arXiv subjects

Suprava Saha Dibya

Publications and source records attributed to Suprava Saha Dibya.

3 recordsLinked to original sources

arXiv2026

Deep Learning Based Behavioral Drift Modeling for Continuous Biometric Authentication

This research proposes a two-level keystroke dynamics authentication system that provides defense-in-depth security through continuous behavioral drift monitoring. Level 1 employs fixed-text password authentication using Temporal Convolutional Networks (TCN) with contrastive learning and population-based training (PBT), achieving 3.77% EER for high-security login verification. Upon successful authentication, Level 2 continuously monitors user typing during natural free-text sessions using a 4-Model Deep Learning Ensemble. If suspicious behavioral drift is detected during monitoring, the system re-authenticates the user by returning to Level 1, providing a feedback loop against session hijacking and behavioral anomalies. The system explicitly models long-term behavioral drift through the fixed-text component's PBT mechanism, which adapts to temporal variations in password typing patterns. This research leverages free-text (Buffalo dataset) and fixed-text (GREYC dataset) keystroke dynamics datasets, extracting temporal and spatial features including hold times, up-down latencies, down-down intervals, and trigram patterns. The final system achieves 96%+ accuracy for fixed-text authentication (3.77% EER) and 83.53% True Acceptance Rate (TAR) at 5% False Acceptance Rate (FAR) for free-text continuous authentication (10.05% EER), demonstrating superior performance and strong resistance to impostor attacks through continuous behavioral monitoring.

cs.CR↗

arXiv2026

The 3DS Oracle: BIN Attack via the Network

EMV 3-D Secure (3DS) requires a client-visible continuation boundary in browser-mediated flows; in some deployments, that boundary exposes a pre-authorization classification channel. This paper studies 3DS as a protocol, integration surface, and governance problem, combining standards analysis, architectural reconstruction, formal modeling, a documentation audit, disclosure history, and a bounded live evaluation. We show that client-visible integrations can reflect routing and authentication state before financial authorization, allowing 3DS to function as a profiling and screening channel for issuer controls and cardholder/account state rather than only as a defense. In the tested browser-channel Braintree/Cardinal path, the first client-visible result separated researcher-owned anchor cards from bounded adjacent same-range comparison PANs in six of seven distinct ACS/card-range cohorts; separate public evidence, including openly accessible attacker tooling, rotating-proxy support, and illicit paid 3DS card-testing services, shows that comparable signals are already operationalized in the wild. Our live study was deliberately bounded for ethical reasons, so the empirical ceiling reported here reflects researcher restraint rather than an attacker-side scalability limit, although we do not claim network-wide prevalence or candidate issuance. The deeper issue is systemic: decoupled pre-authorization authentication, weak requestor-boundary assumptions, identifier-linked routing invariants, and fragmented accountability let the exposure persist even when individual actors appear locally conformant. Meaningful remediation therefore requires consortium-level reform, including stricter minimization of client-visible pre-authorization responses, more uniform continuation behavior, and stronger client authenticity and session binding.

cs.CR↗

arXiv2026

Short Paper: Prefix Count Limits Can Increase First-Hit Discovery in Card Reissuance

When a card number is compromised, an attacker may search for active numbers sharing its prefix. An issuer might respond by reissuing cards from heavily populated prefixes into less populated ones. We show that this intuitive count control can backfire. For fixed search regions, exposure weights, and total activity, we derive exactly when reducing the maximum prefix count increases the chance that a budgeted search finds an active number. In matched synthetic simulations over 50,000 candidates, targeted replacement meets the count limit in every run but raises supplied-12-digit-prefix discovery relative to equal-volume random replacement in three of twelve settings. Thus a lower prefix count does not by itself certify lower enumeration risk.

cs.CR↗