Cognitive Biometrics: Features, Applications, Advantages And Disadvantages
Cognitive Biometrics is a method of user authentication that uses the cognitive, conative and emotional state of a user through biosignals. This paper gives a concise overview of the field of cognitive biometrics highlighting some of its’s key features, applications, advantages and constraints.
Introduction
Cognitive Biometrics is a novelistic approach for identifying user or there validation that uses the state of mind and its derivatives, which is taken out by recording responses of the nervous tissue. The design of the stimulus is such that they pull out characteristic changes within the selected biosignal and they present distinct responses of an individual. Further these changes are then processed by machine learning algorithms, which then results in a signature which distinctly identifies an individual. If provided with the proper stimuli, the stimuli-response example is a substantial procedure for computing the authenticity of the subject requested. The stimulus can be presented in several ways like a film, a family photograph, or a puzzle. This can be prove to be handful for the most demanding security systems, using these techniques in stationary or a mode that is continuous, whether uni-modal, or in a multiple modal approach, as a result of which the recognition process is more effective and efficient. Cognitive biometrics inculcates cognition, mind state of the users and there responsers to variety of stimuli with the already existing ones, in-use, methods of behavioural biometrics such as different keystrokes, mouse movements, hand gestures, voice etc, in order to attain a higher degree of accuracy in determining the uniqueness of any particular individual. The dataset suggests that identification accuracy can also reach out to 100% in many cases, which bolster the use of this novel approach. The challenges in future in relate to cognitive biometrics based on biosignals are to improve information content of the data that is being acquired, calculate the level of uniqueness and permanence of brain responses, design of elicitation protocols, and the invasiveness of the acquisition process.
Features
Behavioural biometrics is more about the action of the user rather than the knowledge of the user. These capabilities enables cognitive machine learning algorithms to study how a user interacts with the designed environment. It also possess some measures of the emotional and cognitive state of the user. Since cognitive biometrics uses a wide range of inputs for identification and verification (visual, auditory, olfactory, or any combination), several varities of authentication approaches can be implemented. For example, validation of user can also take place while playing a game for a minuscule interval as opposed to entering their user ID and password. Having cognitive behavioural biometrics is an add-on to the layer of security, and it avoids continuously evolving threats which form with the use of a password validation system or even with traditional form of biometrics. It relies on attaining of the unique behavioural characteristics that you cannot forget or copy as you might a password. This method can be completely out of the user’s eyesight and still perform continuous verification.
Cognitive behavioural biometrics provides a more insights, robust, user-friendly authentication protocol that is fit for both static and continuous authentication requirements, as it can extend the level of security to any virtually designed level. It is the role of machine learning to understand the usual and the unusual patterns, and uses algorithms which can identify and create user models side by side. The system learns the user’s normal behaviour pattern, resulting in an understanding of current user activity patterns to help better distinguish a fraud individual from a trusted user in real time.
Cognitive biometrics is built on self-learning technology but uses pattern recognition technique in a way to copy the way the human brain works. It is also the part of artificial intelligence applications, so therefore, we say that cognitive leads to artificial intelligence. It can join human perception to several different computer databases in a brain-machine interface. Thus, the precision of human perception provides the data to match that stored in the computer with improved sensitivity of the system.
Examples
Cognitive identification is a solution to the weak passwords entered by the humans, biometrics and two factor models. A simple example of cognitive validation or say authentication is, a user can give a memorable event in their lives as an input, in the system and the authentication phase would ask the user a particular questions about the identified event. Cognitive biometrics are said to be very effectual and hard to elicit due to the distinctiveness of each user’s experiences. The conventional approach is to extract some form of a biological signal from an individual while performing a given task, such as typing something for an element within a picture, or watching a short video clip. Typical signals utilised include the electroencephalogram (EEG), electrocardiogram (ECG), pupillometry, and heartrate. These signals reflect the physiological state of the individual. The genetical basis for the distinctiveness can be exploited if the proper stimulus is delievered. A proper stimulus can find cognitive states induce a fairly reproducible manner, increasing the attractiveness of this technique. Thus, this particular field has been gaining momentum over the past decade and is being implemented in several different ways. Some of them are highlighted below.
A. Electrocardiogram Identification Method
The electrocardiogram (ECG) signal are used for carrying out the diagnosis and monitoring the several patients, has recently emerged as a biometric recognition tool. Indeed, these signal may vary from one individual to another according to health status, heart geometry and anatomy among other factors. They are confidential for each individual and even detect the aliveness of the individual while verifying. The methodology is composed of three parts: pre-processing, feature extraction and selection, and classification. The applied database corresponds to acquired ECG signals during 10 seconds. The ten seconds ECG recordings are filtered before any further processing, in order to remove undesired components of power line interference, muscle noise and baseline wander. The feature set is obtained by calculating 13 different features from 5 different heart beats. The selected beats should not be the first or the last beats in the recording to ensure that all selected beats are complete beats. the extracted features are fed into a classifier assigned labels according to some distance metric from samples stored in the enrolment database. Neural network classifiers are used for their extensive ability to learn complex relationships between feature vectors. Each artificial neuron is itself a classifier. This method can be easily implemented using machine learning algorithms. All the presented methodologies obtain high identification performance with highest rate of 98. 6%, and further confirm the possibility of applying ECG for individual verification and identification.
Authentication circumstances can be categorized in two situations; one is an identification, which uses N templates to figure out the user’s identity, and the other is a verification, which uses a specific threshold to verify the ECG signal is from whether a genuine user or an imposter user. Thus, studies show that even in the circumstances that the heart rate modified and ECG wavelet is deteriorated seriously, it is able to get plausible identification performance by using proper feature selection and classification. Among other biomedical signals, ECG has been the most robust modality for biometric authentication, because it is recorded in non-invasive, simple, effective and low-cost procedure. It is also shown that ECG biometric system shows better identification and verification performance even after the harsh exercise. However, there are several factors affecting the ECG signals. First, the ECG signals alter over time. In the case that the ECG signal is recorded using limb, palm or finger leads, body posture is another factor that can deteriorate the authentication performance, because the electrical heart vector changes in regarding to body position.
B. Language as a cognitive biometric trait
The idea of utilising language written by an author, as his/her cognitive fingerprint is studied and understood in this method. Studies by various psycholinguists suggests, people often generate a jargon that makes more sense to other people in similar age groups, social backgrounds, academic settings, etc. Thus, language becomes a badge of sorts, identification of information about an individual. Given the psychology-based evidence, language of a user does provide unique characteristics that can be used as a cognitive biometric trait for validation. Here, only written text is used as a language has different connotations joined with it.
The dataset consisted of millions of blogs written by thousands of different authors on the Internet. The suggested method learns a classifier that can differentiate between genuine and impostor authors. Two sets of features are taken out from the dataset: Stylistic features, which characterize the text and capture the writing skills of the authors. They come under, numerous categories including lexical -like word count; syntactic - like the frequency of stop words; structural - the paragraph length; and also personal. Some features like the number of distinct words, the digit count, letters, punctuation used are calculated by writing regular expressions to search and count the number of their appearances in the texts. Semantic features, capture the themes running through the blogs. It takes as input a collection of texts i. e the blogs written by the authors, and outputs the important topics, or themes that exist in the collection. The topics are thus a distribution over the words that already exist in the collection. The evaluation is done on the basis of the count of number of blogs written by the author, generalizing data for users not in training set, blog size and frequency of some function words. It can be summed up by, a cognitive fingerprint can be learned successfully using stylistic (writing style), semantic (themes), and syntactic (grammatical) features extracted from blogs.
Performance of (72% Area Under ROC Curve (AUC)) is reported in case of validation, even when the data consisted of blogs which were unstructured collected from across the internet. The study indicates that blogs provide a more diverse and simplistic way to study about authorship on the internet. More improved results are generated with cleaner, high quality texts. If the author count is known, then even few texts per author would be enough to generate a good classifier. However, the accuracy of the classifier is not dependent of the author count of the study. Regarding the issue of permanence, as long as the author maintains a disticnt writing style, this methodology will have to work.
For a user who is unseen, accuracies of 72% (genuine) and 71% (impostor) were also reported. Such a study lay down the groundwork for building alternative cognitive systems. The modality, presented here, is easily obtained, unobtrusive and needs no additional hardware.
C. Using Mouse Perturbation
Richness of biometric signatures can be extracted from mouse dynamics by introducing perturbations in the response of the computer mouse and measuring the motor responses of the individual user. User responses to unexpected and subtle perturbations (e. g. , small changes in mouse velocity, position and/or acceleration) reveal new unique sources of information in the mouse movement signal that reflect the user's cognitive strategies and are inaccessible via existing mouse biometric technologies. A user's response to these perturbations contains information about intrinsic cognitive qualities that can be used as a robust biometric for personal authentication and to support profiling of the individual (e. g. , gender, cultural background, cognitive or emotional state, cognitive quality etc. ).
The system extracts physiological and motor-behavioural parameters from mouse actions and hand characteristics, and the user fills in the psychological (e-self-reports) data, which can be used to analyse correlations with user's emotional state and labour productivity. The mouse perturbation engine communicates the desired perturbation to a mouse movement detection API, which then injects the perturbation into the mouse event. The user's response to the unexpected perturbation of mouse control is then measured and catalogued (paired) with the associated perturbation. These pairs may be logged in a mouse database to build biometric signatures for individual users, for classes of users by gender, ethnicity, race, age etc. for known cognitive states (e. g. stress, situational anxiety, deception etc. ) or for known cognitive qualities (e. g. trait anxiety, reaction time, etc. ) based on the common trait. These pairs may also be provided to an authentication and profiling task module that compares the data to the biometric signatures in the database to authenticate or profile the user. These pairs may be subjected to pre-processing and/or feature extraction before they are logged into the database or forwarded to the task module. The biometric signatures for known users are recorded and stored in the database. During a user session on the computer, user mouse events responsive to perturbations are observed and compared to the pre-stored biometric signatures to authenticate the user or to flag an unknown user.
D. EEG Biometrics for User Recognition
Electroencephalography (EEG) is the recording of electrical activity occurring in the brain, which is recorded from the scalp through placement of voltage sensitive electrodes. These signals collected during a perception or mental task can be used for reliable person recognition. As human brain activities, represented by EEG brainwave signals, are more confidential, sensitive, and hard to steal and replicate, they hold great promise to provide a far more secure biometric approach for user identification and authentication. Generally, EEG-based authentication studies include several common steps, such as data capture, pre-processing, feature extraction, and classification or pattern recognition. Also, accuracy of any system depends on several parameters, such as complexity of task, number of electrodes, electrode type, features, and classification algorithms. The EEG signals were recorded from subjects while being exposed to a stimulus, which consist of drawings of objects of a picture set. These pictures represented common black and white objects, such as, for instance, airplane, banana, and ball. These were chosen according to a set of rules that provides consistency of pictorial contents. They have been standardised based on the variables of central relevance to memory and cognitive processing. The subjects were asked to remember or recognise the stimulus. Stimulus duration of every picture was sufficiently long to record a response. The processing of EEG recordings coming from multiple electrodes may be considered as a multichannel signal processing problem. The electrodes on the scalp of a subject are located so as to record the electrical activity of different brain areas. These areas in the cortex are responsible for a variety of cognitive and motor tasks, and the brain electrical activity recorded from these spatially distributed electrodes reflects the nature of the task being processed. Brain waves are therefore, one of the most emerging cognitive modalities to be used for people recognition.
E. Cognitive Fingerprints from Keystroke Dynamics
Keystroke dynamics can continuously authenticate users by their typing rhythms without extra devices. A new feature called cognitive typing rhythm (CTR) to continuously verify the identities of computer users. The typical keystroke interval time is expressed as the time between typing two characters, and this feature is called the digraphs. The keystroke rhythms of a user are distinct enough from person to person such that they can be used as biometrics to identify people. However, it has been generally considered much less reliable than physical biometrics such as fingerprints. The main challenge is the presence of within-user variability. A biometric-based active authentication system continuously monitors and analyses various keyboard behaviour performed by the user. Features are extracted from keystroke dynamics that contain cognitive factors, resulting in cognitive fingerprints. Each feature is a sequence of digraphs from a specific word. This method is driven by the hypothesis that a cognitive factor can affect the typing rhythm of a specific word. Conventional keystroke dynamics does not distinguish timing information between different words and only considers a collection of digraphs. For each legitimate user, we collect samples of each feature and, then, build a classifier for that feature during the training phase of machine learning. There is a two-class (legitimate user vs. imposters) classification approach in machine learning. A trained profile with multiple classifiers for each legitimate user is built. During the testing phase (i. e. , authentication), a set of testing data is given to the trained profile for verification. Each classifier under testing yields a matching score between the testing dataset and trained file. The final decision (accept or reject) is based on a sum of scores fusion method. The best results from experiments conducted with 1, 977 users show a false-rejection rate of 0. 7 percent and a false-acceptance rate of 5. 5 percent. CTR therefore constitutes a cognitive fingerprint for continuous authentication.
Applications
Cognitive biometric technologies have been in demand over the past decade and is growing at a fast rate with the advent of machine learning and artificial intelligence algorithms. Some of the applications are listed below which are in use.
A. Cognitive based logon process for computing device
A method of user logon to a computing device or computer system that, distinct from requiring entry of a set of known logon credentials such as a username and password, introduces an additional thought-directed user interface whereby the user must respond to one or more prompts that measure the user's cognitive function at the time of logon or during an active logon session. The user's responses to these prompts are evaluated for several purposes, including determining whether the user demonstrates the required level of cognitive function to gain access to the computer system or continue an active logon session. The user's responses and associated data may also be stored and retrieved at a later time for various purposes, including determining whether and to what extent the user's level of cognitive function is improving, diminishing, or remaining static over time.
B. BioCatch’s Technology
BioCatch is a cybersecurity company that delivers behavioural biometrics, analysing human-device interactions to protect users and data. It has three main capabilities: identity proofing, continuous authentication, fraud prevention. BioCatch compares the user behaviour in real-time against the profile to return an actionable risk score. An add-on module gives fraud teams with visualization of behavioural data and advanced analytics, enabling rule setting, and reliable fraud reporting in real time.
C. IBM’S Trusteer
Pinpoint Detect incorporates behavioural biometrics, patented analytics and machine learning for real time cognitive fraud detection. This capability leverages machine learning to study how users interact with stimuli. It can understand subtle mouse movements and clicks in context and meaning, while creating models with each interaction so it gets smarter and more accurate with time. It uses cognitive detection capabilities with an automated malicious pattern recognition tool to help institutions identify anomalies and prioritize evolving threats.
Comparative analysis
Cognitive methods have lot of advantages with respect to traditional forms of biometrics.
Objectivity: By means of objectivity it’s possible to make assessments that do not depend on the user’s perception. Objectivity is an important property that increases the reliability of a measurement technique.
Multidimensionality: Multidimensional measures are able to provide different faces of user state.
Unobtrusiveness: Although cognitive measures require the placement of electrodes on the body, they don’t directly interfere with user tasks like “secondary task measures”. Therefore, they are considered as unobtrusive measures.
Implicitness: By comparing the “primary task measures”, these methods do not require the measurement of overt performance. They provide the necessary information implicitly (covertly).
Continuity and Responsiveness: Psychophysiological measures are continuous signals and therefore they can be used in real-time. They allow researchers to examine both short-term and long-term bodily reactions. Thus, observing changes when they occur in response to manipulations of user stimuli is possible.
These also include privacy compliance, robustness against spoofing attacks, intrinsic liveness detection, and universality. On the other hand, this novel method also poses some challenges which need to be properly addressed. The understanding of the level of uniqueness and permanence of brain responses, the design of elicitation protocols, and the invasiveness of the acquisition process are some of them.
Special Equipment: Cognitive signals are measured by using special equipment and it may be costly according to capabilities of the purchased system. Besides, different electrodes attached to body are used in these measurements. The selection and correct placement of them are crucial to acquire noise free data. Therefore, sufficient attention and time should be given to personnel training and device maintenance.
Data Acquisition and Interpretation: Psychophysiological measures are mostly weak electrical signals and may be highly susceptible to noise. Therefore, suitable filtering techniques should be selected and applied to data. Besides a number of them are very vulnerable to confounding factors like ambient lightning (pupil dilation), power grid (ERP), and body movement (ECG). These factors should not be omitted; otherwise misleading results will be inevitable. Data interpretation is another problem for researcher and engineers. It’s because of that these measures produce large amount of hard-to-analyse data.
Unnaturalness: Especially in laboratories, the environment is artificial and unnatural more sufficiently. With advances of recent technologies portable and wireless solutions are possible for some measures like EEG, GRS and HR. if not; electrodes are joined to user by cables and this restrains the movement of an individual and break the naturalness of the interaction between the user and the system.
Conclusion
Cognitive biometrics is a novel approach to user validation and/or identification that depends on the cognitive and affective responses of users, which are received via biosignal collection and psychological testing paradigms. Given the proper stimuli are presented, the stimulus-response paradigm provides a powerful methodology for evaluating the authenticity of the subject requesting authentication. The concept of the endophenotype is the core in this approach – as it provides a scientific basis for selection of the stimulus, designed to generate responses that have high heritability. Modern HCI (Human Computer Interaction) applications like user experience evaluation and adaptive user interfaces requires unobtrusive, implicit and real-time methods that provide multidimensional information about user affective or cognitive state. As per presented by a great deal of study, psychophysiological measures have the potential to meet these requirements. They are able to present different dimensions of human psychological processes with changing levels. However, these measures are needed to be carefully implemented. Especially, data gathering and interpretation disadvantages prevent them to be implemented in real environments. Although they do not completely vanish off, these problems will be palliated in time and psychophysiological measures will be much more easy for research and will also be implemented more easily.
