Our Approach to Presentation attack detection
At Ingenium, our PAD evaluation process is centered on two critical metrics: the Attack Presentation Classification Error Rate (APCER) and the Bona Fide Presentation Classification Error Rate (BPCER).
- APCER measures how often a system incorrectly classifies an attack as a legitimate user.
- BPCER measures how often a system incorrectly classifies a legitimate user as an attack.
By evaluating both metrics, we gain a comprehensive understanding of a system’s resilience. The goal is to minimise both of these error rates, ensuring a balance between security and user experience. We also consider Failure to Acquire (FTA) errors during our testing.
Attack species sophistication and diversity
Our evaluations use a range of presentation attack species with varying levels of sophistication, aligned with the NIST Strength of Function of Authenticators (SOFA-B) standard. We utilise a range of low, medium and high-level attack species to ensure a thorough assessment.
- Low-level attacks are easy to perform and can be done at a large scale without specialised equipment.
- High-level attacks require significant expertise and effort. While less common, these sophisticated attacks represent a serious threat vector.
The classification of an attack’s sophistication is not static. A high-level attack today could become a medium or low-level threat tomorrow, which is why we continuously update our attack methods.
Our testing can include a variety of attack types, from basic printed photographs to more sophisticated 3D-printed face masks and deepfake videos.
The Presentation Attack Instruments (PAIs) we use are created from a diverse range of individuals, representing different ethnicities, ages, and genders. This ensures our tests are not biased and are representative of our client’s user base.
Ingenium’s 5 levels of presentation attack detection testing
Ingenium offers a five-tiered PAD (Presentation Attack Detection) evaluation process, with each level designed to meet different security needs. Every level includes testing on two client-selected devices, which can be mobile (like Android or iOS), web browsers (like Chrome or Firefox), or specific hardware such as a webcam. To ensure accuracy and reduce the chance of one-off errors, each subject and attack instrument is presented five times during testing.
Level 1:
Our entry-level evaluation focuses on a range of basic and some medium-level attacks. It’s a great starting point for assessing your system’s baseline security. This level involves a total of 1,100 transactions across two devices, testing Level A and B attack species to provide a solid initial assessment.
Level 2:
Building on Level 1, this evaluation expands the scope of testing with a greater volume of attacks. We increase the number of Level B attack instruments to provide a more rigorous test of your system’s defenses.
- APCER Transactions: 1,500
- BPCER Transactions: 100
Level 3:
Level 3 marks a significant increase in the sophistication of our testing. It introduces Level C attack species, including advanced threats like 3D-printed masks and deepfakes. This provides a much more robust evaluation of your system’s resilience against sophisticated attacks.
- APCER Transactions: 1,900
- BPCER Transactions: 250
Level 4:
This level is designed for a truly comprehensive assessment. We increase the volume of both Level B and C attack species, ensuring a thorough evaluation against a wide range of attacks, both simple and complex. This is ideal for systems that require a high level of security assurance.
- APCER Transactions: 2,800
- BPCER Transactions: 250
Level 5:
Our most extensive and rigorous evaluation. Level 5 provides maximum assurance by including the largest volume of presentations and the most diverse set of subjects. This level is designed for systems that demand the highest possible level of security against all known presentation attack types.
- APCER Transactions: 3,200
- BPCER Transactions: 350