CAPTCHA Scheme Research Articles

Adversarial Captcha

CAPTCHAs, tests to separate humans from machines, serve as a method to verify whether an interaction is being performed by a human or a computer, were developed in reaction to the vulnerability of computer networks to intrusions by programmers using bots and computer attack programs. The most popular Captcha scheme is the Text Captcha because of how simple it is to create and use. However, the presumed security of Captchas has been undermined by hackers and programmers, making websites open to attack.Given that attack speeds are generally moderate, usually ranging from two to five seconds per image and that this is not a serious worry, text captchas are nevertheless extensively utilized. This study proposes a novel image-based Captcha called Style Area Captcha (SACaptcha), which is built on deep learning techniques, pixel-level segmentation, and semantic data understanding.The proposed SACaptcha emphasises using deep learning to create neural networks neural networks image-based Captchas. Acquiring methods to enhance security and captcha systems are all covered in this paper.It compares the proving that text-based Captchas are insecure. Key words: deep, text-based, security, and captcha Convolutional image-based learning

Evaluating the security of CAPTCHAs utilized on Bangladeshi websites

A number of attacks such as spamming, email-address harvesting, dictionary attacks, brute-force attacks, credential surfing attacks, DOS attacks and others can be executed relatively easily if the target system cannot differentiate between requests coming from a real human user and those generated artificially by bots. In order to distinguish between human users and bots, the Completely Automatic Public Turing Test (CAPTCHA) has been used for almost 20 years. Nevertheless, CAPTCHA can be easily broken if it lacks security features. Consequently, the motivation for utilizing CAPTCHA is undermined. This article proposes a framework that can evaluate the security aspects of text CAPTCHAs. The effectiveness of the framework is validated by using a generalized attack method consisting of pre-processing and utilizing an Optical Character Recognition (OCR) library such as Tesseract OCR. We have carried out a systematic study of existing CAPTCHAs utilized on Bangladeshi websites. We have studied 238 Bangladeshi websites and found that only 44 websites used a CAPTCHA mechanism. Then, we have assessed the security levels of the selected text CAPTCHAs by the proposed framework. As per our analysis, we have found that there are 29 different CAPTCHA schemes being adopted on Bangladeshi websites and among them 23 are vulnerable to automated attacks. In order to address these issues, we also present a number of recommendations.

Decoding the animated text-based captchas to verify their robustness against automated attacks

In order to protect the web against automated attacks, CAPTCHAs are most widely used mechanism on the internet. Numerous types of CAPTCHAs are introduced due to weaknesses in the earlier designs. Animated CAPTCHAs are one of the design alternatives. Instead of presenting the whole information at once, animated CAPTCHAs present information in various frames over the specific interval of time. As CATPCHAs are ubiquitously used to avoid the serious threats from bots therefore it is important to verify their effectiveness. In this research we have verified their robustness against machine learning attacks. It has been proved that adding the extra time dimension does not necessarily ensure protection against automated attacks. We have attacked the Hello CAPTCHA scheme, which is the most popular animated CAPTCHA scheme available on the internet. By applying novel image processing and machine learning techniques, these CAPTCHAs are decoded with high precision. A pre-trained CNN is used to recognize the extracted characters. In this research, 6 popular types of animated CAPTCHAs along with 41 sub types were successfully deciphered with an overall precision of up to 99.5 %.

The Design and Evaluation of Novel Ananimated CAPTCHA Schemes Based on Humans’ Natural Vision Capabilities

The Design and Evaluation of Novel Ananimated CAPTCHA Schemes Based on Humans’ Natural Vision Capabilities

An Experimental Investigation of Text-based CAPTCHA Attacks and Their Robustness

Text-based CAPTCHA has become one of the most popular methods for preventing bot attacks. With the rapid development of deep learning techniques, many new methods to break text-based CAPTCHAs have been developed in recent years. However, a holistic and uniform investigation and comparison of these attacks’ effects is lacking due to inconsistent choices of model structures, training datasets, and evaluation metrics. In this article, we perform an experimental investigation on the effects of existing attacks on text-based CAPTCHA schemes. We first summarize existing text-based CAPTCHAs using a newly proposed taxonomy based on their resistance mechanisms and systematically review corresponding attacks in terms of methods and pros/cons. Then, we introduce a unified attack framework that contains a number of different attack modules and transfer learning strategies. Applying this framework, we extensively evaluate the performance of known attacks on 20 CAPTCHA schemes in terms of accuracy and efficiency; then, we investigate the robustness of these widely used schemes and discover the effects of previously unexplored attacks. Finally, we discuss future CAPTCHA designs based on our experimental results and findings. Our work also contributes to the CAPTCHA community by offering an open-access dataset that contains 22 different CAPTCHA sample sets.

Recent advances of Captcha security analysis: a short literature review

CAPTCHA has long been used to keep bots from misusing web services. Various CAPTCHA schemes have been proposed over the years, principally to increase usability and security against emerging bots and hackers performing malicious operations. However, automated attacks have effectively cracked all common conventional schemes, and the majority of present CAPTCHA methods are also vulnerable to human-assisted relay attacks. Invisible reCAPTCHA and some approaches have not yet been cracked. However, with the introduction of fourth generation bots accurately mimicking human behavior, a secure CAPTCHA would be hardly designed without additional special devices. In this paper, we presented a short literature review of the current CAPTCHA schemes, as well as highlighting new trends and open issues, the challenges, and the opportunities as a solid starting point for designing the future secure and usable CAPTCHA schemes.

De-CAPTCHA: A novel DFS based approach to solve CAPTCHA schemes

CAPTCHA stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart. CAPTCHAs are used as security mechanism in web applications to differentiate between real users and automated users, also known as bots. Text-based CAPTCHAs are the popularly used CAPTCHA schemes due to their simplicity and thus, they are still being used despite the proposal of several attack mechanisms. In this work, the authors have proposed a novel approach to solve CAPTCHA schemes. In this approach, the authors have used Depth First Search algorithm for the extraction of characters from CAPTCHAs and Convolutional Neural Network for recognizing these extracted characters. The proposed approach was validated on 3000+ CAPTCHA schemes and proved to be efficient by providing an average accuracy of more than 92.0% in detecting CAPTCHA schemes.

UNI-CAPTCHA: A Novel Robust and Dynamic User-Non-Interaction CAPTCHA Model Based on Hybrid biLSTM+Softmax

The security of web applications is protected by firewalls, intrusion detection systems or deep learning-based approaches. Although existing systems perform rules and content-based filtering, they can be bypassed with payloads and advanced bots in different scenarios. CAPTCHA is preferred to prevent bots in web applications to minimize possible risks. Although captcha applications make bot-user distinction, it can be solved with software-based systems. In addition, increasing the difficulty level of CAPTCHA schemes have bringing usage difficulties.In this study, a robust behavior-based CAPTCHA (UNI-CAPTCHA) was developed that detects user-bot without interaction with user. A web application with a landing page, login page, and register page has been developed for UNI-CAPTCHA to learn user and bot behavior. The application was tested with 16 different vulnerability tool bots and real users, creating a unique dataset containing 13 different behaviors. A risk rating was made using the k-Means++ algorithm based on characteristics of user behavior in the dataset. The trained hybrid bi-LSTM + Softmax based UNI-CAPTCHA engine intuitively performs user-bot labeling of requests from the web application simultaneously. It also determines the risk rating of user labels from 1 to 5. The threshold user value (εt) for high protection is determined in the evaluation, and results below εt, its value is evaluated as bot behavior and prevented. In UNI-Captcha, the threshold value of suspicious user behavior is adjusted according to the in-app security risk level. Analysis shows that the UNI-CAPTCHA engine shows better stability, speed, and detection than traditional bot detection and CAPTCHA applications.

Designing Image Based Captcha using Machine Learning

Captchas, or Completely Automated Public Turing Tests to Tell Computers and Humans Apart, were created in response to programmers' ability to breach computer networks via computer attack programmes and bots. Because of its ease of development and use, the Text Captcha is the most well-known Captcha scheme. Hackers and programmers, on the other hand, have weakened the assumed security of Captchas, leaving websites vulnerable to assault. Text Captchas are still widely used since it is assumed that the attack speeds are moderate, typically two to five seconds for each image, and that this is not considered a significant concern. Style Area Captcha (SACaptcha) is a revolutionary image-based Captcha suggested in this paper, which relies on semantic data comprehension, pixel-level segmentation, and deep learning approaches. The suggested SACaptcha highlights the creation of image-based Captchas utilising deep learning techniques for boosting the security purpose, demonstrating that text Captchas are no longer secure.

Semi-supervised deep learning approach to break common CAPTCHAs

Manual data annotation is a time consuming activity. A novel strategy for automatic training of the CAPTCHA breaking system with no manual dataset creation is presented in this paper. We demonstrate the feasibility of the attack against a text-based CAPTCHA scheme utilizing similar network infrastructure used for Denial of Service attacks. The main goal of our research is to present a possible vulnerability in CAPTCHA systems when combining the brute-force attack with transfer learning. The classification step utilizes a simple convolutional neural network with 15 layers. Training stage uses automatically prepared dataset created without any human intervention and transfer learning for fine-tuning the deep neural network classifier. The designed system for breaking text-based CAPTCHAs achieved 80% classification accuracy after 6 fine-tuning steps for a 5 digit text-based CAPTCHA system. The results presented in this paper suggest, that even the simple attack with a large number of attacking computers can be an effective alternative to current CAPTCHA breaking systems.

Position-Encoding Convolutional Network to Solving Connected Text Captcha

Abstract Text-based CAPTCHA is a convenient and effective safety mechanism that has been widely deployed across websites. The efficient end-to-end models of scene text recognition consisting of CNN and attention-based RNN show limited performance in solving text-based CAPTCHAs. In contrast with the street view image and document, the character sequence in CAPTCHA is non-semantic. The RNN loses its ability to learn the semantic context and only implicitly encodes the relative position of extracted features. Meanwhile, the security features, which prevent characters from segmentation and recognition, extensively increase the complexity of CAPTCHAs. The performance of this model is sensitive to different CAPTCHA schemes. In this paper, we analyze the properties of the text-based CAPTCHA and accordingly consider solving it as a highly position-relative character sequence recognition task. We propose a network named PosConv to leverage the position information in the character sequence without RNN. PosConv uses a novel padding strategy and modified convolution, explicitly encoding the relative position into the local features of characters. This mechanism of PosConv makes the extracted features from CAPTCHAs more informative and robust. We validate PosConv on six text-based CAPTCHA schemes, and it achieves state-of-the-art or competitive recognition accuracy with significantly fewer parameters and faster convergence speed.

Interactive Handwritten and Text-Based Handwritten Arabic CAPTCHA Schemes for Mobile Devices: A Comparative Study

CAPTCHA tests (Completely Automated Public Turing test to tell Computer and Humans Apart) are used by many services and websites. Recently, researchers have proposed interactive handwritten and text-based handwritten Arabic CAPTCHA schemes. The former scheme presents a handwritten CAPTCHA image, then requests users to select the joints between Arabic letters. In the latter scheme, a new generator of Arabic handwritten CAPTCHA images is developed, once the image is generated, the user is asked to type the letters shown in the image. Although both of them have shown promising results, this experimental study compares them in terms of security and usability for mobile device applications. The results demonstrated that the interactive scheme performs better than the text-based handwritten scheme in both usability and security.

Capture the Bot: Using Adversarial Examples to Improve CAPTCHA Robustness to Bot Attacks

To date, CAPTCHAs have served as the first line of defense to prevent unauthorized access by (malicious) bots to web-based services, while at the same time maintaining a trouble-free experience for human visitors. However, recent work in the literature has shown that sophisticated bots using advancements in Machine Learning (ML) can easily bypass existing CAPTCHA-based defenses. This work introduces CAPTURE, a novel CAPTCHA scheme based on adversarial examples. Typically adversarial examples are used to lead an ML model astray. With CAPTURE, we attempt to make a “good use” of such mechanisms in order to increase the robustness and security of existing CAPTCHA schemes. Our empirical evaluations show that CAPTURE can produce CAPTCHA challenges that are easy for humans to solve, while at the same time, CAPTURE can effectively thwart sophisticated ML-based bot solvers.

Using Generative Adversarial Networks to Break and Protect Text Captchas

Text-based CAPTCHAs remains a popular scheme for distinguishing between a legitimate human user and an automated program. This article presents a novel genetic text captcha solver based on the generative adversarial network. As a departure from prior text captcha solvers that require a labor-intensive and time-consuming process to construct, our scheme needs significantly fewer real captchas but yields better performance in solving captchas. Our approach works by first learning a synthesizer to automatically generate synthetic captchas to construct a base solver. It then improves and fine-tunes the base solver using a small number of labeled real captchas. As a result, our attack requires only a small set of manually labeled captchas, which reduces the cost of launching an attack on a captcha scheme. We evaluate our scheme by applying it to 33 captcha schemes, of which 11 are currently used by 32 of the top-50 popular websites. Experimental results demonstrate that our scheme significantly outperforms four prior captcha solvers and can solve captcha schemes where others fail. As a countermeasure, we propose to add imperceptible perturbations onto a captcha image. We demonstrate that our countermeasure can greatly reduce the success rate of the attack.

Deciphering complex text-based CAPTCHAs with deep learning

Background: CAPTCHA is a mechanism to distinguish humans from bots. It has become standard means of protection from the misuse of resources on World Wide Web. Different types of CAPTCHAs are implemented but text-based schemes are the most widely used due to its easiness and robustness. A user is asked to type in the text from an image. The image is intentionally distorted to dodge the bots. Recognizing the text is easy for humans but very hard for computers. Method/Findings: In this work, a text-based CAPTCHA scheme with background clutter and partially connected characters is decoded. The main steps consist on preprocessing, segmentation and recognition. Several digital image processing techniques were applied during preprocessing, segmentation steps and convolutional neural network (CNN) was used for recognition process. Since massive data is required for CNN therefore data was generated synthetically. A complex text-based CAPTCHA scheme with varying number of letters: 3, 4 and 5 letters is decoded with the overall precision of 77.5%, 64.2% and 51.9% respectively. Keywords: CAPTCHAs; HIPs; image processing; machine learning; CNN

All about uncertainties and traps: Statistical oracle-based attacks on a new CAPTCHA protection against oracle attacks

CAPTCHAs are security mechanisms that try to prevent automated abuse of computer services. Many CAPTCHAs have been proposed but most have known security flaws against advanced attacks. In order to avoid a kind of oracle attacks in which the attacker learns about ground truth labels via active interactions with the CAPTCHA service as an oracle, Kwon and Cha proposed a new CAPTCHA scheme that employ uncertainties and trap images to generate adaptive CAPTCHA challenges, which we call “Uncertainty and Trap Strengthened CAPTCHA” (UTS-CAPTCHA) in this paper. Adaptive CAPTCHA challenges are used widely (either explicitly or implicitly) but the role of such adaptive mechanisms in the security of CAPTCHAs has received little attention from researchers.In this paper we present a statistical fundamental design flaw of UTS-CAPTCHA. This flaw leaks information regarding ground truth labels of images used. Exploiting this flaw, an attacker can use the UTS-CAPTCHA service as an oracle, and perform several different statistical learning-based attacks against UTS-CAPTCHA, increasing any reasonable initial success rate up to 100% according to our theoretical estimation and experimental simulations. Based on our proposed attacks, we discuss how the fundamental idea behind our attacks may be generalized to attack other CAPTCHA schemes and propose a new principle and a number of concrete guidelines for designing new CAPTCHA schemes in the future.

A novel CAPTCHA scheme based on facial expression reconstruction

Despite some technical and conceptual criticism on the CAPTCHA and its claimed effectiveness, such human interaction proofs (HIPs) are still in the centre of attention. With the aim of designing a novel, efficient and user-friendly CAPTCHA, the facial expression reconstruction CAPTCHA, FERCHA, is proposed. The distinguishing challenge in this schema is reconstruction of a facial expression related to the perceived emotion in a game-like manner. In one side, the weakness of current machines in performing cognitive tasks has been leveraged to introduce a strong CAPTCHA. Also, as the byproduct, the FERCHA schema can be used as a crowdsourcing platform in order to collect human-generated semantic annotation and interpretation of text, emojis and images. The experimental results (including theoretical analysis and user acceptance evaluation) proved the efficacy and robustness of the presented idea. Moreover, it is found that providing humans with user-friendly experience could improve the success rate and satisfaction level.

A novel CAPTCHA scheme based on facial expression reconstruction

Despite some technical and conceptual criticism on the CAPTCHA and its claimed effectiveness, such human interaction proofs (HIPs) are still in the centre of attention. With the aim of designing a novel, efficient and user-friendly CAPTCHA, the facial expression reconstruction CAPTCHA, FERCHA, is proposed. The distinguishing challenge in this schema is reconstruction of a facial expression related to the perceived emotion in a game-like manner. In one side, the weakness of current machines in performing cognitive tasks has been leveraged to introduce a strong CAPTCHA. Also, as the byproduct, the FERCHA schema can be used as a crowdsourcing platform in order to collect human-generated semantic annotation and interpretation of text, emojis and images. The experimental results (including theoretical analysis and user acceptance evaluation) proved the efficacy and robustness of the presented idea. Moreover, it is found that providing humans with user-friendly experience could improve the success rate and satisfaction level.

Color Channel CAPTCHA: A Secure Scheme for Cloud Environment

Abuse of cloud services consequently unauthorized access to cloud data by malicious software automation is prevented by CAPTCHA. The secure usable mechanism is mandatory for resilience to automate attacks accordingly to create pleasant challenges. In this paper, we propose a novel image-based graphical Color Channel CAPTCHA scheme to distinguish between malware and humans for data security in the cloud environment. This color channel CAPTCHA is designed with 2 X 2 grids of different color channels with micro invisible circles or less visible moving circles. This simple challenge is completed by click on the specified circles in the given order with very less solving time, while compared to the state of the art. The experimental study has been conducted among 41 participants on both usability and performance of color channel CAPTCHA.

An End-to-End Attack on Text CAPTCHAs

Text-based CAPTCHAs are the most widely used CAPTCHA scheme. Most text-based CAPTCHAs have been cracked. However, previous works have mostly relied on a series of preprocessing steps to attack text CAPTCHAs, which was complicated and inefficient. In this paper, we introduce a simple, generic, and effective end-to-end attack on text CAPTCHAs without any preprocessing. Through a convolutional neural network and an attention-based recurrent neural network, our attack broke a wide range of real-world text CAPTCHAs that are deployed by the top 50 most popular websites ranked by Alexa.com. In addition, this paper comprehensively analyzed the security of most resistance mechanisms of text-based CAPTCHAs through experiments. Experimental results prove that the anti-segmentation principle can be completely broken under deep learning attacks without any segmentation or preprocessing steps in contrast to commonly held beliefs.