Mobil bankacılık uygulamasında davranışsal biyometri ile artırılmış kimlik doğrulama

Smartphones have become very important and essential tools for our daily lives. We can make our banking transactions by using them instead of going to a bank branch. However, some possible security and privacy issues come in mind at this point. One of the greatest issues would be the theft or seizure of the smartphone by a third person. Banks take care of most of the cases by forcing the customer set a password which is not easily guessable. Also the banks send SMS messages or instant notifications to customers as a second layer of security. These are good to have but may not be sufficient. Assume a customer unlocks the phone, crosses the second security layer into the banking application and then a thief steals the phone. The thief not only has the phone but also has the money that in the bank accounts at this point. This action is known as Account Takeover Attack in the literature. This thesis highlights the potential risks that occur when smartphones are stolen or seized, and provides a solution to account takeovers by using continuous authentication concepts, like continuous user identification via touch and micro movements, and the mechanisms of behavioral biometrics. The solution is implemented inside a mobile banking application and the data is collected with this application. The collected data is modeled utilizing a machine learning algorithm. The details of the augmentation process and the test results in terms of authentication performance and resource consumption are also provided. Keywords: Continuous authentication, behavioral biometrics, machine learning, pattern recognition, security, resource consumption, mobile banking application, account takeover attack, application security, mobile phone sensors, touchscreen, classification, one class svm.