Fingerprint traits are widely recognized for their unique qualities and security benefits. Despite their extensive use, fingerprint features can be vulnerable to puppet attacks, where attackers manipulate a reluctant but genuine user into completing the authentication process. Defending against such attacks is challenging due to the coexistence of a legitimate identity and an illegitimate intent. In this paper, we propose PUPGUARD, a solution designed to guard against puppet attacks. This method is based on user behavioral patterns, specifically, the user needs to press the capture device twice successively with different fingers during the authentication process. PUPGUARD leverages both the image features of fingerprints and the timing characteristics of the pressing intervals to establish two-factor authentication. More specifically, after extracting image features and timing characteristics, and performing feature selection on the image features, PUPGUARD fuses these two features into a one-dimensional feature vector, and feeds it into a one-class classifier to obtain the classification result. This two-factor authentication method emphasizes dynamic behavioral patterns during the authentication process, thereby enhancing security against puppet attacks. To assess PUPGUARD's effectiveness, we conducted experiments on datasets collected from 31 subjects, including image features and timing characteristics. Our experimental results demonstrate that PUPGUARD achieves an impressive accuracy rate of 97.87% and a remarkably low false positive rate (FPR) of 1.89%. Furthermore, we conducted comparative experiments to validate the superiority of combining image features and timing characteristics within PUPGUARD for enhancing resistance against puppet attacks.

翻译：指纹特征因其独特性和安全性优势而被广泛认可。尽管应用广泛，指纹特征仍易受到傀儡攻击的威胁——攻击者通过胁迫真实用户完成认证流程以实施攻击。由于合法身份与非法意图的并存特性，抵御此类攻击极具挑战性。本文提出PUPGUARD解决方案，旨在防御傀儡攻击。该方法基于用户行为模式，要求用户在认证过程中依次用不同手指按压采集设备两次。PUPGUARD通过融合指纹图像特征与按压间隔时序特征，构建双因素认证机制。具体而言，在提取图像特征与时序特征并对图像特征进行特征选择后，PUPGUARD将两类特征融合为一维特征向量，输入单类分类器获得分类结果。该双因素认证方法强调认证过程中的动态行为模式，从而增强对傀儡攻击的防御能力。为评估PUPGUARD的有效性，我们基于31名受试者采集的数据集（包含图像特征与时序特征）开展实验。实验结果表明，PUPGUARD达到了97.87%的准确率，同时将误报率(FPR)控制在1.89%的极低水平。此外，我们通过对比实验验证了PUPGUARD融合图像特征与时序特征在增强傀儡攻击防御能力方面的优越性。