Hello and welcome, my name is Florian Lehmann and I am going to present you the work "Heartbeats
in the Wild: A Field Study Exploring ECG Biometrics in Everyday Life".
I have worked on this topic together with my colleague Daniel Buschek.
We are both from the University of Bayreuth.
We have explored whether it's possible to distinguish people based on heart beats. For
this, we ran a field study and recorded the heart activity with a chest belt tracking
device from 20 participants over one complete week.
The technology to do so has already arrived in the consumer market.
For instance, as you can see in the picture, the Apple Watch Series 4 can be used to measure
the ECG. And this is mainly done for health applications.
But pioneering realted work by Biel and colleagues and Kyoso and Uchiyama showed that the ECG
can be used as a biometric. Kyoso and Uchiyama have motivated their work
with an use case in telemedicine where sensitive health data is stored and needs special protection.
This is interesting since the health data can be used to protect itself. For instance,
the electrocardiogram, or short ECG can be used for that.
But how does the ECG look like and which information does it contain?
Here you can see a schema of the heart, it's on the left. On the right you can see an example
of an ECG line graph.
I am gong to describe you briefly how the ECG reflects the heart activity.
A heartbeat starts at the sinoatrial node, short SA node, this is the pacemaker of the
heart. An electrical signal spreads from there and follows the nerve branches which are colored
blue. The signal stimulates the cells and make the muscles contract. First the atria
contract which is reflected by the P wave. Then the ventricles contract, which is reflected
by the QRS complex that is the most prominent part of the ECG. The T wave then indicates
when the heart went back to the default or resting state. After that the complete procedure
kicks of again. You can find more details on that in the paper.
But basically this is the information that can be used to identify a person since it's
specific for each person -- at least to some extend.
Other prior research relied mainly on lab studies or on data from public medical databases.
This is why Singh and Singh called for field studies. And there was already a field study
by Ye and colleagues but only with five participants.
With our study we wanted to fill this gap and investigated the ECG as a biometric in
everyday life. In addition to that we collected touch data and wanted to look at the ECG whether
it can be used to indicate mental stress.
But for this work we concentrated on the ECG biometrics part.
In our study we 20 participants of which where 9 female, and 11 male. The ages ranged from
18 - 34. Overall we collected the data for one week. The field recordings were covered
by two lab sessions.
Here, you can see an overview of the study procedure. You can read it from the left to
right and within sessions from top to bottom. Important parts are highlighted blue. The
ECG recordings started right after the briefing in lab session 1, and ended before the questionnaires
in session 2.
We recorded the ECG for one complete week.
We obtained the signals from the participants with a movisens chest belt tracking device.
The chest belt had dry electrodes embedded and in total we used 9 sensors of which one
was a EcgMove version 4. Both versions are the same according to the manufacturer. The
only difference is in battery life and the version 4 is water resistant. In total we
collected 36GB of raw tracking data.
On that data we ran a pre-processing pipeline this contained basic methods for instance,
downsampling, filtering, R-Peak detection. You will find details on that in the paper,
for now we are going to skip the details and continue directly with the model.
That's the model we used for evaluation. For each p and q in the data which are user and
attacker we trained a classifier. We fed data from the user and rest of the world to it.
An user was labeled as one and the rest of the world as zeros. Attacker data was spared
out from the training data. In the testing phase, we fed data from the user and attacker
to the classifier. They should be recognised as a one or zero. With this model we tested
scenarios.
In scenario 1 which was a random subsampling approach, we ignored the order of cardiac
cycles and days. For training we used 4000 samples for both, user and rest of the world.
For testing we used 1000 samples for both, user and attacker.
In scenario 2 we kept the order of cardiac cycles and days. This might be the more realistic
case. Scenario 2 was divided into three variants. In scenario 2 a we used data only from day
2 for training. Since this was the first complete day of recordings for all participants. In
scenario 2 b and c we shifted the border between enrollment and validation. We subsequently
moved one additional day to the training set which were day 3 and day 4. In scenario 2
a we had to halve training and test sample size since participants had fragmented datasets.
Now, which classifiers did we use for the evaluation?
We used three classifiers for evaluation a random forest classifier, a support vector
machine, and a neural net. With noted parameters you can see on the right.
We optimised features by computing a correlation matrix and used an Extra Tree Classifier.
This way we identified the min, max, and mean of the QR, RS, and QS intervals as the most
promising.
And now, I am going to present you the results.
For evaluation we plotted the true positive rate against the false positive rate. This
way we've got the receiver operating characteristics curve and derived the area under curve from
it. The more the curve sticks to the top left, the better the classification works, and the
area under curve increases.
We also computed the equal error rate. Which signals when the rate of correct and wrong
classifications are the same. The lower the rate is, the better the classification works.
In particular we made decisions on three subequent heartbeats. On the left, you can see the curves
for scenario 1 on the right for scenario 2. Both figures show that the random forest classifier
and the neural net worked better than the support vector machine.
Let's look at the difference between the scenarios in detail.
Here you can see a comparison of the random forest classifier between scenario 1 and 2
a. The equal error rate in scenario 1 is 5.23 percent lower than in scenario 2 a. We contribute
this mainly to the fact that the ECG might differ to some degree from day to day and
from situation to situation. And training from only one day might not reflect this efficiently.
For example, when analysing scenario 2 b and 2 c, we found that taking into account data
from one more day reduces the equal error rate approximately one percent accordingly.
Because of this we suggest, that a real world system should retrain dynamically on a daily
basis. Since the ECG seems to be less permanent.
And now, let's have a look on how it improves with taking into account more decisions.
Taking into account 15 heartbeats for validation, we were able to improve the classification.
The equal error rate dropped by 7.53 percent. We can say making the validation longer can
improve the classification overall.
In comparison to lab studies for example to one bei Choi and colleagues, our system still
needs some improvement. Choi and colleagues reported an almost perfect classification.
But they recorded the data under controlled conditions and most likely had less variation
in data.
We conclude that ECG biometrics work generally in the wild. But not as good as under controlled
conditions.
Now, how do users think about ECG biometrics?
We asked the participant in question1. How much they agree on the comfort of the chest
belt tracker.
And in question2 we asked them how much they agree on wearing an ECG tracking device for ECG biometrics.
The results of Question 1 clearly show, that the chest belt tracker was perceived as neutral.
Other ways to record the ECG might be prefered.
But even more interesting were the answers on question 2.
Over the half disagreed to accept to wear a tracker for ECG biometrics.
We interpret this as an aversion to ECG biometrics.
So what do we suggest for systems using ecg biometrics?
Based on our findings we argue that ECG biometric systems should be trained adaptively on several
days. Otherwise it might lack of variability in data.
The ECG is still less accurate than fingerprints, but could be a promising factor for multi
factor authentication.
And since our signals were quite noisy we see the need to improve how the measurement
is done.
For example a chest belt could provide an array of electrodes. The tracker software
could then decide for the electrodes with the best signal, or compute a mean signal
out of it.
But we don’t want to concentrate only on the technology.
That is why we also present reflections on privacy.
Especially because ECG biometrics work in everyday life, and the technology is already
there. For example with the Apple Watch Series 4, or devices such as the nymi, a wristband
device which captures the fingerprint plus the ECG. This is used mainly for authentication
in enterprise scenarios.
It must be rememberd that the ECG does not only hold information about the identity but
also about the health state.
We think health data is sensitive data, and deserves special protection.
In case of a data breach, your identity and your health state would be leaked to the public.
So, when building an ecg biometric system it should be at least considered where we
want to store and process the data.
We think raw data should not be stored on a backend server.
Instead, features should be computed locally, and data should only be saved for a small
period of time.
We conclude, that it is possible to distinguish people by their heartbeats in everyday life.
We see the need for future studies to go beyond lab studies. And to evaluate ECG biometric
systems in the intended application contexts.
Finally, we think privacy is an important part when designing ECG biometric systems
and should always be done responsibly.
We are happy to share our code.
And refer to the webpage you can see here. You can go to the website by simply scanning
the QR code and you will find more information on how to get access to the code.
Thank you for watching