Evaluation of machine learning methods for impostor detection in web applications.

Applying machine learning (ML) methods to multi-factor authentication is becoming increasingly popular. However, there is no comprehensive methodology to evaluate biometric systems based on machine learning in the literature. This paper proposes a general methodology for evaluation the ML-based systems for impostor recognition/detection using biometric traits. This includes creation of learning and testing sets with appropriate size balance (proportion) between these sets, selecting the number of instances coming from different users, evaluation of the influence of the impostors number on their detection rate, and the impact of the number of records representing user's behavior. In addition, we propose how the real data (possibly affected by account takeover attempts) could be used to extend the enrollment data to support the impostor detection. The proposed approach was used for a systematic comparison of an extensive set of ML and statistical methods. For some of them, the false acceptance rate (FAR) close to zero and false rejection rate (FRR) smaller than 0.05 in a supervised experiment were accomplished, proving the merit of certain ML-based approaches. Moreover, using the method proposed in the paper, a classifier trained on experimental data achieved FAR below 0.05 on the real-world data collected at an actual financial web page. • General methodology for evaluating ML impostor recognition using biometric traits. • Evaluation of the influence of the impostors number on their detection rate. • Evaluation of the impact of the number of records representing user's behavior. • The proposed approach tested on ML methods reaching FAR and FRR smaller than 0.05. • Test-bed trained classifier achieved FAR < 0.05 on data from financial service. [ABSTRACT FROM AUTHOR]