# US 12,111,898 B2 · Devices and methods for smartphone impostor detection using behavioral and environmental data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,898 B2 - Document ID: US12111898B2 - Status: Granted - Kind: B2 - Application number: 17/668,142 - Filed: 2022-02-09 - Published: 2022-08-25 - Granted: 2024-10-08 - Earliest claimed: 2021-02-09 - Assignees: The Trustees of Princeton University - Applicants: The Trustees of Princeton University - Inventors: Ruby Lee; Guangyuan Hu - Web page: https://patentgrep.com/patent/US12111898B2 ## CPC - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04W 12/30: Security of mobile devices; Security of mobile applications - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 12/12: Detection or prevention of fraud - H04W 12/64: using geofenced areas - H04W 12/68: Gesture-dependent or behaviour-dependent - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Devices and methods for smartphone impostor detection using behavioral and environmental data are provided. Impostors are attackers who take control of an electronic device (e.g., a smartphone) and gain access to confidential and private information of a legitimate user. Embodiments described herein propose a defense-in-depth mechanism to detect impostors quickly with simple deep learning algorithms, which can achieve better detection accuracy than previous works. Embodiments then consider protecting the privacy of the behavioral and/or environmental data (e.g., collected by one or more sensors) of a user by not exposing it outside the protected device. A recurrent neural network (RNN)-based deep learning algorithm is proposed which uses only sensor data of the legitimate user to learn their normal behavior. Prediction error distribution (PED) is used to enhance the detection accuracy. In some embodiments, a minimalist hardware module, dubbed smartphone impostor detector (SID), is integrated into smartphones for self-contained impostor detection. ## Claims ### Claim 1 A mobile device, comprising: one or more sensors; and an impostor detection module coupled to the one or more sensors and configured to: receive a sequence of observed behavioral data or environmental data from the one or more sensors; implement a deep learning model that computes observed prediction error values based on the observed behavioral data or environmental data; perform a statistical inference computation that forms an observed prediction error distribution based on the observed prediction error values and generates a computed difference between a reference prediction error distribution and the observed prediction error distribution; and detect if an impostor is using the mobile device based on the computed difference between the reference prediction error distribution associated with an authorized user and the observed prediction error distribution. ### Claim 2 (depends on 1) The mobile device of claim 1, wherein the impostor detection module runs as a background process. ### Claim 3 (depends on 1) The mobile device of claim 1, wherein the impostor detection module is initiated by a triggering event. ### Claim 4 (depends on 3) The mobile device of claim 3, wherein the triggering event is at least one of a sensor input or a request for access to protected data. ### Claim 5 (depends on 1) The mobile device of claim 1, wherein: the one or more sensors comprise a three-dimensional accelerometer and a three-dimensional gyrometer; and the observed behavioral data comprises a motion pattern of the mobile device. ### Claim 6 (depends on 5) The mobile device of claim 5, wherein the impostor detection module is configured to detect if an impostor is using the mobile device by comparing the motion pattern to expected motion patterns of the authorized user. ### Claim 7 (depends on 1) The mobile device of claim 1, wherein the impostor detection module is a software module operated on a general-purpose processor. ### Claim 8 (depends on 1) The mobile device of claim 1, wherein the impostor detection module is a hardware module operated on a dedicated processor. ### Claim 9 (depends on 1) The mobile device of claim 1, wherein the statistical inference computation uses a Kolmogorov-Smirnov (KS) test to compare the observed behavioral data or the environmental data to the authorized user behavioral data or environmental data. ### Claim 10 (depends on 9) The mobile device of claim 9, wherein to perform the KS test, the impostor detection module is configured to: set a window of m reference prediction error values for a reference histogram; sort in ascending order the reference prediction error values in this window; accumulate a number of observed prediction error values that are less than each reference prediction error value in the window for n observed prediction error values; compare reference distributions and observed distributions by subtracting corresponding numbers in the reference histogram and an observed cumulative histogram that is based on the observed prediction error values; determine a maximum absolute value of differences between the reference histogram and the observed cumulative histogram; and compare the maximum absolute value of differences with a pre-computed threshold value to determine if a reference distribution and an observed distribution are the same or different. ### Claim 11 A method for detecting an impostor, the method comprising: receiving sensor data from an electronic device wherein the sensor data comprises observed behavioral data or environmental data; implementing a deep learning model that computes observed prediction error values based on the observed behavioral data or environmental data; performing a statistical inference computation that forms an observed prediction error distribution based on the observed prediction error values and generates a computed difference between a reference prediction error distribution and the observed prediction error distribution; and determining if an observed user is an impostor based on the computed difference between the reference prediction error distribution associated with an authorized user and the observed prediction error distribution. ### Claim 12 (depends on 11) The method of claim 11, wherein the sensor data comprises motion data corresponding to a motion of the electronic device. ### Claim 13 (depends on 11) The method of claim 11, wherein determining the observed user is an impostor comprises comparing a pattern of motion associated with the observed behavioral data to a behavioral biometric signature corresponding to the authorized user. ### Claim 14 (depends on 11) The method of claim 11, wherein the environmental data is associated with an environment around the electronic device. ### Claim 15 (depends on 14) The method of claim 14, wherein the environmental data comprises at least one of ambient light data, location data, or temperature data. ### Claim 16 (depends on 11) The method of claim 11, further comprising denying the observed user access to authorized user data. ### Claim 17 (depends on 11) The method of claim 11, wherein determining the observed user is an impostor is performed implicitly such that the observed user is not required to comply with identity verification. ### Claim 18 (depends on 17) The method of claim 17, further comprising requesting explicit identity verification from the observed user in response to determining the observed user is an impostor. ### Claim 19 (depends on 11) The method of claim 11, wherein the deep learning model is a long short-term memory (LSTM) model. ### Claim 20 A mobile device, comprising: one or more sensors; and an impostor detection module coupled to the one or more sensors and configured to: receive observed behavioral data or environmental data from the one or more sensors; and detect if an impostor is using the mobile device based on a computed difference between a reference prediction error distribution associated with an authorized user and an observed prediction error distribution based on at least one of the observed behavioral data or the environmental data, wherein the impostor detection module further uses a Kolmogorov-Smirnov (KS) test to compare the observed behavioral data or the environmental data to the authorized user behavioral data or environmental data, wherein to perform the KS test, the imposter detection module is configured to: set a window of m reference prediction error values for a reference histogram; sort in ascending order the reference prediction error values in this window; accumulate a number of observed prediction error values that are less than each reference prediction error value in the window for n observed prediction error values; compare reference distributions and observed distributions by subtracting corresponding numbers in the reference histogram and an observed cumulative histogram that is based on the observed prediction error values; determine a maximum absolute value of differences between the reference histogram and the observed cumulative histogram; and compare the maximum absolute value of differences with a pre-computed threshold value to determine if a reference distribution and an observed distributions are the same or different.