Active authentication of users

1. A computer-implemented method for authenticating users of an electronic device, the method including

collecting data from a user of an electronic device including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the electronic device by an authentication engine, wherein the application context is determined by creating a user profile for an application hosted on the electronic device, based on power consumption of the application, the rate of power consumption of the application, and touch and gestures used in the application to provide usage analysis of the application by the user;

checking for a deviation of the collected data by the authentication engine from a behavior model of the user, wherein to generate the behavior model, data from a plurality of users is collected to create the behavior model corresponding to each of the plurality of users, each behavior model being indicative of data uncommon between the user corresponding to the behavior model and other users in the plurality of users to separate the user corresponding to the behavior model from other users in the plurality of users; and

enforcing at least one access control policy on the electronic device by an enforcement engine based on an input from the authentication engine, on the authentication engine detecting deviations equal to or greater than a pre-defined number of deviations within a pre-defined time window.

2. The computer-implemented method, as claimed in claim 1 , wherein the method further includes

collating data including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the electronic device by the authentication engine; and

building the behavior model of the user from the collated parameters by the authentication engine.

3. The computer-implemented method, as claimed in claim 1 , wherein the method of collecting data is performed at an application level.

4. The method, as claimed in claim 3 , wherein the method of collecting data at the application level includes:

receiving data from a gyroscope capture module by the authentication engine;

receiving data from a touch events capture module by the authentication engine;

receiving data from a power module by the authentication engine;

receiving data from an activity capturing module by the authentication engine;

receiving data from an input events driver by the authentication engine; and

collecting data from at least one filesystem by the authentication engine.

5. The computer-implemented method, as claimed in claim 1 , wherein the method of collecting data is performed at a kernel level.

6. The method, as claimed in claim 5 , wherein the method of collecting data at the kernel level further includes

receiving wakeup event statistics from a resource logger by the authentication engine;

performing event driven collection by the authentication engine; and

collecting data periodically by the authentication engine.

7. The computer-implemented method, as claimed in claim 1 , wherein the method further includes

computing deviation of a new data point by the authentication engine;

placing the new data point in a distribution of distance by the authentication engine, according to the computed distance of the data point; and

considering the new data point as a deviation by the authentication engine, if the place of the new data point is on the tail of the distribution.

8. The computer-implemented method, as claimed in claim 1 , wherein the method further includes

computing distance of a set of data points to a first part of a baseline time series by the authentication engine;

obtaining a new distance to a closest neighbor of the set of data points by the authentication engine;

transducing that distance into a strangeness distribution by the authentication engine; and

analyzing if that data point is a deviation using the transduced distance by the authentication engine.

9. The computer-implemented method, as claimed in claim 8 , wherein generating the strangeness distribution comprises:

dividing a power baseline data collected for a user into a first part and a second part by the authentication engine;

using a first part of the divided power baseline data to find one or more discords in one or more chunks of a second part of the divided power baseline data by advancing a window of size w over the second part by the authentication engine;

determining a distance to the closest neighbor for each data point in the second part by the authentication engine; and

generating the strangeness distribution by sorting the determined distances to in ascending order by the authentication engine.

10. A computer-implemented method of building a behavior model for authenticating a user of an electronic device, the method including:

collating information about the user by an authentication engine, the information including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the electronic device by an authentication engine, wherein the application context is determined by creating a user profile for an application hosted on the electronic device, based on power consumption of the application, the rate of power consumption of the application, and touch and gestures used in the application to provide usage analysis of the application by the user;

extracting features from the collated information by the authentication engine using a feature selection technique to reduce dimensionality of the collated information;

selecting a subset of features from the extracted features by dropping quartiles by the authentication engine;

assigning individual weights for the selected subset of features by the authentication engine;

standardizing the extracted features by the authentication engine;

generating a baseline by the authentication engine using the standardized features, the baseline at least indicative of usage of applications on the electronic device by the user, and wherein the baseline is based on data collected from a plurality of users to indicate data uncommon between the user corresponding to the behavior model and other users in the plurality of users to separate the user corresponding to the behavior model from other users in the plurality of users; and

configuring the electronic device to enforce an access control policy on the electronic device, the enforcement being based on detecting deviations equal to or greater than a pre-defined number of deviations from the baseline.

11. The computer-implemented method, as claimed in claim 10 , wherein standardizing the extracted features includes

computing mean and standard deviation for each extracted feature by the authentication engine;

subtracting the computed mean from each value by the authentication engine; and

dividing the subtracted value by the standard deviation by the authentication engine.

12. The computer-implemented method, as claimed in claim 10 , wherein the method further comprises porting the behavior model to at least one other device.

13. An apparatus operable to authenticate users of an electronic device, comprising:

a processor; and

a memory device, operatively connected to the processor, and having stored thereon instructions that, when executed by the processor, cause the processor to:

collect data from a user of the apparatus including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the apparatus, wherein the application context is determined by creating a user profile for an application hosted on the electronic device, based on power consumption of the application, the rate of power consumption of the application, and touch and gestures used in the application to provide usage analysis of the application by the user;

check for a deviation of the collected data from a behavior model of the user, wherein to generate the behavior model, data from a plurality of users is collected to create the behavior model corresponding to each of the plurality of users, each behavior model being indicative of data uncommon between the user corresponding to the behavior model and other users in the plurality of users to separate the user corresponding to the behavior model from other users in the plurality of users; and

enforce at least one access control policy on the electronic device based on an input, on detecting deviations equal to or greater than a pre-defined number of deviations within a pre-defined time window.

14. The apparatus, as claimed in claim 13 , wherein the processor is further operable to

collating data including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the apparatus; and

building the behavior model of the user from the collated parameters.

15. The apparatus, as claimed in claim 13 , wherein the processor is operable to collect data at an application level.

16. The apparatus, as claimed in claim 15 , wherein the processor is operable to collect data at the application level by

receiving data from a gyroscope capture module;

receiving data from a touch events capture module;

receiving data from a power module;

receiving data from an activity capturing module;

receiving data from an input events driver; and

collecting data from at least one filesystem.

17. The apparatus, as claimed in claim 13 , wherein the processor is operable to collect data at a kernel level.

18. The apparatus, as claimed in claim 17 , wherein the processor is operable to collect data at the kernel level by

receiving wakeup event statistics from a resource logger;

performing event driven collection; and

collecting data periodically.

19. The apparatus, as claimed in claim 13 , wherein the processor is further operable to

compute deviation of a new data point;

place the new data point in a distribution of distance, according to the computed distance of the data point; and

consider the new data point as a deviation, if the place of the new data point is on the tail of the distribution.

20. The apparatus, as claimed in claim 13 , wherein the processor is further operable to

compute distance of a set of data points to a first part of a baseline time series;

obtain a new distance to a closest neighbor of the set of data points;

transduce that distance into a strangeness distribution; and

analyzing if that data point is a deviation using the transduced distance.

21. The apparatus, as claimed in claim 20 , wherein the processor is further operable to generate the strangeness distribution by:

dividing a power baseline data collected for a user into a first part and a second part;

using a first part of the divided power baseline data to find one or more discords in one or more chunks of a second part of the divided power baseline data by advancing a window of size w over the second part;

determining a distance to the closest neighbor for each data point in the second part; and

generating the strangeness distribution by sorting the determined distances to in ascending order.

22. An apparatus operable to build a behavior model for authenticating a user of an electronic device, the apparatus comprising:

a processor; and a memory device, operatively connected to the processor, and having stored thereon instructions that, when executed by the processor, cause the processor to:

collate information about the user, the information including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the electronic device, wherein the application context is determined by creating a user profile for an application hosted on the electronic device, based on power consumption of the application, the rate of power consumption of the application, and touch and gestures used in the application to provide usage analysis of the application by the user;

extract features from the collated information using a feature selection technique to reduce dimensionality of the collated information;

select a subset of features from the extracted features by dropping quartiles;

assign individual weights for the selected subset of features;

standardize the extracted features;

generate a baseline using the standardized features, the baseline at least indicative of usage of applications on the electronic device by the user, and wherein the baseline is based on data collected from a plurality of users to indicate data uncommon between the user corresponding to the behavior model and other users in the plurality of users to separate the user corresponding to the behavior model from other users in the plurality of users; and

configure the electronic device to enforce an access control policy on the electronic device, the enforcement being based on detecting deviations equal to or greater than a pre-defined number of deviations from the baseline.

23. The apparatus, as claimed in claim 22 , wherein the processor is further operable to standardize the extracted features by:

computing mean and standard deviation for each extracted feature;

subtracting the computed mean from each value; and

dividing the subtracted value by the standard deviation.

24. The apparatus, as claimed in claim 22 , wherein the processor is further operable to port the behavior model to at least one other apparatus.

25. A system for authenticating users of an electronic device including:

a sensor manager including circuitry configured to receive data from at least one of a gyroscope capture module, a power monitoring module, and a touch events capture module;

an authentication engine including circuitry configured to:

collect data from an actual user of the apparatus including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the apparatus, wherein the application context is determined by creating a user profile for an application hosted on the electronic device, based on power consumption of the application, the rate of power consumption of the application, and touch and gestures used in the application to provide usage analysis of the application by the user; and

check for a deviation of the collected data from a behavior model of the user, wherein to generate the behavior model, data from a plurality of users is collected to create the behavior model corresponding to each of the plurality of users, each behavior model being indicative of data uncommon between the user corresponding to the behavior model and other users in the plurality of users to separate the user corresponding to the behavior model from other users in the plurality of users; and

an enforcement module including circuitry configured to enforce at least one access control policy on the electronic device based on an input from the authentication engine, on detecting deviations equal to or greater than a pre-defined number of deviations within a pre-defined time window.

26. The system, as claimed in claim 25 , wherein the authentication engine is further configured to

collate data including touch measurements, measurements from an accelerometer, measurements from a gyroscope, application context, and power measurements of the apparatus; and

build the behavior model of the user from the collated parameters.

27. The system, as claimed in claim 25 , wherein the authentication engine is configured to collect data at an application level.

28. The system, as claimed in claim 27 , wherein the authentication engine is configured to collect data at an application level by:

receiving data from the gyroscope capture module;

receiving data from the touch events capture module;

receiving data from the power module;

receiving data from an activity capturing module;

receiving data from an input events driver; and

collecting data from at least one filesystem.

29. The system, as claimed in claim 25 , wherein the authentication engine is configured to collect data at a kernel level.

30. The system, as claimed in claim 29 , wherein the authentication engine is configured to collect data at a kernel level by

receiving wakeup event statistics from a resource logger;

performing event driven collection; and

collecting data periodically.

31. The system, as claimed in claim 25 , wherein the authentication engine is further configured to

compute deviation of a new data point;

place the new data point in a distribution of distance, according to the computed distance of the data point; and

consider the new data point as a deviation, if the place of the new data point is on the tail of the distribution.

32. The system, as claimed in claim 25 , wherein the authentication engine is configured to:

compute distance of a set of data points to a first part of a baseline time series;

obtain a new distance to a closest neighbor of the set of data points;

transduce the new distance into a strangeness distribution; and

analyze if that data point is a deviation using the transduced distance.

33. The system, as claimed in claim 32 , wherein the authentication engine is configured to generate the strangeness distribution by:

dividing a power baseline data collected for a user into a first part and a second part;

using a first part of the divided power baseline data to find one or more discords in one or more chunks of a second part of the divided power baseline data by advancing a window of size w over the second part;

determining a distance to the closest neighbor for each data point in the second part; and

generating the strangeness distribution by sorting the determined distances in ascending order.

34. The system, as claimed in claim 32 , wherein the processor is further operable to port the behavior model to at least one other apparatus.