User Profiling Using Sequential Mining over Web Elements

Most of today's sensitive systems offer receiving information and performing actions remotely through the company's website by using authentication mechanisms such as username and password, one-time tokens, etc. However, these methods are not immune against credentials theft. Authenticated sessions can be subjected to session hijacking through stolen cookies, man in the middle (MitM) attacks, social Engineering and more. Behavioral biometrics models within the website can help continuously verify user's identity throughout the session and prevent a wide variety of attacks. Such methods usually focus on sampling the raw movements and extracting meaningful features for profiling such as velocity, curvature, distance, etc. However, traditional methods usually avoid the elements that are being traversed by the user and do not use the created sequence of elements the user usually go through, which can be easily extracted in web applications. Therefore, we introduce a novel approach for pointing device (e.g. mouse, finger, touchpad, trackball) sequential verification in web applications. This approach can be used in addition to traditional feature-based movement techniques and enhance them. Our approach is based on Hidden Markov Model and Linear Regression to profile a user based on web elements sequences constructed from the user's pointing device movements. We demonstrate the competitive advantage via encouraging results on anonymized dataset collected by IBM from accounts of 2500 web application users.