.

Remerciement

L'auteur remercie l'Agence Nationale pour la Recherche qui a contribué au financement de cette étude par l'intermédiaire du contrat n° ANR-14-ASTR-005-01.

Références

[1] Desse JM, Picart P & Tankam P. "Digital three-color holographic interferometry for flow analysis" Opt. Express, 16(8), 5471-5480, 2008.

[2] Desse JM, Picart P. "New Techniques in Digital Holography: Digital color holography for analyzing unsteady wake flows" Chapter 3. Ed. P. Picart. ISBN 978-1-184821-773-7. Edition Iste-Wiley, Hermesscience publishing, 2015.

[3] Desse JM Picart P & Tankam P. "Digital color holography applied to fluid and structural mechanics" Optics and Lasers in Engineering, vol. 50, pp. 18-28, 2012


André Pereira
email: apereira@dcc.fc.up.pt

Manuel Correia

Pedro Brandão
email: pbrandao@dcc.fc.up.pt

USB Connection Vulnerabilities on Android Smartphones: Default and Vendors' Customizations

Keywords: Android, Security, USB vulnerability, privileges escalation, vendor vulnerabilities

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Nowadays the extended features that smartphones possess are crucial to explaining its success, we see a yearly increase of its market share over traditional phones. The extra features like phone banking, e-mail, GPS, together with the traditional features of phone calling and SMS make the smartphone essential to our daily lives and ease our existence in this day and age. These benefits lead us to expose our personal data increasingly more, as such, the security associated with these systems is essential.

The Android system composes 80% [START_REF]Android Pushes Past 80% Market Share While Windows Phone Shipments Leap 156.0% Year Over Year in the Third Quarter, According to[END_REF] of the worldwide market share, making it a big player on the smartphone business. Since it is an open source Operating System (OS), the research of vulnerabilities on the system is in the best interest of the community.

Vendor customization is one of the advantages of the Android ecosystem, but this is a double-edged sword, since it can introduce security breaches. Attackers could exploit different attack vectors on many of the different ROMs, as vendors add software, such as applications and system owned processes, for dealing with things like USB pairing. According to a recent study [START_REF] Wu | The impact of vendor customizations on android security[END_REF], vendor customization accounts for 60% of the vulnerabilities found in the Android ecosystem. We researched Samsung's Android customization and discovered the possibilities introduced to exploit the system.

In this paper we present a newly found vector to exploit the USB connection, more precisely to a vendor customization that extends the AT commands 1 . The system understands and lets these commands be sent by USB. We also describe a proof of concept of the attack and a scenario where this attack could be used.

In the proof of concept, we were able to effectively flash a compromised boot partition without the user consent. This enabled the three main objectives of the attack: gain root access, enable adb2 and install a surveillance application that is impossible to uninstall without re-flashing the android boot partition.

Attack Scenario

The main purpose of the attack is to explore the vulnerabilities found on the Android OS, namely the vulnerabilities found in its USB connection. This mandates that the attacker must possess a physical USB connection linking the computer of the attacker to the victim's device.

A practical scenario would be the installation of a public kiosk for charging devices' batteries. However, the true purpose would be to inject malicious code into the devices. Unbeknownst to this malicious purpose, the victim would willingly place its device in a compromised situation, hoping that it would charge the phone's batteries.

Such scenario could be very fruitful, as we expect easy acceptance by the victim to place the phone in such a manner. There are a couple of reasons for this. First the lack of knowledge of the dangers of an exposed USB connection. As this is such an uncommon practice, even an IT experienced user could possibly lack this knowledge. The second reason is the emergency state in which the victim is in. Nowadays our cellphone is an extension of ourselves, it is completely implanted in our daily life and the lack of it is unthinkable. This is even truer for smartphones, since you can perform additional tasks on it, like phone banking and e-mails. So a situation where the cellphone battery is empty or almost empty, would easily lead the victim to expose its device to the charging kiosk.

Given the nature of such an attack, a script is necessary on the computer holding the other end of the USB cable. A script capable of accurately detecting the smartphone, match its vulnerabilities and proceed with the attack. For example we would execute a different type of attack for different Android versions, for different firmware versions, as well as different brands and different products of those brands. As an example, in the Samsung smartphone family, we could have an attack for the Galaxy S2 and another attack using different vulnerabilities found for the Galaxy S4.

Vulnerabilities

The following vulnerabilities are used in the proof of concept described in the next section. We will first elaborate on said weaknesses and then describe the overall attack. Some vulnerabilities are documented commands, like the standard AT commands and others were discovered in our work. AT commands by themselves are not the vulnerability, but the vendors' implementation of them make them so.

AT COMMANDS

The AT commands (ATC) define a command language that was initially developed to communicate with Hayes Smartmodem. Nowadays it stands as the standard language to communicate with some types of modems. For example, protocols like GSM and 3GPP use this type of commands as a standard way of communicating with the modem. With ability to issue these commands to the modem, we are able to [START_REF] Specification | AT command set for 3GPP User Equipment (UE) (3G TS 27.007 version 2[END_REF]:

 Issue calls;  Send SMSs;
 Obtain contacts stored inside the SIM card;  Alter the PIN.

In order to understand this attack vector, we need to comprehend how a modern smartphone works. A modern smartphone is built with two OSs, running in two very different environments [START_REF] Mulliner | Taming Mr Hayes: Mitigating signaling based attacks on smartphones[END_REF]. On one hand we have the AP, Application Processor, where the android OS and all the applications with which the user interacts run. On the other we have the Baseband/Cellular Processor (BP/CP), where the entire cellular (ex.: GSM) communication is done and where the modem lies. Issuing AT commands is not the only way to communicate with the modem, but it is the most popular way, together with RPC (Remote Procedural Calls).

The RIL, Radio Interface Layer [START_REF] Singh | Android Internals and Telephony[END_REF], is the layer on the OS responsible for establishing a communication between the android OS and the modem. If a component in the application framework needs to send messages or make calls, it uses the RIL in the application framework to do so. Where in the application framework, the RIL uses the Linux IP stack as a way of communicating with the baseband, establishing the communication channel.

In our scenario we can use the USB connection to issue such commands. This vulnerability is only made possible due to the fact that some Android smartphone manufacturers, like Samsung and HTC, enable this through the USB channel. This means that it is possible to send, using the USB connection, AT commands directly to the baseband. We stress the fact that this is not a default feature of the Android OS, but manufacture added.

In a practical scenario, upon the detection of a new USB device, the driver responsible for that device recognizes that the device has a modem type of interface through the USB, notifying the OS of such. Hence forward the OS has a way of communicating with the modem, which can be used in our attack scenario. We can thus send AT commands to make phone calls or send SMS to premium cost numbers. This way making the attacker earn money, or more accurately stealing it.

Complementing this, some manufacturers extend this list, adding some proprietary commands, with the purpose of enabling control and capabilities that they want to have on the system. These commands are private and manufacturers do not publish them. But without the use of some form of encryption, anyone is able to eavesdrop the communication channel and try to understand, what lies under the system.

Vulnerabilities discovered and AT Samsung proprietary commands

In the case of Samsung, a vast list of its family of smartphones has this vulnerability, where it is possible to communicate with the modem through the USB channel, without any previous configuration on the smartphone. This is something that does not happen with adb.

Samsung extends the standard AT command set that comes with the 3GPP and GSM standards adding their proprietary commands. This extends the capabilities of interaction that their computer software (Kies) has on the device.

In fact Kies for Windows uses both the standard set and the extended proprietary AT command set, to at least achieve the following operations:

 Obtain the contact book;  Obtain the files in the SD card;  Update the firmware on the cellphone.

Through eavesdropping methods 3 , on the USB channel and watching the android logcat 4 , it was possible to discover the way in which the Kies software interacts with the device to accomplish those tasks.

As mentioned, the Kies software uses a proprietary set of AT commands. To achieve this, several processes inside the smartphone parse the commands received, to know if it is just an ordinary AT command or a proprietary Samsung command. According to the result, it issues or not the command to the modem. The smartphone must be a Samsung phone and contain a valid Samsung ROM. The ROM has a chain of processes that intercept the commands sent by USB and send them or not to the modem.

Fig. 2. Chain of communication when AT commands is sent through USB.

In Fig. 2 we are able to see in the red dashed box a non-proprietary AT command that the OS intercepts and sends to the modem. In the blue box we have an example of a flow for a proprietary command that is not sent to the modem.

If we use a program to communicate using the serial port (eg.: Realterm5 ), we can send commands to the modem through a virtual COM type, instantiated by the driver. When we issue the proprietary command AT+DEVCONINFO and analyze the Androids' logcat, we can see that there is a process with a tag dun_mgr that is listening to the USB channel. Initially it receives the command and delegates it to the process with the AT tag. This process executes it and responds to the original process, which forwards the response through the USB channel.

Fig. 3. Logcat of issuing AT command

This led us to conclude that there is an interception by the OS, before deciding whether to send the command to the modem or to the Android OS.

Command "AT+DEVCONINFO".

The execution of the proprietary command AT+DEVCONINFO, in addition to obtaining all the information displayed in Fig. 4, also triggers the smartphone to mount the SD card on the computer as a mass storage device. When we eavesdropped the USB connection, we could confirm that this was one of the firsts commands sent to the phone by the Kies software. This assists the program in gathering all the necessary information in order to work properly. As it can be seen in Fig. 4, the information includes the smartphones' firmware version, the phone model and IMEI.

Fig. 4. Response message from issuing AT+DEVCONINFO

With this functionality, it is possible to make an attack to steal all the information inside the SD card.

Command "AT+FUS?".

With the execution of AT+FUS? the smartphone is placed in download mode, which is the mode where all Samsung smartphones need to be in order to flash their internal partitions and thus update the smartphones' firmware. Normally putting the phone in download mode involves mechanical key pressing, i.e., input from the user, which implies acceptance to flash the phone. This is not the case when it is triggered by the AT command, no user intervention is needed, which enables an automation of this process. The discovery of this command, led us to conclude that this is the way that the Kies software uses to update the phone firmware. Download mode is similar to fastboot mode that you find in other Android smartphones, but in download mode we cannot use the fastboot tool included inside the android SDK, only Odin [START_REF]Odin 3.09 -Odin download with Samsung ROM Flashing Tool[END_REF] and Heimdall [START_REF] Heimdall | Glass Echidna[END_REF] serve that purpose. They are both popular flashing software for Samsung devices. Odin is closed-source free flashing tool for windows and Heimdall is a cross-platform open-source tool suite. This is the most damaging of the vulnerabilities, since we can alter the partitions inside the phone, explicitly injecting code on the partition that we want. The novelty of this attack, like the AT+DEVCONINFO command, is that no prior configuration is needed on the phone. We can do this, just right after the phone is bought. Placing the phone in download mode enables us to use Odin to flash the phone with malicious partitions.

ADB enabled

It is important to mention adb, the android debug bridge, since later we use it to gain further capabilities on the system. The adb serves as a means of communication between a computer (host) and a smartphone (device). The communication is done via USB, but it is also possible to configure the device so that the connection is made through WiFi.

An USB connection and an adb enabled Android, could pose a serious security threat to the smartphone, so serious that since Android version 4.2.2 [START_REF]Security Enhancements in Android 4.3 | Android Developers[END_REF] Google made a security enhancement to the adb connection. Making sure that every USB connection has an accepted RSA key pair with the host computer the android is connected to. So every new USB host the android smartphone tries to connected, needs to be previously accepted by the user.

With adb enabled we can [START_REF]Android Debug Bridge | Android Developers[END_REF]: a) get shell access to the device; b) install applications that were not verified by the Google app store bouncer 6 ; c) uninstall applications; d) mount the SD card; e) read the contents of logcat; and f) start an application.

Shell access through adb could also unveil new attack vectors has shown in [START_REF] Vidas | All Your Droid Are Belong To Us : A Survey of Current Android Attacks[END_REF], were it is possible to gain privileged access, with rooting techniques like Super One-Click root [START_REF][END_REF] and also Cyndia impactor [START_REF]Cydia Impactor[END_REF].

In fact Kyle Osborn presented in Derbycon 2012, a shell script suite 7 that uses adb to injected several rootkit malwares and tools, to help in the extraction of the screen pattern, user information and other data. Prior to that, in Defcon 2011, Joseph Mlodzianowski and Robert Rowley built a public charging kiosk, to raise awareness about the dangers with USB connections. The users would plug the device, and the kiosk would prompt the device id of the user, with no other malicious intent.

4

Anatomy of the attack (Script)

As mentioned in section 3.3.2 we developed a script to automate the attack process in our proof of concept development. We will describe it in this section.

Architecture

The script has to be fast, fully automated, effective and able to perform operations on numerous levels of the OS stack. We had the need to make use of the functionalities of two different OSs, Windows and Linux. For that we deployed the script in a guest virtual machine containing Xubuntu that is able to communicate with its Windows7 host machine. We use a Xubuntu virtual machine so that the script can take advantage of the Linux OS scripting environment. Linux comes with libusb8 as a generic driver to handle USB devices, which in turn is used by the usbutils, making it more practical for scripts like this to be developed. We will detail its functionalities further down.

As virtualization software we used Virtual Box 9 . This program enables us to create guest virtual machines and at running time exchange the control of the USB device from guest to host and vice-versa. In order to give the guest control over the USB device, it presents a virtual USB controller to the guest, and as soon as the guest starts using the USB virtual device, the USB device will appear as unavailable to the host. So only one OS has access to, and thus can control, the USB connection at a time.

It is essential that the guest machine is Linux and the host Windows and not the other way around. This guarantees that the Samsung device drivers have direct access to the USB device, which would not work inside a guest machine, because the devices are emulated by Virtual Box. The type of attacks done by the guest machine cope with this emulation process.

We have a host with Windows 7 so that we can have access to Odin that is used to flash Samsung devices. This tool is unable to work on Linux, because of the dependence that it has on the Windows' Samsung drivers. Other tools are able to flash firmware on Samsung phones on Linux, like Heimdall, but it is only able to target a limited number of Samsung smartphones, whereas in the case of Odin we are able to target all Samsung smartphones.

A communication channel between the host and the guest is needed, in order that the guest, which is doing most of the work, can tell the host when and which smartphone to flash. For that we use a shared file between the guest and the host OS, so when the guest needs to communicate it writes the file. The host is polling the file for changes. The roles are exchanged when the communication is in the opposite direction. In the guest machine, a full list of the USB devices that we want to attack is needed, in order to tell the guest machine which devices to filter, so that they can be controlled inside the guest and not on the host. This is done by identifying the product id and the vendor id, which together identify all USB devices. The vendor id identifies the brand, for example Sony, and the product id identifies the product, for example Xperia.

The script running on the Xubuntu (guest) is responsible for:

 Detecting plugged USB devices;  Identifying the type of device;  Identifying the vulnerabilities known for that device;  Attacking using the known vulnerabilities;  Communicating with the host, in case the vulnerabilities require the use of the Odin tool;  Identifying the mounted external cards of USB devices.

The Windows 7 (host) is responsible for:

 Communicating with the guest, to know which device to flash;  Identifying the flash image that matches the device and its firmware ;  Identifying the correct version of Odin for flashing ; It uses GUI automation libraries, namely Pywinauto [START_REF]pywinauto -Windows GUI automation using Python -Google Project Hosting[END_REF], to control Odin without human intervention.

Using the vulnerabilities found

As we mentioned in the previous sub-section, the guest machine detects plugged devices, identifies them, matches them to the vulnerabilities found and executes the attacks that target those vulnerabilities. We will now cover the vulnerabilities and the attacks.

Device identification.

The purpose of this attack is firstly to identify the firmware version of the smartphone with the command AT+DEVCONINFO, as it was shown in Fig. 4. Enabling us to identify the firmware version of the smartphone in question. In Fig. 4 it is identifiable by VER (S5839iBULE2/ EUR_CSC /S5839iBULC1/ S5839iBULE2) that shows the following details as per the format PDA CSC Modem Boot:

 PDA: The build version, which includes the system partition. 6 illustrates a firmware file to be flashed on a device. The boot partition is placed in a boot.img type file, which is inside of the PDA file. This file in turn is a tar file with a checksum, usually a .tar.md5. Usually inside the PDA file there is also the System partition. In order to flash we only need the boot.img file. For our proof of concept we re-constructed a stock boot partition.

The bootloader [START_REF] Hoog | Android Forensics: Investigation, Analysis and Mobile Security for Google Android[END_REF] is very different from the boot image. The bootloader is the very first piece of software that gets executed on a device. One of its roles is to check the integrity and signatures of the partitions before it starts them. This prevents any modification of the partitions, such as the boot or the system, by an un-authorized third party. When a bootloader is unlocked, like in some Samsung devices', it does not check the signatures of the partitions, which means a further modification of the partitions is possible, thus enabling our attack.

Normally the boot.img file is divided in two parts, the Kernel and the ramdisk. The ramdisk is the first file system mounted on the root of the system. There we can find files like the init file and the init.rc, the image that is used in the booting process of the smartphone and various other folders needed for good performance of the system.

In the init.rc [START_REF] Vidas | All Your Droid Are Belong To Us : A Survey of Current Android Attacks[END_REF] file we can find several shell type instructions for the initial configuration of the system. Instructions that will be executed with root access by the init process. It is in this file that we will alter the ramdisk of the boot partition, adding malicious instructions.

In this scenario we want to show three different things that can be done by altering just the boot partition, first make the adb debug over USB option always enabled, second obtain root access, third install a surveillance application, in this case Androrat [START_REF][END_REF].

For the first objective, we have to alter the on property:persist.service .adb.enable=0. This system property tells the system, what operations to do when disabling adb. In the original file, when adb was disabled, we had that it would stop adbd, effectively stopping the adb daemon on the smartphone. We changed this from stop adbd to start adbd, rendering it impossible to disable the adb from configuration, even thought it might appear disabled in the systemss' options.

For the second objective, we want to obtain root access on the smartphone using the binary tool su [START_REF] Superuser | [END_REF]. The binary configured with permissions of execution for everyone, and with the owner as root, enables every user to have root access. We put the su file inside the ramdisk, being placed on the root of the system and then copying it to /sytem/xbin/. This is done adding these lines to the init.rc file.

 COPY /SU /SYSTEM/XBIN/SU  CHMOD 06755 /SYSTEM/XBIN/SU  CHOWN ROOT /SYSTEM/XBIN/SU This will allow root access to any operation, for example when adb is enabled it will have root access.

For the third objective we want to install a surveillance application, in this case Androrat which stands for Android RAT (Remote Access Tool), in a way that the user does not know of its existence. First we place the application .apk file in the ramdisk directory, so that once it boots, it places the .apk in the root of the system, similar to what we did for su. Then we add again to the init.rc script, the following code:

 COPY /ANDRORAT.APK /SYSTEM/APPS/ANDRORAT.APK Once the phone boots, the application is installed as a system app. This makes the removal of the application extremely difficult for regular users even with root access. As described the application gets installed each time the phone boots.

The AndroRat application enables several remote surveillance capabilities on the phone, such as get contacts, get call logs, get all messages, GPS location.

AndroRat is composed of a client and a server, the client is the application that gets installed on the phone, the server runs on a PC, regardless if it is a Windows, Linux or Mac, since it runs in a java virtual machine. The client communicates with the server by TCP/IP. We altered the AndroidManifest.xml of the original application, deleting the following lines: <intent-filter> <action android:name="android.intent.action.MAIN" /> <category android:name="android.intent.category.LAUNCHER" /> </intent-filter> This way making the icon is not visible in the app section of the phone, so an inexperienced user would not detect the malicious application.

Installing the new boot image.

For a successful attack we need to create a dictionary of previously altered boot partitions, to encompass all the different smartphones that we want to attack. For example, for the bundle version presented in VER(S5839iBULE2/ EUR_CSC/ S5839iBULC1/ S5839iBULE2), we have to specifically map this bundle version to a boot previously altered that matches it.

After an initial identification of the smartphone version from the Linux guest machine, it is necessary that we place the smartphone in download and notify the host machine, handing over the control of the USB device to the host. When putting the device in download mode, its product Id and vendor Id gets altered, to a non-filtered combination of vendor Id and product id by Virtual Box, rendering the process of handing over the control of the USB device automatic. The guest machine saves the IMEI of the smartphone, so that once the phone reboots, it already knows that it is a compromised smartphone, which would enable the guest to do other types of attacks, since the adb is on and we have root access.

After the host is notified to flash the device with the firmware version, it maps the given version to a previously altered boot image that is ready to be flashed. It also maps the correct version of Odin.

Using a GUI automation tool for Windows, the host commands Odin to choose the correct image file folder and name and then to flash the phone. The smartphone proceeds with the flashing of the partitions and reboots normally. After rebooting, its product id and vendor id changes once more to the previous ones, handing over again the control of the USB connection to the guest machine, so that it can proceed with the attack. List of phones tested with the vulnerabilities found.

We successfully verified the attack on the following phones:

 Samsung GT-S5839i  Samsung GT-I5500
And it was also possible to confirm that the attack was possible, by issuing AT commands that the fallowing phones had the vulnerability:

 Samsung GT-S7500  Samsung GT-S5830  Samsung I9100  Samsung S7560M
It is necessary that the smartphone has an original ROM from Samsung. We expect that the span of vulnerable versions of Samsung smartphones be much more wide than this, since in our assumption, having the vulnerability or not is implicitly related with the ability that the smartphone has on communicating with Kies software. So as far as we now, most (if not all) Samsung smartphones are supported by Kies.

List of tested Anti-virus Apps. AVG, Avast and Virus Scanner were the anti-virus chosen for testing. First we examined if any of them detected/prevented the attack, and later, after the attack if any of them detected malicious software on the phone. The results are that none of them prevented the attack at first. After the attack, and after a scan had been performed, AVG detected that androrat was installed and informed the user that it could be malicious. However, upon trying to uninstall the threat it states that it cannot. Nothing more has been detected by AVG, or by the other two anti-viruses. They did not detect alterations to the init.rc file, or that su binary was added when compared to the previous state.

Conclusion

We exposed a serious vulnerability on some vendor customization of the android OS. We described our proof-of-concept with which we were able to explore the implications of that vulnerability, such as gaining root access by flashing a compromised boot partition. As the extended functionalities are intended to be used by the computer application of the vendor to configure and manage the smartphone, they were developed knowingly and with the mentioned intent. In our view, implementation of such "features" should be at least disclosed to users, in order that they understand the risks of an exposed USB connection. Our future work will involve developing a smartphone application to warn and advise the user regarding these possibilities. Depending on the smartphone's root access it can also be possible to allow the charging by possible hibernating the process responsible for handling the AT commands. Another future investigation will be to confirm that the "features" are still present in the latest version of the Samsung Kies software and the latest version of Android.

Fig. 1 .Fig. 1

 11 Fig. 1. Android Telephony system architecture from[START_REF] Module | Android RIL Integration Guide-Huawei[END_REF]

Fig. 5 .

 5 Fig. 5. Architecture of communication from Guest to Host.

   CSC: (Country Sales Code): Language and country parameters.  Modem: Identifying the modem firmware version.  Boot: For the version of the Boot partition. Changing the Boot Image. As we described in 3.3.2 the AT command AT+FUS? places the phone in download mode and allows flashing a new boot partition.The primary functions of the boot partition are:  Mount the primary partitions necessary for the system to boot;  Start the first process of all OSs based on Linux, i.e. the init process;  Read and execute the init.rc boot configuration file;  Load the kernel and the ramdisk.

Fig. 6 .

 6 Fig. 6. Structure of a typical PDA file.

Fig.

  Fig.6illustrates a firmware file to be flashed on a device. The boot partition is placed in a boot.img type file, which is inside of the PDA file. This file in turn is a tar file with a checksum, usually a .tar.md5. Usually inside the PDA file there is also the System partition. In order to flash we only need the boot.img file. For our proof of concept we re-constructed a stock boot partition.

First the Guest Linux does: 1 .

 1 Detection of plugged USB devices. 2. Matching of its vulnerability. 3. Checks if it has a compromised boot partition. 4. Notifies the boot image to flash the device and saves the IMEI. 5. Places the phone in download mode. Then the Host Windows does: 6. Identification of which file matches give version. 7. Makes use of GUI automation tools to control Odin and flash the phone And again the guest Linux finishes with: 8. Proceeds with the rest of the attack, now that it possesses root access and adb enabled.

Serial commands for modem configuration and management.

Android Debug Bridge[START_REF]Android Debug Bridge | Android Developers[END_REF]

http://www.sysnucleus.com/, USBTrace: USB Protocol Analyzer

Android Logging System[START_REF] Gargenta | Learning Android[END_REF]

Realterm is a terminal program specially designed for capturing, controlling and debugging binary and other data streams.[20]

Dynamic heuristic malware detection system, for the Google app store.

https://github.com/kosborn/p2p-adb: p2p-adb Framework

http://www.libusb.org/

https://www.virtualbox.org/

Acknowledgments

This work is financed by the ERDF -European Regional Development Fund through the COMPETE Programme (operational programme for competitiveness) and by National Funds through the FCT -Fundação para a Ciência e a Tecnologia (Portuguese Foundation for Science and Technology) within project *«FCOMP-01-0124-FEDER-037281»*


Paulo Pinto
email: prpinto@itgrow.pt

Bernardo Patrão
email: bernardo.patrao@watchfulsoftware.com

Henrique Santos
email: hsantos@dsi.uminho.pt

Free typed text using keystroke dynamics for continuous authentication

Keywords: Identity verification, User authentication, Biometrics, Keystroke dynamics, Host-based intrusion detection, Security

Information is increasingly in a digital-only format and almost everything we do nowadays depends on a digital identity for authentication and authorization. No matter how strong the authentication system is, after the authentication phase, there is no continuous verification that user is still the same human being that successfully logged in, thus leaving the system unprotected. This paper presents a usable breakthrough approach for continuous authentication with free typed text through the use of biometric techniques based on keystroke dynamics. Our main purpose is to achieve a reduction of the required sample size, while improving (or at least not worsen) precision performance, by adapting and improving parameters on a keystroke dynamics algorithm.

Introduction

In a world governed by digital information, computing is the main activity and user authentication plays an important role in access control. One of the most common situations of intrusion occurs when a worker leaves his/her workstation unlocked or when someone knows a user password and tries to use a false identity to do something malicious (for example, to send an e-mail, to change a document, to write on facebook or twitter) [START_REF] Lynch | Securing Against Insider Attacks[END_REF][START_REF] Schulz | A Framework for Understanding and Predicting Insider Attacks[END_REF].

Keystroke dynamics, as a biometric for authentication, can be used to mitigate the above threat, continuously detecting intrusions [START_REF] Monrose | Keystroke dynamics as a biometric for authentication[END_REF]. But false alarms in such intrusion detection systems are quite common [START_REF] Killourhy | Comparing Anomaly-Detection Algorithms for Keystroke Dynamics, Dependable Systems and Networks[END_REF] and the european standard for access-control systems (EN-50133-1) specifies a false alarm rate of less than 1% for this type of solution [START_REF]CENELEC European standard EN 50133-1, Alarm systems. Access control systems for use in security applications, European Committee for Eletrotechnical Standardization[END_REF]. For that reason, it is crucial to optimize algorithms to achieve low false rejection rate (FRR) and false acceptance rate (FAR).

In this paper, we present an heuristic optimization of an algorithm based on keystroke dynamics and results obtained from a real experiment, for validation purposes.

The rest of the paper is organized as follows. Section 2 is dedicated to the study of keystroke dynamics and how it can be used to verify user identity and section 3 is the state of the art. In section 4, we start defining main functions used for the intrusion detection and we also define the decision criterion. In section 5 we present techniques that will allow us to improve the algorithm as well as how these techniques can be implemented. On the same section we describe a new decision criterion that will allow us to get FRR lower than 1% (validated with results on a real environment) and in section 6 we write the main conclusions of this work.

Biometrics and keystroke dynamics

Using biometrics, each individual can be uniquely identified by physical and behavioural characteristics and, unlike passwords, biometrics can not be lost, stolen or copied. There are several biometric techniques such as fingerprints, the way you walk, your eye geometry or even the way you speak [START_REF] Bergadano | User authentication through keystrokes dynamics[END_REF]. Each one can be used to identify or to authenticate. In a very simplified way, identification involves the comparison of a given biometric pattern with all of previously stored patterns. Authentication is similar but involves only one comparison with the pattern belonging to someone claiming identity checking. In both cases, one main concern is to avoid false rejections and false acceptances: for access control the objective of the application is to not allowing access to unauthorized individuals under all circumstances while granting access to all legitimate users. It is clear that the surveillance software has to be set up with a very low FAR even if it comes at the price of a higher FRR. On the other hand, identification within surveillance software has to be set up with a low FRR even if FAR gets higher.

Keystroke dynamics is a technique aiming to find patterns based on timing information from pressed and released keys when a person is typing at a keyboard. Most common features are dwells (time between key down and key up of a specific key), flights (time between key up and key down of two consecutive keys), digraphs, trigraphs and fourgraphs [START_REF] Monrose | Keystroke dynamics as a biometric for authentication[END_REF]. Weather conditions, fatigue, stress or any sort of influence, can drastically impact the result but with a constant user profile update, even the effect of these weird behaviours can be drastically reduced.

State of the art

Keystroke dynamics is a behavioural based furtive biometric technique [START_REF] Magalhes | Keystroke dynamics stepping forward in authentication[END_REF] that does not require any special resources (hardware), besides a normal keyboard and the support low-level software usually available in any PC like system. These properties make it a good candidate for continuous authentication [START_REF] Ferreira | Intrusion detection through keystroke dynamics[END_REF]. Recently this research topic received some important contributions, being evident that one of the main issues is the training data used. Solami et. al present a generic model for a Continuous Biometric Authentication System (CBAS), discussed some proposed solutions and propose a classification based on the type of target scenario: class I, when legitimate users' profiles are available and the identities of all possible impostors are known (i.e., a closed system); class II, otherwise [START_REF] Solami | Continuous Biometric Authentication: Can It Be More Practical?[END_REF]. In this work we are targeting a class I system, aiming to improve only its performance over the internal user universe. The base of the software architecture is the one proposed in [START_REF] Ferreira | Intrusion detection through keystroke dynamics[END_REF][START_REF] Ferreira | Keystroke dynamics for continuous access control enforcement[END_REF]. It is composed of a central server, a database where user profiles are saved and a constant validation mechanism for each sample produced by the user (see above references for more detailed information).

The mechanism receives an attempt sample and needs to decide whether it is an intrusion or not (see Fig. 1). The decision algorithm is the heart of the mechanism and, as we will see later, with a generalization of the scores function proposed in [START_REF] Monrose | Keystroke dynamics as a biometric for authentication[END_REF] (by defining new parameters and new metrics), varying acceptance thresholds and implementing a dynamic decision criterion, it is possible to substantially decrease the FRR, the FAR and the attempt sample size.

Absolute scores

The user profile, stored in the database, consists essentially in one merged sample with all characteristic user features. This profile is constructed and constantly updated every time the user produces a new valid sample.

Let us define AS(l) as the set of all features from an attempt sample with length l and DB as the set of all features from the merged sample stored on the database. Let us also define, if exist, DW (x(y)) as the average of x(y) where x(y) ∈ I DW (y) = {all dwells in y} and y ∈ J = {AS(l), DB}.

Intuitively, we define F L(x(y)), DI(x(y)), T R(x(y)) and F R(x(y)) for flights, digraphs, trigraphs and fourgraphs, respectively, and the corresponding sets

I F L (y) = {all f lights in y}, I DI (y) = {all digraphs in y}, I T R (y) = {all trigraphs in y} and I F R (y) = {all f ourgraphs in y}.
For each feature x on the merged sample (x(DB)), we define the acceptance neighbourhood as

V (x(DB)) = [(2 -p(z))z(x(DB)), p(z)z(x(DB))],
where

z(x(y)) =      DW (x(y)) if x is a dwell in y, F L(x(y)) if x is a f light in y, DI(x(y)) if x is a digraph in y, T R(x(y)) if x is a trigraph in y, F R(x(y)) if x is a f ourgraph in y.
and p(z) ∈ [1, 2] is a parameter that defines the interval around z(x(y)). Note that we write z without arguments in p(z) because we are referring to the type of feature and not to some specific feature, meaning that features of the same type (for example dwells) all have the same parameter value to define his acceptance neighbourhood.

For each feature x ∈ AS(l) that is shared with the merged samples, the acceptance feature function is defined as

A(x) = 1 if z(x(AS(l))) ∈ V (x(DB)), 0 otherwise.
Defining N (z) as the number of shared features between AS(l) and DB of the type z (for example, if z = DW then N (z) is the number of all shared dwells between the attempt sample and the merged sample), we write the absolute score as

Ab(AS(l)) = z∈Z w(z) 1 N (z) x∈Iz A(x)
, with w(z) = 1, where w(z) is the weight parameter associated to each type of feature. Note that the formula proposed by Monrose and Rubin [START_REF] Monrose | Keystroke dynamics as a biometric for authentication[END_REF] is a particular case of the absolute score defined here.

Relative scores

The relative score value is based in time disorder divided by the maximum disorder. For each type of features in our AS(l), a list is created ordering all features by time. Then this order is compared with the one from DB. Let us define D(z, AS(l)) as the function that give us the disorder between all shared features of the type z in AS(l) with DB(see [START_REF] Ferreira | Intrusion detection through keystroke dynamics[END_REF], 5.3.2 for more details). Then, the relative score is written as

Rl(AS(l)) = 1 - z∈Z D(z, AS(l)) D m (z, AS(l))
,

where D m (z, AS(l)) is the maximum possible disorder between AS(l) and DB for some z type of feature.

Decision criterion

The value to compare with a fixed threshold is a linear combination of the two quantities defined before:

S(AS(l)) = w Ab Ab(AS(l)) + w Rl Rl(AS(l)), (1)
where w Ab and w Rl are weights. We define 3 thresholds for different intrusion levels: yellow, orange and red level represented by th y , th o and th r , respectively. The intrusion is detected when S(AS(l)) < th y .

Parameter space

The parameter space is composed by p(z) ∀z ∈ Z, w(z) ∀z ∈ Z, th y , w Ab , w Rl and l. The trivial configuration is the configuration where each event has the same weight as well as each score function.

Validation

All results presented in this section come from a real environment composed, most of the times, by more than 10 users. The users are, for the most part, software developers, meaning their input can result from coding and/or writing, both formally and informally, in English and Portuguese, in several distinct software environments. In some sense it is the worst case scenario to classify behaviour since there is a great variety on the user actions.

According to initial requirements we assume no other users have access, i.e., intruders are internal users trying to circumvent access control rules.

Tool description for artificial attacks

On the database, each user has his own merged sample with all characteristic features. This merged sample is the user profile previously saved and constructed using the user samples also saved on the database.

With all samples from the database we can test the algorithm. For a particular user, we can simulate authentications using the samples from the database against the merged sample of the same user. In that way we can calculate the FRR. Also, we can calculate the FAR of the entire group using all samples against each merged sample. It is an artificial attack because people are not intentionally attacking but it is the easiest way to simulate a large number of attacks and it is according to the scenario specification. Acceptance neighbourhoods are controlled by the parameters p(z). Considering w(z) = 0.2 ∀z ∈ Z, w Ab = 0.5 and w Rl = 0.5 (trivial configuration), what we study first is the "best" (heuristically speaking) acceptance neighbourhoods for each type of features looking at the FRR and FAR calculated from artificial attacks. Fig. 2 is a summary of the best scenarios tested with l = 750. The first column of the second table represents different thresholds to detect intrusion. As an example, for the value 0.06, th y is defined as th y = (S(DB) -0.06), where S(DB) is the score from the user profile.

Acceptance neighbourhoods study

As we can see from Fig. 2, when we increase the threshold we get a high FRR and when we decrease the threshold the FAR tends to increase. Situation A produces a very high FRR with high security level (threshold= 0.06) and situation E produces a very low FAR with low security level (threshold= 0.12). The table shows that situation B is the one that produces the best results to minimize FAR and FRR.

Transients study for sample reduction

This part of the study allows us to understand if it is possible to reduce the size of the attempt sample and how much we can reduce. The more information we have, the more accurate are our decisions. On the other hand, the fewer keys the intruder types, the less damage the intruder does before being detected. The aim is always to find best of both parts.

Transient is a common term in differential equations theory and essentially represents states that actually are not the common states on some dynamical system. A simple example is throwing a rock to a lake: The waves produced by the rock is a transient state since most of the time the lake has no waves. The classical example for transients is the harmonic oscillator [START_REF] Serway | Physics for Scientists and Engineers[END_REF]. In our mechanism, we have S(AS(l)) l→∞ -→ a with a representing the characteristic value for the user (in theory close to 1).

Here, the transients are the values we get when l is too small and, consequently, are not user representative. Identifying the minimum l for which we do not have any more transients means identifying the minimum size of the sample to get a reasonable value for a. Fig. 3 shows the transients study using 3 samples with 750 keys each from 3 different users. The horizontal axis represents sample reduction process and the vertical axis is the score defined in [START_REF] Lynch | Securing Against Insider Attacks[END_REF]. In each iteration of the reduction process, we erase 11 or 12 features from the samples (on the same proportion as they exist for any sample with length l). This figure shows that after 11 sample reductions, the value of S(AS(l)) starts to be a bit unstable. Using 11 as the maximum number of reductions for the trivial configuration means that we can reduce the sample size in 40% (around less 300 keys) but 450 keys is still a considerable number for an attempt sample.

The question we would like to answer is: It is possible to get a better reduction result with a different parameter configuration? Next section we answer this question with an heuristic study of the weights.

Weights study

The study of weights has three distinct phases. The first one is the absolute and relative weights study. With the good weights from the first phase a study of the weights of each type of feature in the absolute score is done (the reason we are only considering the absolute score is justified by the first phase study). Finally, we check if, after the second phase, we still have the same weight results for absolute and relative scores. There might be more efficient ways to conduct this study like using genetic algorithms [START_REF] Mitchell | An Introduction to Genetic Algorithms(Complex Adaptive Systems[END_REF] but, apart from the fact that this approach takes much less time, even using this simplified technique, the results should be very similar to the ones from a genetic algorithm strategy.

In Fig. 4, the chart on the left shows how the gap between the average intrusion score and the average user score increases at the same time as we increase the weight of the absolute score. On the horizontal axis, we start with S(AS(l)) calculated using only the relative score. Then we increase the weight of the absolute score until we have S(AS(l)) calculated using only the absolute score. The gap represents how much separate is the intrusion score region and the user score region. The chart on the right shows some stability when the absolute score weight is more than 70%. We conclude, among all the distinct combinations, that 70% -30% or even 80% -20% are the best configurations for w Ab -w Rl to get an higher gap and, at the same time, to consider the relative score in our evaluation. Fig. 5 shows a summary of many simulations, using 80%-20% for w Ab -w Rl , for many different parameters w(z) ∀z ∈ Z. From here we observe an important fact: dwells, flights and digraphs are the most efficient type of features to identify or to authenticate the user. On the other hand, in a real environment, when we try to isolate the most important type of feature (dwell) the FAR typically tends to increase because the validation mechanism tends to be more sensible. We conclude that (42% -24% -16% -10% -8%) is, heuristically speaking, the Fig. 4. Absolute and relative weights study for user samples with 750 keys. The gap between the typical intrusion score and the typical user score increases whenever we increase the importance (weight) of the absolute score. On the other hand, it is important to have more than one measure to evaluate identities, we should not ignore the relative score at all. Instead of ignoring it, we should decrease his importance.

best configuration for w(z) and with this configuration the results from the first phase (Fig. ( 4)) were exactly the same. Finally, the transient study was repeated but this time taking into account the previous best configurations (the best acceptance neighbourhood parameters and the best weights previously presented). Fig. 6 shows S(AS(l)) for different values of l. As we can see, the value stays stable during all the reduction process (starting with l = 750). After 20 reductions, the value shows no relevant fluctuations. This means a reduction of 80%, equivalent to a reduction of around 600 keys. At this point we are able to use attempt samples with 150 keys.

ROC curve

The Receiver Operating Characteristics (ROC) curve illustrates the performance as its discrimination threshold is varied. We present, in Fig. 7, a pseudo ROC curve using the best parameters configuration presented here and attempt samples with 250 keys (l = 250). At this point we are able to produce rates close to 2%. Next section we present a simple way to even more these rates.

Evaluations scheme

One of the main focus in any continuous detection system using keystroke dynamics is to reduce the size of the required sample to detect intrusions and, at the same time, not increase FRR and FAR. For a static biometric system it is important to know how often a wrong decision is made but the purpose of a performance evaluation for a continuous biometric authentication system is not to see if an impostor is detected, but how fast he is detected [START_REF] Boruc | Continuous keystroke dynamics: A different perspective towards biometric evaluation[END_REF].

An interesting way to detect intrusions fast is dividing the evaluation process in more than one part. Let us suppose that, after each l keys, we want intrusion detection probability p. So, p is what we want after l keys and the question is: What should we have in l/2 keys to achieve p in l keys?

To simplify our example, let us divide the process in only two parts and let us assume that l/2 ∈ N . If we define X = "number of authentications in 2 attempts" then X -Bi(2, m) with

P (X = k) = ( 2 k )m k (1 -m) 2-k , k = {0, 1, 2}
If we define Y = "detect intrusion" then we want to know m for P (Y ) ≈ p:

P (X ≥ 1) ≈ p ⇔ 1 -P (X = 0) ≈ p ⇔ 1 -(1 -m) 2 ≈ p ⇔ m ≈ 1 -(1 -p) 1/2 .
So, m < p for p = {0, 1} meaning that we do not need p probability after each l/2 keys but usually much less! As a consequence, we do not need to be so accurate with l/2 keys to have probability p in l keys and we have the opportunity to catch the intrusion in less than l keys(in our example, in l/2). Another direct consequence of not being so accurate is the fact that the FRR decreases. As a conclusion, if we divide the process in two parts then we just need to have intrusion probability m (less than p) and we automatically have a lower FRR. Also, during this process, the yellow (th y ) and orange (th o ) warnings are ignored and only red warnings are considered intrusion. At the end of the process (in this example after each 2 evaluations) some particular situations with yellow and orange warnings are considered intrusion. All these considerations on the yellow and orange warnings will help us on the FRR reduction.

We already have some good and stable results using this approach and considering evaluations after each 125 keys but it is still a work in progress. Fig. 8 shows DET curve for 125 keys and for 250 keys (process divided in two parts) from a real scenario of users (11 users) and considering the best configuration, presented here, for the parameters.

Conclusions

The purpose of this paper is to present improvements of some of the keystroke dynamics biometrics to identify/authenticate users and to detect intrusions, using data from a real environment to validate.

The main conclusions of this work are the huge importance of dwells (time difference between key up and key down for any key) to identify/authenticate Fig. 8. DET curve at the middle of the evaluation process and with 125 keys (left) and DET curve at the end of the process and with 250 keys (right). In this example the process was only divided in two parts.

users. Also, the importance of the right weights on all features to reduce the size of the attempt sample (sample used to verify user identity or to detect intrusion) and to reduce FAR and FRR at the same time. In our particular scenario, we were able to get an amazing reduction of the sample size from 750 keys to 150 keys with FRR and FAR close to 2%. Also, using an evaluation scheme we were actually able to get an impressive FRR and FAR lower than 1% with the strong possibility to detect the intrusion after only 125 keys.

It is important to refer that in [START_REF] Ferreira | Intrusion detection through keystroke dynamics[END_REF] all the presented simulations are with samples of 750 keys and what we present here is a huge reduction of the sample size which is crucial to have an earlier intrusion detection. Also, Kevin Killourhy and Roy Maxion [START_REF] Killourhy | Comparing Anomaly-Detection Algorithms for Keystroke Dynamics, Dependable Systems and Networks[END_REF] referred, in a recent study, that at present no anomaly detector has archived a false alarm rate specified in the european standards which makes our results even more interesting.

We believe that the strategy presented here to calculate the weights in order to improve the FAR, FRR and attempt sample reduction is something that can be implemented in any group of users. Also, the weights study can be done periodically, continuously calculating the best parameters for an specific group of users.

Fig. 1 .

 1 Fig. 1. Algorithm architecture.

Fig. 2 .

 2 Fig. 2. Summary of the acceptance neighbourhoods study. All FRR and FAR values, for each fixed configuration (A, B, C, D and E) and for each fixed threshold, were obtained from 11 users each with 15 samples of 750 keys.

Fig. 3 .

 3 Fig. 3. Transients study. The horizontal axis represents the number of reductions that were made on each sample. The vertical axis represents the scores defined in (1) for each sample in different reduction phases. The more reductions we do, the smaller is the sample. The initial sample size is 750 keys and this picture shows samples from 3 different users, the reduction process and the score in each reduction phase.

Fig. 5 .

 5 Fig. 5. Features weights study.

Fig. 6 .

 6 Fig. 6. Transients study with an improved configuration and considering only one user. The initial sample size is 750 keys.

Fig. 7 .

 7 Fig. 7. Pseudo ROC curve (left) with logarithmic scale and DET curve (right) for an improved configuration. The sample size is 250 keys and all simulations were done using a group of 11 real users.

Acknowledgements. This work has been supported by FCT -Fundaçaão para a Ciência e Tecnologia within the Project Scope: PEst-OE/EEI/UI0319/2014. We would like also to thank Watchful for supporting this work and the Software Development Team for helpful comments and data. The authors had financial support from Watchful Software.