Traditionally, authentication systems have followed a non-feedback approach, requiring users to present credentials before accessing resources. Over time, users have become accustomed to this oblivious form of authentication. However, this model offers no opportunity for users to provide feedback that could enhance the system's effectiveness. Similarly, biometric-based implicit authentication, while transparent, often excludes users entirely from the feedback loop. Incorporating user feedback into authentication systems has the potential to significantly improve their performance. Achieving this, however, requires a novel framework capable of standardizing user input, extracting meaningful information from feedback, and integrating the user more closely into the system. To this end, we challenge conventional authentication paradigms and introduce User-Centered Implicit Authentication (UserIA)-a customizable approach that extends beyond the limits of traditional schemes. UserIA maintains the transparency of implicit authentication while delivering improved accuracy and reduced overhead. To enable secure feedback-driven feature adaptation, UserIA introduces a new technique calledbehavior alignment. Additionally, it appliesuser operant conditioningfrom psychology to reinforce user behavior and further enhance authentication accuracy. We have implemented and thoroughly evaluated UserIA in a real-world environment. Experimental results demonstrate that UserIA achieves a lower Equal Error Rate (EER) and consumes less time and energy compared to existing methods.

In the advancing field of machine learning, balancing accuracy, interpretability, and privacy represents a significant challenge. The problem is exacerbated by the widespread deployment of pre-trained models locally in diverse applications, which could lead to various amounts of privacy leakage. Conventional Differential Privacy strategies, in which uniform noises are applied to model gradients, guarantee data privacy at the expense of accuracy and interpretability. This paper introduces a Feature-Sensitive Adaptive Differential Privacy (FADP) framework with a unique noise-adding strategy. Noises are adaptively added based on feature importance clustering, where important features are considered for interpretability. By employing a unique masking technique, FADP selectively preserves crucial features with minimal noise interference, maintaining accuracy while enhancing interpretability. The FADP framework addresses the limitations of traditional DP methods by preserving critical channels and improving interpretability — a vital requirement in machine learning applications that demand transparency in model decisions. Through comprehensive testing, FADP is shown to balance the trade-offs among accuracy, privacy, and interpretability, marking a substantial advancement in the field of privacy-preserving machine learning.

In recent years, continuous authentication, a method of ongoing identity verification aimed at enhancing cybersecurity protection, has been receiving increasing attention. It utilizes users’ behavior data sampled from various sensors, but due to the resource limitations of smart devices, both the data and computation (including data processing, transmission, and training) have to be offloaded. However, the offloading will introduce more security vulnerabilities. In this paper, we propose LightSentinel, a lightweight continuous user identification and anomaly detection system. LightSentinel can derive users’ key behavior patterns and detect behavior changes during usage without the need for data and computation offloading, and a probability chain has been established for each user to improve the identification accuracy of the system. In our experiment, we deployed LightSentinel on Android devices and conducted evaluations to assess its identification accuracy, energy consumption, and computational efficiency. The results demonstrate that LightSentinel consumes lower power consumption and requires less computation than other applications and IA schemes. Moreover, its accuracy makes it suitable for deployment as an anomaly detection system on smart devices.

False data injection attacks (FDIAs) pose a significant security threat to power system state estimation. To detect such attacks, recent studies have proposed machine learning (ML) techniques, particularly deep neural networks (DNNs). However, most of these methods fail to account for the risk posed by adversarial measurements, which can compromise the reliability of DNNs in various ML applications. In this paper, we present a DNN-based FDIA detection approach that is resilient to adversarial attacks. We first analyze several adversarial defense mechanisms used in computer vision and show their inherent limitations in FDIA detection. We then propose an adversarial-resilient DNN detection framework for FDIA that incorporates random input padding in both the training and inference phases. Our simulations, based on an IEEE standard power system, demonstrate that this framework significantly reduces the effectiveness of adversarial attacks while having a negligible impact on the DNNs' detection performance. Index Terms-False Data Injection Attack, Smart Grid Communication, Deep Learning, Adversarial Attacks

Leveraging users' behavioral data sampled by various sensors during the identification process, implicit authentication (IA) relieves users from explicit actions such as remembering and entering passwords. Various IA schemes have been proposed based on different behavioral and contextual features such as gait, touch, and GPS. However, existing IA schemes suffer from false positives, i.e., falsely accepting an adversary, and false negatives, i.e., falsely rejecting the legitimate user due to users' behavior change and noise. To deal with this problem, we propose BubbleMap (BMap), a framework that can be seamlessly incorporated into any existing IA system to balance between security (reducing false positives) and usability (reducing false negatives) as well as reducing the equal error rate (EER). To evaluate the proposed framework, we implemented BMap on five state-of-the-art IA systems. We also conducted an experiment in a real-world environment from 2016 to 2020. Most of the experimental results show that BMap can greatly enhance the IA schemes' performances in terms of the EER, security, and usability, with a small amount of penalty on energy consumption.

Recent research demonstrated that the superficially well-trained machine learning (ML) models are highly vulnerable to adversarial examples. As ML techniques are becoming a popular solution for cyber-physical systems (CPSs) applications in research literatures, the security of these applications is of concern. However, current studies on adversarial machine learning (AML) mainly focus on pure cyberspace domains. The risks the adversarial examples can bring to the CPS applications have not been well investigated. In particular, due to the distributed property of data sources and the inherent physical constraints imposed by CPSs, the widely-used threat models and the state-of-the-art AML algorithms in previous cyberspace research become infeasible.

Implicit authentication (IA) is gaining popularity over recent years due to its use of user behavior as the main input, relieving users from explicit actions such as remembering and entering passwords. However, such convenience comes with a cost of authentication accuracy and delay which we propose to improve in this paper. Authentication accuracy deteriorates as users' behaviors change as a result of mood, age, a change of routine, etc. Current authentication systems handle failed authentication attempts by locking the users out of their mobile devices. It is unsuitable for IA whose accuracy deterioration induces a high false reject rate, rendering the IA system unusable. Furthermore, existing IA systems leverage computationally expensive machine learning, which can introduce a large authentication delay. It is challenging to improve the authentication accuracy of these systems without sacrificing authentication delay. In this paper, we propose a multi-level privilege control (MPC) scheme that dynamically adjusts users' access privilege based on their behavior change. MPC increases the system's confidence in users' legitimacy even when their behaviors deviate from historical data, thus improving authentication accuracy. It is a lightweight feature added to the existing IA schemes that helps avoid frequent and expensive retraining of machine learning models, thus improving authentication delay. We demonstrate that MPC increases authentication accuracy by 18.63% and reduces authentication delay by 7.02 minutes on average, using a public dataset that contains comprehensive user behavior data.

Motivated by the great potential of implicit and seamless user authentication, we attempt to build an implicit authentication (IA) system with adaptive sampling that automatically selects dynamic sets of activities for user behavior extraction. Various activities, such as user location, application usage, user motion, and battery usage have been popular choices to generate behaviors, the soft biometrics, for implicit authentication. Unlike password-based or hard biometric-based authentication, implicit authentication does not require explicit user action or expensive hardware. However, user behaviors can change unpredictably which renders it more challenging to develop systems that depend on them. In addition to dynamic behavior extraction, the proposed implicit authentication system differs from the existing systems in terms of energy efficiency for battery-powered mobile devices. Since implicit authentication systems including the proposed one rely on machine learning, the expensive training process needs be outsourced to the remote server. However, mobile devices may not always have reliable network connections to send real-time data to the server for training. We overcome this limitation by proposing a W-layer, an overlay that provides a practical and energy-efficient solution for implicit authentication on mobile devices. We implemented partially labeled Dirichlet allocation (PLDA) on the server side for more accurate feature extraction, and achieved 93.3 percent precision and 98.6 percent accuracy in the synthetic dataset. Furthermore, we tested the power consumption of the smartphones used for our experiments and found that our method consumed 14.5 percent of the devices' total battery usage.

Motivated by the great potential of implicit and seamless user authentication, we attempt to build an efficient middle layer running on mobile devices to support implicit authentication (IA) systems with adaptive sampling. Various activities, such as user location, application usage, user motion, and battery usage have been popular choices to generate behaviors, the soft biometrics, for implicit authentication. Unlike password-based or hard biometric-based authentication, implicit authentication does not require explicit user action or expensive hardware. However, user behaviors can change unpredictably which renders it more challenging to develop systems that depend on them. Various machine learning algorithms have been used to address this challenge. The expensive training process is usually outsourced to the remote server but this can potentially increase the chance of data leakage. In addition, mobile devices may not always have reliable network connections to send real-time data to the server for training. Motivated by these limitations, we propose a W-layer, an overlay that provides an energy-efficient solution for real-time implicit authentication on mobile devices. The size of the data the system needs to collect at different times depends on the legitimacy of the user. This in turn affects how the sampling rate is adjusted which can reduce energy consumption. To evaluate our method, we conducted several experiments on both synthetic and real datasets. The average accuracy of identifying legitimate users is 96.73% using the synthetic dataset and 96.70% using the real dataset. Furthermore, we tested the power consumption on a low-end Nexus S smartphone to obtain a more pessimistic result. We found that our method consumed 14.5% of the device's total battery usage. The power consumption performance is expected to improve significantly on high-end mobile devices.

With the rapid growth of the smart device market, associated security issues become more threatening and diverse than ever before. Due to the limitations of the traditional explicit authentication mechanisms (e.g., Password-based, biometrics), researchers and the industry have been promoting implicit authentication (IA) that does not require explicit user action and potentially enhances user experience to further protect devices from misuse. IA typically leverages various types of behavioral data to deduce a user behavior model for authentication purpose. However, IA systems are still at their infancy and exhibit many limitations, one of which is how to determine the best retraining frequency when updating the user behavior model. Another limitation is how to gracefully degrade user privilege, when authentication fails to identify legitimate users (i.e., False negatives) for a practical IA system. To address the first problem, we propose an algorithm that utilizes Jensen-Shannon (JS)-dis(tance) to determine the optimal retraining frequency. For the second problem, we introduce a dynamic privilege mechanism, again based on JS-dis(tance), to achieve multi-level fine-grained access control. Our simulation results show that the proposed techniques can successfully detect the degradation of accuracy of the user behavior model, as well as automatically determine and adjust to the best retraining frequency. It is also shown that the dynamic privilege-based access control reduces the impact of false negatives on legitimate users and enhances system reliability and user experience compared with the traditional lock-only method in case of authentication failure.