In the modern digital era, passwords remain a common yet vulnerable means of user authentication, making them susceptible to many attacks. As a result, Two-Factor Authentication (2FA) emerged, offering heightened security. However, its two-step verification process can discourage widespread adoption. This study explores the potential of Electroencephalography (EEG) signals as an innovative alternative to 2FA by combining the authentication and validation processes into a single step. Our research examines different techniques to extract features from raw EEG signals, including band power extraction, statistical features, wavelet features, and Shannon Entropy, to capture these signals’ unique and intricate patterns. Additionally, we perform a comprehensive comparative analysis of discriminative classifiers such as Support Vector Machines (SVMs), k-Nearest Neighbors (k-NNs), Multilayer Perceptron’s (MLPs), Random Forest, and Gradient Boosting to determine the most effective approach for EEG signal-based authentication. We utilize a user-friendly web application that connects with cloud resources to validate our findings and provide a tangible demonstration. This application securely receives and stores EEG signals, allowing them to be evaluated against pre-trained machine-learning models. Our findings highlight the significant potential of EEG signals as a dependable, robust, and secure approach for user authentication, paving the way toward a future where passwords and complex 2FA processes can be substituted with a more convenient and reliable EEG-based authentication system.

The need for a new authentication method such as biometrics becomes apparent as the data breaches on password-based authentication increase. However, current biometric forms of authentication become unusable once compromised. Additional limits are realized when an attacker coerces an authorized user into a forced authentication. To resolve both issues, we propose creating an authentication mechanism that depends on the user's neurophysiological responses to chosen pieces of music (non-lyrical) measured using electroencephalographic (EEG) signals. This research paper provides a guide for creating and presenting a system that incorporates such idea for person classification and authentication. In a group study, the aim is that participant listen to individually selected music and music selected by other participants during an EEG reading. The change in the Alpha and Beta band frequencies across eight electrode EEG sensors serves as the input feature vector for a supervised machine learning algorithm that trains on the user and attacker EEG readings. Ultimately, the goal of the algorithm is to create a user-specific model to uniquely identify the respective user based on the corresponding EEG response to music and grant authentication. Our study lays a solid foundation for creating a promising EEG-based authentication system by solving the drawbacks of current biometric authentication methods.

As attacks against password-based authentication increase, the need for robust biometrics becomes apparent. Currently, two of the most popular biometric authentication systems are fingerprint and facial recognition. However, both of these biometrics become unusable once compromised. Also, an attacker might coerce the user to force authentication. Therefore, we propose an authentication mechanism that depends on the participant's neurological responses to chosen pieces of music measured using electroencephalographic (EEG) signals. The current study proposes an authentication system that uses neurological responses to music for classification. Participants listened to individually selected music and music selected by other participants during an EEG reading. The change in the Alpha and Beta band frequencies across seven electrodes served as the input to a user specific K-Nearest Neighbors (KNN). The classifier attempts to determine if we can identify a user based on their EEG response to music. Our pilot data collection and analysis has shown promise of this authentication system with an accuracy rate between 76.4%-92.3%.

Mobile Money Applications are thriving due to the ease and convenience it brings to people, where it offers to transfer money between people's bank accounts/cards with a few taps on a smartphone either in the form of Mobile Banking or Mobile Payment Services. However, a key challenge with gaining user adoption of mobile banking and payments is the customer's lack of confidence in the security of the services, and that makes much sense because whenever people grant service access to their debit/credit cards or bank accounts that automatically opens the door for identity thefts, fraudulent transactions, and stolen money. Add to that, the fact that already people and developers are not giving much attention to the security aspect of the applications. This paper consists of two parts: first, an intensive security analysis on a selection of different mobile banking and mobile payment applications on Android platform where 80% of the selected applications were found not following the best security measures. And second, a thorough step by step Android security testing guide in the form of this paper to ease the process of security testing any Android application to be used by developers, ethical hackers, and anyone interested in testing the security of any application.

Phishing e-mails are the stepping stone for many cyber attacks exploiting the psychology of the victims. However, the literature lacks a study that correlates these phishing e-mail contents and the personality traits of the victims. By understanding how different types of phishing e-mails are crafted to exploit a population of certain personality types, one can develop a system that can predict which types of phishing e-mails a person might be more susceptible to. In this paper, we outline the architecture of such a decision support system based on five factor model of personality traits and a phishing experiment creating a virtual stock market, which can be used by an organization for personalized phishing awareness training of employees and better defense from phishing attacks.