An Automated Attendance System in Academia with Implicit Authentication via Mobile Devices and Wi-Fi Connection

— Many automated attendance systems have been proposed in acad emia. However, all of them require the attendees to consciously record their attendance. This is prone to human error as some attendees may forget to do that. It is also distractive as the recording process should be remembered by the at-tendees, in addition to focusing on their main responsibilities. This paper proposes an automated attendance system with implicit authentication, based on the connection between the attendees' mobile devices and the Wi-Fi network. Our evaluation shows that this system is almost 100\% accurate in recording staff attendance. It is applicable due to many factors. For example, many attendees often bring their mobile devices and connect the devices to the Wi-Fi.


Introduction
Academic attendance can be useful for administrational purpose as a part of the university's responsibilities [1]. It can also be beneficial to foresee possible issues. Students who seldom attend the classes are unlikely to get high marks [2], [3]. The attendance of lecturers (as university employees) can have an impact to their own well-beings [4]. Tutoring sessions in which the tutors are not fully available during the whole sessions can mitigate the impact of tutoring. Late academic staff attendance can lead to unsatisfied customers.
Sign-in-sheet is one of conventional practices for recording academic attendance; each person (i.e., student, lecturer, tutor, or staff) is required to write down their attendance in a sheet and then sign it [5]. This is argued to have several drawbacks, especially when applied in recording student attendance in a classroom [6]; it is time-inefficient, labor-intensive, prone to human error, and distractive for the main task at hand.
Many automated attendance-recording systems have been proposed. However, most of them require additional devices (or tokens) to rely on, such as RFID reader [7] or NFC reader [8]. Such requirement can be cost-inefficient, especially in developing countries where these devices are likely to be expensive due to weak currency.
To cope with that, few attendance-recording systems rely purely on existing devices, such as the attendees' mobile devices. [6], [9]. Nevertheless, this is still prone to human error in a sense that the attendees can forget to record their attendance. It is also still distractive to the main task at hand as the attendees need to remember recording their attendance per occasion.
This paper proposes an academic attendance recording system that records the attendance automatically when the attendee is in the designated university area (e.g., classrooms or the whole university). It is cost-efficient as it only relies on MAC addresses of the attendees' mobile devices and Wi-Fi connection (that is commonly provided in many universities). If required, the attendees can request a correction to the administrator to assure that the data reflects their attendance accurately. To the best of our knowledge, this is the first of its type.
We are aware that unlike biometric-based attendance systems -e.g., those with face recognition [10], [11] or voice recognition [12], [13], our system is more prone to bogus attendance. However, we believe mobile devices are often used privately and such attendance issue is unlikely to happen.

Related Works
In general, automated attendance systems can be classified to two categories based on their verification process: biometric-based and non-biometric-based.
Biometric-based attendance systems rely on human biological data as the ID, assuming that data is unique per person. Fingerprint is the most frequently used one [14]- [16]. A fingerprint reader is put in the target location and each attendee is required to scan his/her finger(s) upon arrival and prior leaving the location. Some systems rely on voiceprint instead of fingerprint [12], [17]. The attendance is recorded similarly as the fingerprint-based ones except that each attendee should mention a particular word or phrase in front of voice recorder.
Human faces are argued to be unique and can be considered as an ID. This leads to a growing number of attendance systems with such an ID on board. Some of them automatically recognize the attendees [11], [18]- [20], while the others ask the attendees to select their faces [6]. The former requires less human intervention while the latter aims for higher accuracy (knowing that the systems can misrecognize the faces).
Non-biometric-based systems rely on additional tokens (e.g., RFID and NFC) for verification. A study in [21], [22] utilizes the attendees' mobile devices to scan a particular barcode for recording the attendance. A study in [23] captures the attendees' photos and therefore asks them to sign the photos. Studies in [24] and [25] uses BLE (Bluetooth Low Energy) to send a magic number for each attendee to prevent bogus attendance. This is partly followed by a study in [26] that uses BLE beacon for detecting the location. Studies in [27]- [30] rely on RFID tags.
Compared to the counterpart, non-biometric-based systems are arguably more practical as the attendees are not required to register their biological data before using the systems. They are also more secure as the biological data is credential and can be easily misused. But they are more prone to bogus attendance; the tokens can be illegally brought by unauthorized people.
Regardless of the verification mechanism, existing attendance systems cannot record the attendance if the attendees forget to initialize the recording process; the systems are still prone to human error. The recording process can also be distractive in a sense that the attendees should remember to do the process in addition to focusing on their main responsibilities.

Methods
In response to the aforementioned gap, this paper proposes an attendance system in academia, in which the recording process is performed implicitly (without human initialization). The system relies on MAC addresses of the attendees' mobile devices and Wi-Fi connection. Per attendee, each time the mobile device connects to the Wi-Fi, the MAC address will be identified by the router and recorded periodically for attendance; the earliest record will be considered as the arrival time while the latest one will be considered as the leaving time. We are aware that connecting the mobile device to the Wi-Fi can be considered as human initialization. However, as many mobile devices try to connect to an available Wi-Fi network by default, it can be done automatically.
Considering the attendees will be identified based on their MAC addresses, such data pairs should be accessible by the router. The data pairs can be collected by asking the attendees to either contact an administrator or install our mobile application that will self-register the MAC address. In return to their willingness of giving the data, free internet access can be provided.
As the attendance is recorded implicitly without human initialization, it is possible that some of the data are incorrectly recorded. For that purpose, a web application is also required for the attendees to request a correction. However, to keep the validity of the data, the correction will only be applied if it is approved by an administrator.
The system is implemented in our faculty's computer laboratories for recording staff attendance. The staff are expected to work around the laboratories and if they leave that area, it is assumed that their working schedule is over.
We use MikroTik RouterOS [31] as the Wi-Fi router, where a script for recording the attendance is executed periodically every second. That script enlists the MAC addresses of any connected devices, maps them to the attendees, and stores them to the database. At the end of each day, another script checks the earliest and the latest records per attendee and mark them as their arrival and leaving time, respectively.
The network topology can be seen in Fig. 1 with 14 rooms in total. Each room has its own access point, but all access points share the same SSID. This makes the Wi-Fi connection equally accessible from any rooms. The Internet Proxy router also enlists the connected devices for validity. In the demilitarized zone (isolated private network), web server fetches the data and stores it on the database. A switch device connecting the router with the web server is only required to connect those two on data link layer (OSI layer 2).

Evaluation
This section evaluates the impact of our proposed attendance system with accuracy and user behavior as the metrics. The evaluation scenario will be discussed first and then followed by the findings.

Evaluation scenario
Our proposed attendance system was evaluated based on two criteria: accuracy and user behavior. The former was measured by revalidating the recorded attendance data toward staff working schedule created by the head of the laboratories for about 7-month period (26th April to 11th November 2019). Twenty-six staff members were considered in this study with 596,520 records in total.
The latter was measured by performing a questionnaire survey toward the staff members upon the 7-month period. Each question should be answered in 5-point scale; the details of these questions can be seen in Table 1.

ID
Survey Statement Q1 Before using the system, how often did you forget to fill out the attendance sheet for manual recording? (1 = always forget and 5 = never forget) Q2 How often do you bring your smartphone to work? (1 = never and 5 = always) Q3 How often do you connect to the Wi-Fi while at work? (1 = never and 5 = always) Q4 Do you agree if the manual attendance system is replaced with the proposed one? (1 = strongly disagree and 5 = strongly agree) Fig. 2 shows that the attendance data of twenty-one staff members cover their working hours (equal to or higher than 100%).

Findings
The extra time is expected as commonly, the working staff members are still around the laboratories despite their working schedule is over. This is not an issue as our main concern is to assure that the staff members are available during their working period.

Fig. 2. The proportion of working hours covered by captured attendance data
Five staff members only have their working hours partially covered. However, the coverage is considerably high (around 99%). The staff members may occasionally forget to set their mobile device to automatically connect to the Wi-Fi network, leading them to initiate such a connection manually. The survey result can be seen in Fig. 3. For Q1, it is clear that 17 of 26 staff members feel that they occasionally forget to fill out the attendance sheet in sign-in-sheet, a conventional practice that was originally used for recording staff attendance. This strengthens the need of our system as the attendance can be implicitly recorded without human initialization.
Our system is applicable for recording staff attendance as all staff members often bring their mobile devices to work (Q2). However, around half of them do not believe that they often connect their mobile devices to the Wi-Fi connection (Q3) ---even though they did, as their working hours are mostly covered by the system according to our accuracy evaluation.
When we asked whether the proposed system can replace sign-in-sheet attendance recording in Q4, 21 of 26 staff members agree with it. This means that our proposed system is preferred.

Conclusion and Future Work
This paper proposes an automated attendance system with implicit authentication using mobile devices and Wi-Fi connection. Each time an attendee's mobile device is connected to the Wi-Fi, the MAC address will be recorded periodically, earliest one will be considered as the arrival time while the latest one will be considered as the leaving time.
According to our evaluation for staff attendance, this system is almost 100\% accurate. It is applicable as many attendees occasionally forget to record their attendance manually, but they often bring their mobile devices and connect the devices to the Wi-Fi. The system is responded positively by the attendees to replace manual attendance recording (i.e., sign-in-sheet in our case).
In the future, we plan to apply the proposed attendance system to other case studies such as lecturer attendance or student attendance. After that, a meta study can be carried out to empirically highlight the benefits and the drawbacks of our attendance system.