So, you think you can create an avatar and mask your identity on the net? Well, think again. That was the takeaway from the brief but dense talk on identifying social network users, given by Marina Gavrilova, Ph.D., professor and and head of Biometric Technologies Lab at the University of Calgary, Canada.
Gavrilova presented over the course of two days at the Fordham-FBI 2018 International Conference on Cyber Security, beginning with a lecture on multi-model biometric fusion for cybersecurity on Jan. 8 and then on identifying social network users by their online behavior on Jan. 9.
Multi-model biometric fusion essentially combines the many ways an individual can be identified in both the real world and online. It’s not one fingerprint, computer program, algorithm, social media profile, or facial recognition that identifies persons, but rather “a proposed philosophy” that combines all of the data to identify them, said Gavrilova.
For example, a person’s gait can be recognized on their way to catch a flight. Their face and ear points can be identified by a surveillance camera as they pick up their baggage. When they go online they can be identified the by the way they use their mousepad, the pressure they put on the keys, and how fast they type.
“As long as information has been collected over time, how strongly you press on the keys, which keys you like to press, even the frequency, how fast you type, where you move your hands, and when you type can identify you,” she said. “As long as this information is available it becomes part of your so-called biometric template.”
To snag a cybersecurity suspect, such surveillance doesn’t necessarily need expensive equipment. If someone creates a profile on Twitter or another social network, they can still be identified simply by the way they text, their spelling mistakes, hashtags, favorite words, and their associations. Gavrilova likened it to going to a doctor with symptoms—a headache, a stuffed nose—and the doctor trying to figure out what the illness is.
“It’s the same with biometric. We say we have these face points, these ear points, this social profile, who is that person?”
“Even if you don’t have the physiological data and the person is simply hiding behind a login name—but is active online—we can look at all this information,” she said. “You can view their activities, acquaintances, and the times that they’re online.”
All of the data becomes part of a multimodal system that can precisely profile the person and even how they change.
“In some ways, it’s like old-school spying: Someone talks to someone on the street and gives them a briefcase. They go into a room. You don’t know what they’re talking about, but you can see their gestures and who they’re talking to,” she explained. “Now that information is available in plain sight on the web,
“We all have a data foot print—and it’s enormous.”
