{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T20:23:11Z","timestamp":1784924591321,"version":"3.55.0"},"reference-count":48,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2024,1,29]],"date-time":"2024-01-29T00:00:00Z","timestamp":1706486400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Virtual Real."],"abstract":"<jats:p>This study explores the potential privacy risks associated with the use of behavioural data as an identification mechanism in immersive VR applications. With the advent of modern VR technology, tracking sensors are now able to provide a highly immersive experience with a high level of user agency, significantly increasing both the amount and richness of behavioural data being collected and recorded. However, there has been little research into the privacy risks of such approaches. In this work, we investigate the capability of machine learning algorithms to identify VR users across multiple sessions and activities, as well as their effectiveness when users deliberately change their behaviour to evade detection. We also examine how the physical characteristics of users impact the accuracy of these algorithms. Our results show that once a user is tracked in VR, they can be identified with 83% accuracy across multiple sessions of the same activity and with 80% accuracy when performing a different task. Even when users attempt to deliberately obfuscate their behaviour, they can still be recognised with 78% accuracy. These findings highlight the need for more robust technical measures to safeguard the behavioural privacy of VR users.<\/jats:p>","DOI":"10.3389\/frvir.2024.1197547","type":"journal-article","created":{"date-parts":[[2024,1,29]],"date-time":"2024-01-29T11:25:02Z","timestamp":1706527502000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":14,"title":["Privacy threats of behaviour identity detection in VR"],"prefix":"10.3389","volume":"5","author":[{"given":"Dilshani","family":"Kumarapeli","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sungchul","family":"Jung","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Robert W.","family":"Lindeman","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2024,1,29]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"427","DOI":"10.13016\/M2B853K5P","article-title":"Ethics emerging: the story of privacy and security perceptions in virtual reality","author":"Adams","year":"2018","journal-title":"SOUPS@ USENIX Secur. Symp."},{"key":"B2","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1080\/00031305.1992.10475879","article-title":"An introduction to kernel and nearest-neighbor nonparametric regression","volume":"46","author":"Altman","year":"1992","journal-title":"Am. Statistician"},{"key":"B3","doi-asserted-by":"publisher","first-page":"905","DOI":"10.1001\/jamapediatrics.2018.1909","article-title":"Protecting nonverbal data tracked in virtual reality","volume":"172","author":"Bailenson","year":"2018","journal-title":"JAMA Pediatr."},{"key":"B4","doi-asserted-by":"publisher","first-page":"2555","DOI":"10.1109\/tvcg.2021.3067787","article-title":"A privacy-preserving approach to streaming eye-tracking data","volume":"27","author":"David-John","year":"2021","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"B5","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3359626","article-title":"Security and privacy approaches in mixed reality","volume":"52","author":"De Guzman","year":"2020","journal-title":"ACM Comput. Surv."},{"key":"B6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.14763\/2021.4.1610","article-title":"Critical questions for facebook\u2019s virtual reality: data, power and the metaverse","volume":"10","author":"Egliston","year":"2021","journal-title":"Internet Policy Rev."},{"key":"B7","doi-asserted-by":"publisher","first-page":"52","DOI":"10.1109\/MTS.2018.2826060","article-title":"The social metaverse: battle for privacy","volume":"37","author":"Falchuk","year":"2018","journal-title":"IEEE Technol. Soc. Mag."},{"key":"B8","first-page":"2405","article-title":"Poster: reavatar: Virtual reality de-anonymization attack through correlating movement signatures","author":"Falk","year":"2021"},{"key":"B9","doi-asserted-by":"publisher","first-page":"313","DOI":"10.1007\/s10877-013-9436-7","article-title":"Influence of skin type and wavelength on light wave reflectance","volume":"27","author":"Fallow","year":"2013","journal-title":"J. Clin. Monit. Comput."},{"key":"B10","first-page":"1367","article-title":"Transfer learning for time series classification","author":"Fawaz","year":"2018"},{"key":"B11","first-page":"33","article-title":"Sun and skin","volume":"2","author":"Fitzpatrick","year":"1975","journal-title":"J. de Med. Esthetique"},{"key":"B12","unstructured":"Security and privacy in virtual reality\u2013a literature survey\n            GiarettaA.\n          2022"},{"key":"B13","doi-asserted-by":"crossref","DOI":"10.1145\/3411764.3445309","article-title":"Covert embodied choice: decision-making and the limits of privacy under biometric surveillance","author":"Gordon","year":"2021"},{"key":"B14","unstructured":"Making ethical decisions for the immersive web\n            HosfeltD.\n          2019"},{"key":"B15","unstructured":"Privacy implications of eye tracking in mixed reality\n            HosfeltD.\n            ShadowenN.\n          2020"},{"key":"B16","doi-asserted-by":"crossref","first-page":"189","DOI":"10.1007\/978-3-030-81111-2_16","article-title":"A literature review on virtual reality authentication","volume-title":"Human aspects of information security and assurance","author":"Jones","year":"2021"},{"key":"B17","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3287052","article-title":"Cueauth: comparing touch, mid-air gestures, and gaze for cue-based authentication on situated displays","volume":"2","author":"Khamis","year":"2018","journal-title":"Proc. ACM Interact. Mob. Wearable Ubiquitous Technol."},{"key":"B18","doi-asserted-by":"publisher","first-page":"20","DOI":"10.1186\/s42400-019-0038-7","article-title":"Survey of intrusion detection systems: techniques, datasets and challenges","volume":"2","author":"Khraisat","year":"2019","journal-title":"Cybersecurity"},{"key":"B19","volume-title":"Applied predictive modeling","author":"Kuhn","year":"2016"},{"key":"B48","first-page":"861","article-title":"Privacy threats of behaviour identity detection in VR,\u201d in 2023 IEEE conference on virtual reality and 3D user interfaces abstracts and workshops (VRW), Shanghai, China","author":"Kumarapeli","year":"2023"},{"key":"B20","doi-asserted-by":"crossref","first-page":"55","DOI":"10.1007\/978-3-030-05710-7_5","article-title":"Task-driven biometric authentication of users in virtual reality (vr) environments","volume-title":"MultiMedia modeling","author":"Kupin","year":"2019"},{"key":"B21","first-page":"1","article-title":"Whose move is it anyway? authenticating smart wearable devices using unique head movement patterns","author":"Li","year":"2016"},{"key":"B22","doi-asserted-by":"crossref","DOI":"10.1145\/3411764.3445528","article-title":"Understanding user identification in virtual reality through behavioral biometrics and the effect of body normalization","author":"Liebers","year":"2021"},{"key":"B23","doi-asserted-by":"publisher","first-page":"3","DOI":"10.3389\/frobt.2016.00003","article-title":"Real virtuality: a code of ethical conduct. recommendations for good scientific practice and the consumers of vr-technology","volume":"3","author":"Madary","year":"2016","journal-title":"Front. Robotics AI"},{"key":"B24","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3428121","article-title":"Fast and secure authentication in virtual reality using coordinated 3d manipulation and pointing","volume":"28","author":"Mathis","year":"2021","journal-title":"ACM Trans. Computer-Human Interact."},{"key":"B25","doi-asserted-by":"publisher","first-page":"17404","DOI":"10.1038\/s41598-020-74486-y","article-title":"Personal identifiability of user tracking data during observation of 360-degree VR video","volume":"10","author":"Miller","year":"2020","journal-title":"Sci. Rep."},{"key":"B26","first-page":"140","article-title":"Using siamese neural networks to perform cross-system behavioral authentication in virtual reality","author":"Miller","year":"2021"},{"key":"B27","first-page":"409","article-title":"Combining real-world constraints on user behavior with deep neural networks for virtual reality (vr) biometrics","author":"Miller","year":""},{"key":"B28","first-page":"684","article-title":"Using external video to attack behavior-based security mechanisms in virtual reality (vr)","author":"Miller","year":""},{"key":"B29","first-page":"23","article-title":"Unsure how to authenticate on your vr headset? come on, use your head","author":"Mustafa","year":"2018"},{"key":"B30","unstructured":"Exploring the unprecedented privacy risks of the metaverse\n            NairV.\n            GarridoG. M.\n            SongD."},{"key":"B31","unstructured":"Going incognito in the metaverse\n            NairV.\n            GarridoG. M.\n            SongD."},{"key":"B32","doi-asserted-by":"publisher","first-page":"256","DOI":"10.3156\/jsoft.19.256","article-title":"Multi-factor authentication using spectral biometrics","volume":"19","author":"Pishva","year":"2007","journal-title":"J. Jpn. Soc. Fuzzy Theory Intelligent Inf."},{"key":"B33","doi-asserted-by":"publisher","first-page":"383","DOI":"10.2307\/3478805","article-title":"Privacy","volume":"48","author":"Prosser","year":"1960","journal-title":"Calif. Law Rev."},{"key":"B34","doi-asserted-by":"publisher","first-page":"81","DOI":"10.1007\/BF00116251","article-title":"Induction of decision trees","volume":"1","author":"Quinlan","year":"1986","journal-title":"Mach. Learn."},{"key":"B35","first-page":"38","article-title":"Effective classification of head motion trajectories in virtual reality using time-series methods","author":"Quintero","year":"2021"},{"key":"B36","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1109\/MCE.2019.2953741","article-title":"Tracking attacks on virtual reality systems","volume":"9","author":"Rafique","year":"2020","journal-title":"IEEE Consum. Electron. Mag."},{"key":"B37","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1186\/1687-417X-2011-3","article-title":"A survey on biometric cryptosystems and cancelable biometrics","volume":"2011","author":"Rathgeb","year":"2011","journal-title":"EURASIP J. Inf. Secur."},{"key":"B38","doi-asserted-by":"crossref","DOI":"10.1002\/9780470997949","volume-title":"Behavioral biometrics: a remote access approach","author":"Revett","year":"2008"},{"key":"B39","first-page":"143","article-title":"An approach for user identification for head-mounted displays","author":"Rogers","year":"2015"},{"key":"B40","first-page":"447","volume-title":"Self-sovereign identity systems","author":"Satybaldy","year":"2020"},{"key":"B41","doi-asserted-by":"publisher","first-page":"85","DOI":"10.1016\/j.neunet.2014.09.003","article-title":"Deep learning in neural networks: an overview","volume":"61","author":"Schmidhuber","year":"2015","journal-title":"Neural Netw."},{"key":"B42","unstructured":"Addressing the privacy implications of mixed reality: a regulatory approach\n            ShadowenN.\n            HosfeltD.\n          2020"},{"key":"B43","doi-asserted-by":"publisher","first-page":"484","DOI":"10.1109\/TDSC.2018.2800048","article-title":"Gaitlock: protect virtual and augmented reality headsets using gait","volume":"16","author":"Shen","year":"2019","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"B44","article-title":"\u2018i\u2019ve got nothing to hide\u2019 and other misunderstandings of privacy","volume":"44","author":"Solove","year":"2007","journal-title":"San. Diego Law Rev."},{"key":"B45","doi-asserted-by":"crossref","DOI":"10.1145\/3411763.3451769","article-title":"Nod to auth: fluent ar\/vr authentication with user head-neck modeling","author":"Wang","year":"2021"},{"key":"B46","doi-asserted-by":"publisher","first-page":"103845","DOI":"10.1016\/j.jesp.2019.103845","article-title":"Tracing physical behavior in virtual reality: a narrative review of applications to social psychology","volume":"85","author":"Yaremych","year":"2019","journal-title":"J. Exp. Soc. Psychol."},{"key":"B47","first-page":"458","article-title":"An exploration of useable authentication mechanisms for virtual reality systems","author":"Yu","year":"2016"}],"container-title":["Frontiers in Virtual Reality"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frvir.2024.1197547\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,29]],"date-time":"2024-01-29T11:25:16Z","timestamp":1706527516000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frvir.2024.1197547\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1,29]]},"references-count":48,"alternative-id":["10.3389\/frvir.2024.1197547"],"URL":"https:\/\/doi.org\/10.3389\/frvir.2024.1197547","relation":{},"ISSN":["2673-4192"],"issn-type":[{"value":"2673-4192","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1,29]]},"article-number":"1197547"}}