 I don't know what to say. I come from Norway and this is a lot of people. So I'm coming all the way from Norway to bring you a touch of pink for you. I just completed my master thesis at NUTS. That's the Norwegian University of Technology and Science. The administration have just kind of switched it to last letters because someone created a lot of t-shirts. Yeah, so I work at a company called ITERA and I'm a developer, full-time developer. So let's get started. At first everybody probably knows that humans are predictable and that's when you talk about security, that's kind of not a good thing. So when you look at the different locking mechanism on mobile devices you're probably seeing all of them. You probably know the common strategies for selecting both pin codes and pass codes using date of birth, names, etc. But the different thing with the Android lock pattern is that it does not have a semantic meaning. It's only dots and you cannot kind of use the same strategies as when using a pin code and a password. So just to give a recap, you know with pin codes there are 10,000 combinations. How many pin codes or patterns does the Android unlock pattern have? That's a pretty bigger number than the pin code. And the interesting thing is, yeah, the numbers for you. When you're going to, yeah, sorry. When I started this project, I've started to think about how people created their pin codes and the passwords. As I said, using names and date of birth and such. But the Android catalog, you can't use their things. So what can you do to predict people's patterns? So I started by creating a survey for collecting data. I collected about 3,400 user selected patterns and additional data about the patterns or the user that created the patterns. So I asked all the people that participated to create a pattern for a shopping account, a smart phone and a banking account just to give the patterns a kind of a context. Just wanted to, if you look at it, you can probably guess I just think it was kind of funny. Because the people that I used the ALP, that's the dark color and the light color is the people that have not used the ALP before. As you can see, the numbers, that's the reaction time. How fast the respondents were creating the patterns. And as you can see for the smart phone, people that have created the patterns have used the pattern like before, very responding very quickly. You can kind of guess what's, why they were actually giving the patterns so predictable. So what factors can you look at when you're going to predict someone's pattern? For instance, you have two hands. You might be even right or left handed. You have a reading and writing direction. And your phone has a screen size. There is a difference in gender and age. First, I want to say something about the visual complexity because the pattern lock is not the same as any other pattern lock or any other pin code because it's visual. Meaning that you cannot just judge a pin or a pattern lock based on the number of connected nodes. So I used a mathematical formula for kind of giving each pattern a score. Just how visual complex is the pattern. I'm going to give you an example. So the two upper, the blue ones, both are of length 9. But if you're standing behind someone's back, you will probably be easily be guessing the first one. But the second one is more complex, but it's still the same number of connected dots. So what I spotted with the complexity score is that actually the patterns created for this smartphone was the lowest score because I asked the participant to create three different patterns. And nobody that participated there was about 850 people participating in the study and nobody managed to create a pattern of the maximum score. I was kind of thinking that people would take it as a challenge when I gave the survey and people would kind of try to create the most complex pattern they knew about, but nobody managed. So that's kind of the same as with passwords and pin codes. People are not able to remember or create complex patterns or passwords. One of the things that I told you about was that the pattern, you cannot use names and date of birth, for example. But when I started collecting the patterns, people were coming up to me and told me that, you know, my mom used her first letter in her name as a pin code. And I was like, oh, okay. So I went through all the collected patterns. That was kind of possible to form or corresponding to a letter in the alphabet. And it was kind of interesting that 10.4% of the data set were corresponding to a letter from the alphabet. That's one in the same patterns. One in ten. If you pick up a phone, one in ten would probably have a pattern corresponding to a letter. And that was kind of interesting. One of the things with the Android pattern lock is that you can only select one note once. Meaning that if you knew the starting point, for example, you can reduce the number of patterns, the possible patterns. Just give you some seconds to look at that. So in the data set, 44% of all the pattern were starting in the upper left corner. And if you kind of look at all the green ones, that's the three corners, you get a 73%. And if you combine all the corners, there is a 77% chance of a pattern starting in one of the corner. How predictable. But if you look at everyone in the room, there is only about 10% of you that's likely to be left-handed. And 90% of you will probably be right-handed. So I was thinking that because I look at there is probably two main ways of creating a pattern on the screen. You're probably seeing either using one hand or two hands. So if you use one hand, you will probably use your thumb to create a pattern. Or if you use two hands, you'll probably use the forefinger to interact with the screen. So if I was, for instance, left-handed, 10% of the population, would it be the same? Would I start in the same corner? So kind of if I was holding a left-handed person phone with the pattern starting in the other corner on the other side. So for the right-handed, the two pictures are the likely starting point for either holding with one hand and two hand and being right-handed. And the number looks pretty similar to the number I showed you in the other for all the patterns. When looking at left-handed, I was kind of disappointed because the numbers I was predicting in the first place. So I was like, why? So either left-handed or right-handed, using one hand, using two hands, either way, people start on the left-hand side and particularly up in the upper left corner. And I was like, at first I didn't understand why, but then I was thinking about the reading and writing direction because research have found that if you give a person a set of images, if you read from left to right, you will probably be scanning the pictures from left to right, so remembering the pictures from left to right. But if you had the test, also tested this on people having another reading and writing direction. So if reading from right to left, having, for example, an Arabic background, the people started scanning the pictures from right to left. So unfortunately, I didn't get a lot of Arabic or other people having another reading and writing direction, but I still have a strong belief that if I knew the reading and writing direction, it would correspond to where you start to create a pattern. So I will not give you all kind of a list of, this is the top ten patterns and how, yeah, it is more interesting to look at how people behave and where you kind of select or create your patterns. So these are what is called a three gram. That's a set of three connected nodes. And as you can see in the blue one, that's the most commonly selected three grams, meaning that people actually create the patterns sticking to the edge. And it's kind of hard to show here at this view, but lines such as you probably know that you can go from the upper left corner to the bottom. Such patterns or lines are not, there are really few of the patterns having a line crossing from the upper left to the bottom, the middle of the bottom. The lines are straight and are connected to the next node next to the, so it's also funny to look at the length of a pattern. So I also collected the gender of the partisan pens. And I don't know if it's just you male participants preferring length or a woman being less, thinking less about security. I don't know. So just to show, just not to just generate an average length, there is a distribution of the length selected. And the upper graph on the top is for male. And the bottom is for female. And as you can see, the bottom graph has a higher percentage of selected patterns of lower lengths. And one funny observation is that you see the patterns of length eight. There is really few patterns of length eight. In the data set, there was kind of four, on average four percent of the patterns had a length eight. I should barely show the calculation of how many patterns had of the different lengths. But there's actually 140,000 patterns starting with the length eight. And as well, when looking at the age of the participants, there were, the younger the person were, the stronger pattern were created for all the three different patterns. So for both the shopping, the mobile phone and the banking account, the younger the participant were, the stronger patterns. So by using this, this is kind of a brief introduction to all the results that was found. But I hope in the future to kind of use the data to as far as I have now, there's a build, for example, a Marco model, because I only have 3400 patterns, but there's 389,000 patterns. And how can we be able to predict every pattern if I don't have the pattern in my data set? So by using, there is already, I already have a Marco model kind of predicting that I've been developed by a German researcher that can predict the likelihood of a pattern being selected based on the three grams that I showed you. So using the predictable ways of creating a pattern, a likelihood of selecting a pattern can be estimated. And in the future, to use this information that I have to reduce the number of patterns, to be able to add the information about the creators to see if we can kind of get a better model of being able to predict a pattern based on the person or who the person are. So for now, there is about two or three minutes left. So I might be able to take a couple of questions before I leave. I will stand here next to the scene if someone want to come and talk and ask questions. Thank you.