A novel spoofing attack against electroencephalogram-based security systems

Security systems using brain signals or Electroencephalogram (EEG), attempt to exploit chaotic nature of brain signals and their individuality to derive security primitives that are hard to reproduce. In this sense, the signal features are extracted to train a Machine Learning (ML) algorithm for classification. However, although brain signals are chaotic, feature extraction process might reduce the chaos rendering features in a way that they can be generated. Besides, even if features are chaotic, ML techniques might classify them in such a manner that an element in a particular class becomes easy to generate. In this paper, we perform entropy analysis on common features used in EEG-based security systems to estimate their information content, which is used to propose a novel technique for EEG signal generation in feature domain instead of time domain. These generated signals can potentially be used for spoofing attacks. We consider five types of feature extraction techniques and six classifiers found in recently proposed security systems, and analyze their vulnerability to spoofing attacks using generated EEG signals. The results show that the generation scheme can synthesize artificial signals to get classified as genuine brain signals by ML algorithms.