When the packet rate of flows in a mixnet depends on the amount of transferred data, it is possible to identify which flow entering is which flow exiting the mixnet based on their shapes. We present a passive shape-based flow correlation attack against state-of-the-art mixnet Nym and a systematic evaluation of countermeasures. Assuming an adversary controlling both the entry and exit gateway-requesters selected by users to access the public Internet through Nym, our attack's artificial neural network assigns correlation scores to flow pairs based on traffic distribution similarities to accurately distinguish paired from unpaired flow tuples. From data we collected on the live Nym mixnet, we generate$ \mathbf {45}$datasets and$ \mathbf {119}$testing scenarios for different defense configurations. After one minute of attacking flow pairs on default Nym, we achieve a PR-AUC of$ \mathbf {0.9998}$at a base rate of$ \mathbf {1.9 \times 10^{-4}}$paired flow tuples. However, (combinations of) the five evaluated defense strategies indicate that the right choice and scale of countermeasure(s) can offer meaningful protection. Our evaluation also informs on the resources overhead spent on defenses. We discuss steps a mixnet such as Nym can take to make our attack both less likely and less accurate.

Geofencing, the virtual demarcation of physical spaces, is widely used for managing the localisation of Internet of Things (IoT) devices. However, traditional localisation techniques face security challenges indoors due to signal interference and susceptibility to spoofing, often requiring extensive calibration or extra hardware, limiting scalability. In this work, we propose ZeroTouch, a machine learning-based system that leverages Received Signal Strength (RSS) measurements from multiple receivers to improve the security of geofencing without introducing additional deployment overhead. While RSS-based localisation is known to have inherent security limitations, we show that by aggregating RSS readings from multiple anchor points and detecting anomalies using an autoencoder model, ZeroTouch provides a practical and automated mechanism for verifying whether a device is inside or outside a defined boundary. Rather than serving as a standalone security mechanism, ZeroTouch enhances existing authentication frameworks by adding an additional zero-touch security layer that operates passively in the background. ZeroTouch eliminates manual calibration, removes the human-in-the-loop element, and simplifies deployment. We evaluate our solution in a realistic simulated environment and demonstrate that it achieves high accuracy in distinguishing between in-room and out-of-room devices, even in strong adversarial settings.

Mixnets provide communication anonymity against network adversaries by routing packets independently via multiple hops, delaying them artificially at each hop, and introducing cover traffic. We show that these features (particularly the use of cover traffic) significantly diminish the effectiveness of state-of-the-art flow correlation techniques developed to link the two ends of a Tor connection. In this work, we propose novel methods to determine whether a set of endpoints exchanges packets via a mixnet and demonstrate their effectiveness by applying them to the Nym mixnet. We consider Nym in both an idealized lab setup and the official live network, and propose and compare three classifiers to conduct flow matching on it. Our statistical classifier tests whether egress packet timestamps are consistent with ingress timestamps and the (known) routing delay characteristic of the mixnet. In contrast, our two deep learning (DL) classifiers learn to distinguish matched from unmatched flow pairs from collected datasets directly, rather than relying on priors that describe the delay distribution. All three classifiers use our flow merging technique, which enables testing a match for sets of communicating endpoints of any cardinality. Considering a use case where two observed endpoints communicate exclusively to exchange a file through Nym, we find that flow matching is fast and accurate in the idealized lab setup. If flow pairs are aligned using all network observations in a download, we achieve a TPR of circa 0.6 (DL) and 0.47 (statistical) at an FPR of 10^-2 after only processing 100 observations. We evaluate classifier performance under key variations of this setup: the absence of loop cover traffic, an increased or decreased average per-mix delay, larger communicating sets (three endpoints) with faster responders, and the presence of realistic network effects (live network). The classifiers' matching performance diminishes on the live network where packet losses and variable propagation delays exist, reducing DL TPR to circa 0.26 and statistical TPR to circa 0.28 at an FPR of 10^-2. Informed by the insights of our analyses, we outline countermeasures that can be deployed in mixnets such as Nym to mitigate flow matching threats.

Biometric authentication systems have traditionally relied on the False Match Rate (FMR) to evaluate security against impersonation threats. However, this metric alone is insufficient for assessing vulnerabilities to statistical attacks because it cannot account for the non-uniformity of mismatches and atypical inputs that adversaries may manipulate. To address this issue, we propose a new evaluation framework that overcomes these limitations. The framework includes an estimate of the effective key space of biometrics and metrics that consider non-uniformity in the biometric embedding space. Our findings demonstrate that our framework provides a nuanced understanding of biometric security. Moreover, optimizing for the proposed metric leads to better security against statistical attacks than optimizing the FMR. Furthermore, the framework provides a comparative security analysis with traditional methods like passwords and PIN codes. It also quantifies the impact on security when adversaries partially know their victims, e.g., demographics.

As biometric templates consist of highly correlated features, the real security level offered by biometric authentication systems remains an open research question. In this work we provide new approximations and a lower bound of the security offered by fuzzy commitment schemes. Fuzzy commitment cryptosystems and in general biometric template protection schemes play an important role in allowing for remote storage and processing of biometric data, as they mitigate the threat of biometric template leakage. The use of such schemes would alleviate some of the usability constraints imposed by the state-of-practice local use of biometrics. As such we conduct an in-depth security analysis for IMU based gait authentication systems, where we evaluate the effectiveness of attacks within the scope of two well-defined threat models that target both unprotected and protected systems. A pivotal enabler of our analysis is the development of nine different approaches to gait authentication, which allows us to perform intramodal fusion on these distinct, yet highly correlated biometric templates, and to protect them with a strengthened fuzzy commitment scheme. Our analysis clearly demonstrates the high correlation between the different biometric templates, which, among others, further showcases the threat of biometric template leakage. Furthermore, as our analysis incorporates a threat model that assumes biometric template leakage, it provides metrics for the security provided by the biometric modality itself.

With the increasing capabilities of wearable sensors and implantable medical devices, new opportunities arise to diagnose, control and treat several chronic conditions. Unfortunately, these advancements also open new attack vectors, making security an essential requirement for the further adoption of these devices. Researchers have already developed security solutions tailored to their unique requirements and constraints. However, a fundamental yet unsolved problem is how to securely and efficiently establish and manage cryptographic keys. One of the most promising approaches is the use of patient's physiological signals for key establishment.

The procedure for extracting a cryptographic key from noisy sources, such as biometrics and physically uncloneable functions (PUFs), is known as fuzzy extractor (FE). Although FE constructions deal with discrete sources, most noisy sources are continuous. In the continuous case, it is required to transform the source to a discrete one. We introduce a 1) model-based uncoupling construction that directly deals with the continuous noisy source and produces helper data uncoupling the discrete representation from the noisy source, guaranteeing the diversity of the discrete representation, and making it more robust and a 2) strengthened uncoupled fuzzy extractor, suitable for privacy-preserving applications, which integrates an additional fixed authentication factor and obtains a key uncoupled to the noisy sources and unlinkable helper data. We present optimal model-based uncoupling constructions for Gaussian sources. Specifically, we show how to: 1) extract one or multiple bits from a single Gaussian source; 2) extract one bit from several unreliable Gaussian sources; and 3) provide a general procedure to obtain an optimal uncoupled FE from Gaussian source(s). Our experiments show that the proposed constructions achieve much higher security levels for wide operational scenarios, approximately doubling the obtained effective key length without affecting false rejection rates.

Biometrics are widely used for authentication in several domains, services and applications. However, only very few systems succeed in effectively combining highly secure user authentication with an adequate privacy protection of the biometric templates, due to the difficulty associated with jointly providing good authentication performance, unlinkability and irreversibility to biometric templates. This thwarts the use of biometrics in remote authentication scenarios, despite the advantages that this kind of architectures provides. We propose a user-specific approach for decoupling the biometrics from their binary representation before using biometric protection schemes based on fuzzy extractors. This allows for more reliable, flexible, irreversible and unlinkable protected biometric templates. With the proposed biometrics decoupling procedures, biometric metadata, that does not allow to recover the original biometric template, is generated. However, different biometric metadata that are generated starting from the same biometric template remain statistically linkable, therefore we propose to additionally protect these using a second authentication factor (e.g., knowledge or possession based). We demonstrate the potential of this approach within a two-factor authentication protocol for remote biometric authentication in mobile scenarios.

Parameterized Appearance Models, such as Active Appearance Models (AAM), Morphable Models, or Boosted Appearance Models, have been extensively used for face alignment. Discriminative methods learn a mapping function between appearance features and shape parameters. Different mapping functions have been studied in the literature, including linear regression, which has proved to perform well when close to the true solution. Despite its easiness, it still suffers from two major drawbacks: 1) It takes the whole data without highlighting relations among different regions of the face, and 2) it is computationally expensive both in time and memory. In this paper, we analyze the covariance of the training data, and propose a way to find related information. By clustering those patches that are related, we reach a noise-reduced regression matrix. Then, we construct a clean mapping matrix, with reduced dimensionality, taking only the relevant training information. Experiments show that this method outperforms linear regression for face alignment.

A successful deployment of biometric-based recognition systems in real-life applications depends on crucial issues such as data security and privacy, which have to be specifically addressed. Besides, cryptographic key protection can represent the main weakness of a secured transmission. In this demonstration a system for encryption and digital signature of generic digital documents (SAES, standing for Signature-based Assymetric Encryption System) is presented, where cryptographic keys are protected by the hand-written signature of the user. Furthermore, a demonstration of a the handwritten online signature verification system (SVS) based on non-protected templates will also be performed.

A new probabilistic framework for beat tracking of musical audio is presented. The method estimates the time between consecutive beat events and exploits both beat and non-beat information by explicitly modeling non-beat states. In addition to the beat times, a measure of the expected accuracy of the estimated beats is provided. The quality of the observations used for beat tracking is measured and the reliability of the beats is automatically calculated. Ak-nearest neighbor regression algorithm is proposed to predict the accuracy of the beat estimates. The performance of the beat tracking system is statistically evaluated using a database of 222 musical signals of various genres. We show that modeling non-beat states leads to a significant increase in performance. In addition, a large experiment where the parameters of the model are automatically learned has been completed. Results show that simple approximations for the parameters of the model can be used. Furthermore, the performance of the system is compared with existing algorithms. Finally, a new perspective for beat tracking evaluation is presented. We show how reliability information can be successfully used to increase the mean performance of the proposed algorithm and discuss how far automatic beat tracking is from human tapping.

Data security and privacy are crucial issues to be addressed for assuring a successful deployment of biometrics-based recognition systems in real life applications. In this paper, a template protection scheme exploiting the properties of universal background models, eigen-user spaces, and the fuzzy commitment cryptographic protocol is presented. A detailed discussion on the security and information leakage of the proposed template protection system is given. The effectiveness of the proposed approach is investigated with application to online signature recognition. The given experimental results, evaluated on the public MCYT signature database, show that the proposed system can guarantee competitive recognition accuracy while providing protection to the employed biometric data.

The success of generative models for online signature verification has motivated many research works on this topic. These systems may use hidden Markov models (HMMs) in two different modes: user-specific HMM (US-HMM) and user-adapted universal background models (UBMs) (UA-UBMs). Verification scores can be obtained from likelihood ratios and a distance measure on the Viterbi decoded state sequences. This paper analyzes several factors that can modify the behavior of these systems and which have not been deeply studied yet. First, we study the influence of the feature set choice, paying special attention to the role of dynamic information order, suitability of feature sets on each kind of generative model-based system, and the importance of inclination angles and pressure. Moreover, this analysis is also extended to the influence of the HMM complexity in the performance of the different approaches. For this study, a set of experiments is performed on the publicly available MCYT-100 database using only skilled forgeries. These experiments provide interesting outcomes. First, the Viterbi path evidences a notable stability for most of the feature sets and systems. Second, in the case of US-HMM systems, likelihood evidence obtains better results when lowest order dynamics are included in the feature set, while likelihood ratio obtains better results in UA-UBM systems when lowest dynamics are not included in the feature set. Finally, US-HMM and UA-UBM systems can be used together for improved verification performance by fusing at the score level the Viterbi path information from the US-HMM system and the likelihood ratio evidence from the UA-UBM system. Additional comparisons to other state-of-the-art systems, from the ESRA 2011 signature evaluation contest, are also reported, reinforcing the high performance of the systems and the generality of the experimental results described in this paper.

In this paper, we present the main results of the BioSecure Signature Evaluation Campaign (ESRA'2011). The objective of ESRA'2011 is to evaluate through two different tasks the resistance of different online signature systems to skilled forgeries categorized automatically according to their quality. Task 1 aims at studying with only coordinate time functions the influence of acquisition conditions (digitizing tablet vs. PDA) on systems' performance. The two BioSecure Data Sets DS2 and DS3 make this possible, since they contain data from the same 382 people, acquired respectively on a digitizer and on a PDA. Task 2 then aims at assessing the contribution of the five time functions available on a digitizer (coordinates, pressure, pen inclination) on systems' resistance to different qualities of skilled forgeries. Results of the 13 systems involved in this competition are reported and analyzed for both tasks in this paper. We observe that the best system in terms of performance on forgeries of "bad" quality is not necessarily the most resistant to an increased quality of skilled forgeries. Also, we note that mobile conditions are still threatening independently of the quality of forgeries. Finally, when adding pen inclination time functions to pressure and coordinates, we find that the gap between systems in terms of performance is wider than when only pen coordinates and pressure are considered.

Person recognition using facial features, e.g., mug-shot images, has long been used in identity documents. However, due to the widespread use of web-cams and mobile devices embedded with a camera, it is now possible to realize facial video recognition, rather than resorting to just still images. In fact, facial video recognition offers many advantages over still image recognition; these include the potential of boosting the system accuracy and deterring spoof attacks. This paper presents an evaluation of person identity verification using facial video data, organized in conjunction with the International Conference on Biometrics (ICB 2009). It involves 18 systems submitted by seven academic institutes. These systems provide for a diverse set of assumptions, including feature representation and preprocessing variations, allowing us to assess the effect of adverse conditions, usage of quality information, query selection, and template construction for video-to-video face authentication.

Generalized Gaussian (GG) densities have been recently proposed to model both real and imaginary parts of Gabor coefficients. However, when matching faces, most systems make use of magnitude information only, due to its smooth behavior with displacements. The first goal of this paper is to propose a novel statistical model for the magnitude of Gabor coefficients, supposed that both real and imaginary parts are GG distributed. The proposed model, namely the ß-Rayleigh distribution, Rß(¿), is a generalization of the standard Rayleigh, R(¿), density. The Kullback Leibler (KL) divergence is used to measure the fitting accuracy of the model, showing the benefits of Rß(¿) over standard R(¿). The second goal of the paper tackles the selection of distance measures for Gabor features comparison, a topic that has received little attention in the literature. Inspired by the proposed statistical model, different ¿ßnorms are tested on the XM2VTS database, showing interesting results that confirm that classical distances used in Gabor-based recognition systems do not provide the best performance.

In this paper we present a solution to obtain useful and reliable user logs in a Learning Management System (LMS).Current LMS logs are combined with biometric-based logs that show the student behaviour. Our system models the student behaviour, allowing to know exactly how much time the student spends in front of the computer examining the con-tents of the LMS. Besides, user verification and face tracking are also integrated, what guarantees that the student is the person actually interacting with the system. The presented multimodal solution for user tracking and user ver-ification combines face tracking, face verification, speakerverification and fingerprint verification. Face tracking and face verification are performed in a non-collaborative fashion. Fingerprint or speaker verification is performed on demand, with the aim of avoiding a negative influence of adverse environmental or behavioural human factors in the reliability of the user logs generated by the system. These circumstances can thwart the non collaborative face veri-fication performance involved in the tracking process. The presented solution solves the problem of user tracking and authentication even in adverse environments for face verification.