FrD1.25
Proceedings of the 5th International IEEE EMBS Conference on Neural Engineering Cancun, Mexico, April 27 - May 1, 2011
Low-Cost Electroencephalogram (EEG) based Authentication Corey Ashby∗a , Amit Bhatia∗a , Francesco Tenoreb , and Jacob Vogelsteina
Abstract— A low-cost, consumer-grade, EEG-based individual authentication system is proposed in this work. While EEG signals are recorded, the subject performs four mental imagery tasks consisting of a baseline measurement, referential limb movement, counting, and rotation for 150 seconds each. The 150 seconds of data are divided into one second segments, from which features are obtained. Three sets of features are extracted from each electrode: 6th order autoregressive (AR) coefficients, power spectral density, and total power in five frequency bands. Two additional sets of features are extracted from interhemispheric data: interhemispheric power differences and interhemispheric linear complexity. These feature sets are combined into a feature vector that is then used by a linear support vector machine (SVM) with cross validation for classification. The goal was to minimize both false accept rates (FARs) and false reject rates (FRRs). Using voting rules across groups of ten segments, we were able to achieve 100% classification accuracy for each subject in each task. Though more work must be done with a larger subject pool as well as across multiple sessions, these results show that low-cost EEG authentication systems may be viable.
I. INTRODUCTION Individual authentication (or verification) involves confirming the claimed identity of an individual based on the information they provide. This is different from identification, which attempts to determine who an individual is based solely on the information they provide (no claim is necessary). Authentication is important for the regulation of access to restricted areas as well as for the secure transmission of sensitive data. The recent growth of internet commerce and banking, especially, has spurred interest in this topic. All existing authentication methodologies adopt one or more of the following three basic individual qualities [1]: • Knowledge (e.g. password, PIN), • Possessions (e.g. ATM card, passport) • Traits (e.g. fingerprint, voice) Most consumer authentication systems rely on either knowledge/knowledge (e.g. username/password) or possession/knowledge (e.g. access card/PIN) combinations. Both of these are vulnerable to multiple types of attack, including shoulder surfing, forgery, and theft. Consequently, biometric authentication methodologies that rely on intrinsic physical and behavioral traits have been proposed to overcome these weaknesses. a Department of Electrical and Computer Engineering, The Johns Hopkins University, 3400 N Charles Street, Baltimore MD, 21218 b The Johns Hopkins University Applied Physics Laboratory, 11100 Johns Hopkins Road, Laurel, Maryland 20723 *These authors contributed equally to this paper.
[email protected] [email protected]
978-1-4244-4141-9/11/$25.00 ©2011 IEEE
In order to be used in an authentication system, a biometric must satisfy the following requirements [2]: • •
•
•
Universality: each person should have the characteristic. Distinctiveness: any two persons should be sufficiently different in terms of the characteristic. Permanence: the characteristic should be sufficiently invariant (with respect to the matching criterion) over a period of time. Collectability: the characteristic can be measured quantitatively.
All biometric methodologies satisfy these basic requirements to a sufficient degree to allow for authentication. Examples of such methodologies include recognition of fingerprint, face, DNA, palm print, hand geometry, iris (which has largely replaced retina), odor/scent, typing rhythm, gait, and voice [3]. Electroencephalogram (EEG) authentication is a relatively new type of biometric authentication methodology, first described in the literature in the late nineties [4]. This approach depends on extracting relevant features from electrical activity of the brain while an individual perform various tasks. The extracted features are then compared with those previously collected from whomever the individual claims to be and successful authentication occurs only if the features match. Studies have explored several different task paradigms for EEG authentication including having subjects sit relaxed with their eyes closed [5], [6], performing mental computation or reading [3], [7], imagining speech [8], imagining motor movements [9], [10], and looking at or listening to stimuli known to elicit evoked potentials (EPs) [8], [11].
Fig. 1. (left) EEG electrode placement diagram. There are 14 electrodes and two references (CMS/DRL), positioned in the International 10-20 System: AF3, F3, F7, FC5, T7, CMS, P7, O1, AF4, F4, F8, FC6, T8, DRL, P8, O2; (right) Picture of lab setup.
442
II. M ETHODS Five subjects (2 female, 3 male, all between the ages of 18 and 35 with no history of neurological disorders) donned an Emotiv EEG headset with 14 electrodes. Each subject performed four different mental tasks while data was recorded at 128 Hz. A. Tasks Each task consisted of ten sessions with each session lasting 15 seconds, resulting in 150 seconds of data per subject, per task. Task 1: Baseline – Subjects were instructed to close their eyes, sit relaxed, and remain still. Task 2: Referential Limb Movement Activity – Prior to the referential task, subjects were instructed to choose one of their four limbs without revealing which limb they had chosen. They were then told to close their eyes and imagine moving that limb without making any real movements. Task 3: Visual Counting Activity – Subjects were instructed to close their eyes and imagine a blackboard and to visualize numbers being written on the board sequentially, with the previous number being erased before the next number was written. Subjects were not allowed to verbalize the numbers and were told to resume counting between successive sessions rather than starting over at the beginning of each session. Task 4: Geometric Figure Rotation Activity – Prior to each session of the rotation task, subjects were given 30 seconds to study a Rubik’s cube displayed on an LCD monitor, located approximately three feet away. As in the previous tasks, subjects were told to close their eyes and visualize it being rotated about an axis of their choice, without revealing which axis. EEG signals were recorded only while the subject’s eyes were closed. Task 1 is the task most commonly performed in EEG authentication studies. It can be used either as a reference for all other tasks or as a separate task. Task 2 was designed to allow an individual to retain information that only he/she knew in the rare event that someone discovers how to “feign” his/her brain activity. Tasks 3 and 4 were chosen because they yielded the best performance according to a previous study [3]. All tasks except baseline involve interhemispheric brain wave asymmetry [12]. B. Feature Extraction The 150 seconds of data recorded per subject per task was divided into 150 one second segments of 127 samples each. First, the data was high-pass filtered with a second order 2 Hz cut-off elliptic filter. Forward and reverse filtering was performed to ensure no phase distortion. Then the following features were extracted for each segment of data: 1) Autoregressive coefficients (ARs): A 6th order autoregressive (AR) model was used on the filtered data to obtain six AR coefficients for each of the 14 electrodes: x(n) =
M X k=1
ak x(n − k) + e(n),
Fig. 2. EEG authentication flow diagram. Data is collected with the Emotiv headset, then high-pass filtered with a second order elliptic filter. Autoregressive coefficients (ARs), power spectral density values (PSDs), spectral powers (SPs), interhemispheric power differences (IHPDs), and interhemispheric linear complexity values (IHLCs) are extracted from the data to form the feature vector. The feature vectors are classified with a one-vs.-all support vector machine (SVM). Finally, false accept (FAR) and false reject (FRR) classification error rates are obtained.
where M is the model order, x(n) is the signal at the sampled point n, ak are the real valued AR coefficients, and e(n) represents the error term independent of past samples. Therefore, six AR coefficients were obtained for each channel, giving 84 features for each segment of data. 2) Power Spectral Density (PSD): The power spectral density was obtained by taking the square of the absolute value of the Fourier transform of the data in each segment. This consisted of 65 points, representing half the sampling rate, for each of the 14 electrodes. This added 910 features for each segment of data. 3) Spectral Power (SP): Total power was obtained for each of the electrodes in 5 frequency bands: delta (0-4 Hz), theta (4-7 Hz), alpha (8-13 Hz), beta (14-20 Hz), and gamma (21-50 Hz) by integrating the spectral density over the given frequency ranges. This resulted in 5 spectral powers per electrode, or an additional 70 features for each segment of data. 4) Interhemispheric Power Difference (IHPD): Interhemispheric power differences were taken for each of the 5 bands, between each pair of electrodes in the left and right hemispheres. These differences were computed as in Ref. [3]: P owerdif f = (P1 − P2 )/(P1 + P2 ), where P1 is the power in one channel and P2 is the power in another channel in the same spectral band, but, in the opposite hemisphere. This resulted in 49 interhemispheric power differences (7 electrodes on each hemisphere) in each band, or 245 more features for each segment of data. 5) Interhemispheric channel linear complexity (IHLC): Interhemispheric linear complexity values were calculated as the entropy of the eigenvalues of the covariance matrix of the interhemispheric power differences. It measures the degree
443
TABLE I E RROR R ATES BY S UBJECT AND TASK
of spatial synchronization of data. It can be computed by: Ω = exp(
C X
ζi logζi )
i=1
ζi =
λi , C X λi i=1
where the λi are the eigenvalues of the covariance matrix of the interhemispheric power differences, the ζi are the normalized λi s, and Ω is the IHLC. High values indicate a low correlation between the signals in the electrodes and vice versa. This yielded 49 more features for each segment of data. All told, the size of the feature vector is 1,358 for each segment of data. The EEG authentication flow from data collection to classification is diagrammed in Fig 2. After classification, the results contained two types of errors: false accept rate (FAR), which occurs when a subject is erroneously authenticated as the person they claim to be and false reject rate (FRR), in which a subject is erroneously rejected as not being the person they claim to be.
Subject FRR FAR
S1 0.013 0.000
Subject FRR FAR
S1 0.007 0.003
Subject FRR FAR
S1 0.047 0.008
Subject FRR FAR
S1 0.113 0.020
BASELINE S2 S3 S4 0.080 0.000 0.100 0.015 0.002 0.008 REFERENTIAL S2 S3 S4 0.053 0.007 0.053 0.008 0.003 0.013 COUNTING S2 S3 S4 0.053 0.000 0.047 0.007 0.005 0.010 ROTATION S2 S3 S4 0.067 0.000 0.047 0.012 0.002 0.003
S5 0.060 0.012
Avg 0.051 0.007
S5 0.000 0.007
Avg 0.024 0.007
S5 0.013 0.008
Avg 0.032 0.008
S5 0.000 0.017
Avg 0.045 0.011
C. Classification Classification of the feature vector was performed with a one-vs.-all linear support vector machine (SVM). Assuming that in a real-world scenario we would take ten seconds of data per task per subject (or 40 seconds of data per subject), we define ten segments of data as one block and four blocks of data (one from each task) as one group. Therefore, the 600 segments of data per subject (150 per task) were composed of 15 groups of data (15 blocks per task). The goal was to correctly classify a subject based on one group of data. 15-fold cross validation was used, so the 15 blocks from each task were split into 14 training blocks and 1 test block. The 140 segments of positive samples (labeled as ‘subject’) were combined with 560 segments of negative samples, from the four other subjects (labeled as ‘not subject’), to form each training set. The remaining positive sample block was combined with 4 blocks of negative samples, from the four other subjects, to form the test set. This was repeated 15 times with non-overlapping windows to obtain 750 results per task, per subject. We can obtain more accurate results by using voting rules to combine the results of individual segments into a single result per block of data. We can then combine the results of individual blocks into a single result per group of data. III. R ESULTS Table I shows both the per-subject error rates, as well as the average FAR and FRR values in each of the four tasks. These FAR and FRR values were computed for each block and then averaged across the 15 folds. Finally the FAR and FRR values were averaged together to obtain the half total error rate (HTER). The raw classification accuracy was computed by taking 1 − avgHT ER , where the HTER is averaged across subjects.
Fig. 3. Classification accuracy with and without voting rules. See text for details.
Next, as explained in the Methods section, we use voting rule 1 to obtain a classification result from each block of data: if more than 6 of the 10 segments within the block have the same label, the block is assigned that label. Then we apply voting rule 2 to obtain a result from each group of data: if more than 2 of the 4 tasks within the group have the same label, the subject is assigned that label. The classification accuracies before and after each voting rule are found in a similar manner to the raw classification accuracy and are shown in Fig 3. IV. D ISCUSSION In this study, a low-cost, consumer-grade EEG system was used to perform individual authentication. Unlike costly laboratory-grade equipment, this system utilizes an inexpensive $300 EEG headset, which has the potential to pave the way for mass adoption in consumer applications. In our feature vector, AR coefficients of order six are used because others researchers have suggested this approach for EEG classification [3]. Spectral powers are used to obtain brain activity in different, biologically significant bands. Power spectral density values were taken because spectral power reduces the amount of information by integration between bands and it is possible that some of the information lost could contribute to better classification. Interhemispheric values (both power differences and linear complexity) were taken because the tasks chosen elicit interhemispheric asym-
444
metry in brain activity. Both are measures of the degree of spatial synchronization of the data. The many extracted features were kept to first allow us to validate that the chosen set of features provided good results, that is yielded low error rates. The next step will be to identify the most relevant features (e.g. via Principal Component Analysis, PCA) and use only those in subsequent classification steps. Having analyzed the requirements for a biometric mentioned in the introduction, we know that electrical activity of the brain satisfies the universality requirement—indeed, lack of electrical activity in the brain is often used as a legal indicator of death. We also know that brain activity satisfies the collectability requirement, as it can be reliably recorded via EEG as it has been for decades. Though it is unlikely that brain activity remains constant over the lifetime of any individual (age and disease almost certainly modify it), it may be possible to develop classification methods that incorporate data from successful authentication sessions as part of an ongoing, expanding training set. With proper weighting, this could account for slow changes in brain activity over time. Moreover, whether or not brain activity is necessarily distinct between different individuals, especially during specific tasks and under similar conditions, remains an open question. It is reasonable to believe that because all individuals (except monozygotic multiple births) have unique DNA and every individual has a unique set of experiences, this uniqueness is in some way encoded in brain activity. If this is true, then EEG would satisfy the requirements for a biometric. In addition to the criteria above, practical biometric authentication systems must also consider the following factors [2]: • Performance, which refers to the achievable recognition accuracy and speed, the resources required to achieve the desired recognition accuracy and speed, as well as the operational and environmental factors that affect the accuracy and speed • Acceptability, which indicates the extent to which people are willing to accept the use of a particular biometric identifier (characteristic) in their daily lives • Circumvention, which reflects how easily the system can be fooled using fraudulent methods. The ability to circumvent an EEG-based authentication system depends in part on the distinctiveness of the signal (e.g. no individual should be able to “feign” another individuals brain activity with their own thought process) and in part on the ability to resist a “man-in-the-middle” (MITM) type of attack (e.g. copying or recording one individual’s brain activity and inserting it during the authentication process of another individual). While acceptance of EEG-based authentication systems may be impeded by privacy concerns and discomfort caused by the required gel/saline solutions, education of the public and increasing familiarity with the technology could lead to popular adoption. Performance is the metric most commonly used and often the only metric used to evaluate the feasibility of EEG-
based authentication systems. While reported performance (including our results) has been promising (i.e. low error rates), studies have typically used fewer than ten subjects (only one study has used more than 100 [8]) and almost all have used single session recordings, as opposed to multisession recordings involving removal and replacement of electrodes. Although it has been shown that good accuracy can be achieved even with over 100 subjects [8], it is yet to be shown that good accuracy can be obtained for a number of subjects that would be practical in a real-world application. ATM machines, for example, would require accurate distinction between thousands to millions of people. In fact, while good results can be obtained for single recordings, performance has been shown to degrade severely for data taken over multiple trials and/or days [9]. The mechanism behind this performance degradation must be more clearly understood if EEG authentication is to become a reality. Specifically, we need to know whether the performance degradation is due to small deviations in electrode placement or whether other factors are at play such as mood or concentration of the subject. If we can isolate the cause, it may be possible to restore good performance. For example, if it turns out that performance is extremely sensitive to electrode placement, we can develop more reliable ways of placing the EEG headset to ensure the same locations are used every time. On the other hand if human factors are the cause, we can possibly make our classifier more robust by including more recordings under more diverse settings in our training set. R EFERENCES [1] Fed. Fin. Inst. Exam. Cncl., Auth. in an Int. Bank. Env., http://www.ffiec.gov/pdf/authentication guidance.pdf. [2] A. K. Jain, et al., “An Introduction to Biometric Recognition,” IEEE Trans. Circuits Syst. Video Technol., vol. 14, pp. 4-20, 2004. [3] R. Palaniappan, “Two-Stage Biometric Authentication Method Using Thought Activity Brain Waves,” Int. J. Neural Systems, vol. 18, no.1, pp. 59-66, 2008. [4] M. Poulos, et al., “Person Identification Based on Parametric Processing of the EEG,” 6th ICECS, pp. 283-286, 1999. [5] I. Nakanishi, et al., “EEG Based Biometric Authentication Using New Spectral Features,” ISPACS, pp. 651-654, 2009. [6] P. Tangkraingkij, et al., “Personal Identification by EEG Using ICA and Neural Network,” ICCSA, vol. 6018, pp. 419-430, 2010. [7] C.R. Hema et al., “Single Trial Analysis on EEG Signatures to Identify Individuals,” 6th CSPA, 2010. [8] K. Bringham, et al., “Subject Identification from Electroencephalogram (EEG) Signals During Imagined Speech,” 4th BTAS, 2010. [9] S. Marcel, et al., “Person Authentication Using Brainwaves (EEG) and Maximum A Posteriori Model Adaptation,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 29, no. 4, pp. 743-728, 2007. [10] S. Sun, “Multitask Learning for EEG-Based Biometrics,” 19th ICPR, pp. 1-4, 2008. [11] C. He, “Person Authentication Using EEG Brainwave Signals,” Master’s Thesis, The Univ. of British Columbia, Vancouver, Dept. of Elect. Eng., 2009. [12] Z. A. Keirn et al., “A new mode of communication between man and his surroundings,” IEEE Trans. on Biomed. Eng. vol. 37, no. 12, pp. 1209-1214, 1990.
445
