Improving the Security of the Android Pattern Lock using Biometrics and Machine Learning

Abstract: With the increased use of Android smartphones, the Android Pattern Lock graphical password has become commonplace. The Android Pattern Lock is advantageous in that it is easier to remember and is more complex than a five digit numeric code. However, it is susceptible to a number of attacks, both direct and indirect. This fact shows that the Android Pattern Lock by itself is not enough to protect personal devices. Other means of protection are needed as well. In this thesis I have investigated five methods for the analysis of biometric data as an unnoticable second verification step of the Android Pattern Lock. The methods investigated are the euclidean barycentric anomaly detector, the dynamic time warping barycentric anomaly detector, a one-class support vector machine, the local outlier factor anomaly detector and a normal distribution based anomaly detector. The models were trained using an online training strategy to enable adaptation to changes in the user input behaviour. The model hyperparameters were fitted using a data set with 85 users. The models are then tested with other data sets to illustrate how different phone models and patterns affect the results.        The euclidean barycentric anomaly detector and dynamic time warping (DTW) barycentric anomaly detector have a sub 10 \% equal error rate in both mean and median, while the other three methods have an equal error rate between 15 \% and 20 \% in mean and median. The higher performance of the euclidean and DTW barycentric anomaly detector is likely because they account for the time series nature of the data, while the other methods do not. Each user in the data set have provided each pattern at most 50 times, meaning that the long-term effects of user adaptation could not be studied.