Text-based CAPTCHA Research Articles

Transformer-based end-to-end attack on text CAPTCHAs with triplet deep attention

Websites frequently use text-based captcha images to distinguish whether the user is a person or not. Previous research mainly focuses on different training strategies and neglects the characteristics of the text-based captcha images themselves, resulting in low accuracy. For text-based captcha images characterized by rotation, distortion, and non-character elements, we propose an end-to-end attack using a Transformer-based method with triplet deep attention. Firstly, the features of text-based captchas are extracted using ResNet45 with triplet deep attention module and Transformer encoder. The TDA module is capable of learning rotational and distortion features of characters. Subsequently, based on self-attention mechanism, design query, key, and value, and adopt the query enhancement module to enhance the query. The query enhancement module can strengthen character localization and reduce attention drift towards non-character elements. Finally, the feature maps are transformed into probabilities of character for the final text recognition. Experiments are conducted on captcha datasets based on Roman characters from 9 popular websites, achieving average word accuracy of 91.14%. To evaluate the performance of our method on data with small samples, experiments are conducted different scales of training data. Additionally, we use the method on Chinese text-based captcha tasks and achieve average word accuracy of 99.60%. The effectiveness of the method is also explored under conditions of lack of illumination and scene text recognition, where background interference is present.

Adaptive CAPTCHA: A CRNN-Based Text CAPTCHA Solver with Adaptive Fusion Filter Networks

Text-based CAPTCHAs remain the most widely adopted security scheme, which is the first barrier to securing websites. Deep learning methods, especially Convolutional Neural Networks (CNNs), are the mainstream approach for text CAPTCHA recognition and are widely used in CAPTCHA vulnerability assessment and data collection. However, verification code recognizers are mostly deployed on the CPU platform as part of a web crawler and security assessment; they are required to have both low complexity and high recognition accuracy. Due to the specifically designed anti-attack mechanisms like noise, interference, geometric deformation, twisting, rotation, and character adhesion in text CAPTCHAs, some characters are difficult to efficiently identify with high accuracy in these complex CAPTCHA images. This paper proposed a recognition model named Adaptive CAPTCHA with a CNN combined with an RNN (CRNN) module and trainable Adaptive Fusion Filtering Networks (AFFN), which effectively handle the interference and learn the correlation between characters in CAPTCHAs to enhance recognition accuracy. Experimental results on two datasets of different complexities show that, compared with the baseline model Deep CAPTCHA, the number of parameters of our proposed model is reduced by about 70%, and the recognition accuracy is improved by more than 10 percentage points in the two datasets. In addition, the proposed model has a faster training convergence speed. Compared with several of the latest models, the model proposed by the study also has better comprehensive performance.

Adversarial Captcha

CAPTCHAs, tests to separate humans from machines, serve as a method to verify whether an interaction is being performed by a human or a computer, were developed in reaction to the vulnerability of computer networks to intrusions by programmers using bots and computer attack programs. The most popular Captcha scheme is the Text Captcha because of how simple it is to create and use. However, the presumed security of Captchas has been undermined by hackers and programmers, making websites open to attack.Given that attack speeds are generally moderate, usually ranging from two to five seconds per image and that this is not a serious worry, text captchas are nevertheless extensively utilized. This study proposes a novel image-based Captcha called Style Area Captcha (SACaptcha), which is built on deep learning techniques, pixel-level segmentation, and semantic data understanding.The proposed SACaptcha emphasises using deep learning to create neural networks neural networks image-based Captchas. Acquiring methods to enhance security and captcha systems are all covered in this paper.It compares the proving that text-based Captchas are insecure. Key words: deep, text-based, security, and captcha Convolutional image-based learning

Next-Generation Captcha: Enhancing Security Through Hand Gestures and Gaming

Abstract: In the digital age, the threat of automated attacks on online platforms continues to evolve, necessitating innovative approaches to ensure cybersecurity. Traditional text-based CAPTCHA systems are becoming increasingly vulnerable to sophisticated attacks, prompting the exploration of alternative solutions. This research proposes a novel approach to enhance online security through the integration of hand gestures and gaming elements into CAPTCHA mechanisms. By leveraging the unique biometric characteristics of hand gestures and the engaging nature of gaming, this next-generation CAPTCHA system aims to provide robust protection against automated bots while ensuring a user-friendly experience. The study explores the design, implementation, and evaluation of this hybrid CAPTCHA solution, assessing its effectiveness in mitigating various challenges associated with existing CAPTCHA methods. Through empirical analysis and user feedback, the research aims to demonstrate the feasibility and efficacy of incorporating hand gestures and gaming into CAPTCHA systems to enhance security and usability in online environments.

Robustness and user test on text-based CAPTCHA: Letter segmenting is not too easy or too hard

Text-based CAPTCHA is widely used as an online security guard, requiring a user to input letters for classifying human and automated software (known as a bot). However, they are still a problem for usability and robustness. This study investigated the effect of letter spacing, disturbing line orientation and disturbing line color on user test and robustness of text-based CAPTCHA. The 240 CAPTCHAS were tested using Thai undergraduate students. The results show that there were no significant differences in user tests for the three factors. For robustness, disturbing line orientation had no significant difference. However, overlapping letter CAPTCHA was the most significantly robust. CAPTCHA with a disturbing line using the same color as the background was more significantly robust than that using the same color as the foreground. Moreover, if no-spacing letter is used, the effect of disturbing line color is statistically significant in robustness while the effect of that became insignificant when a spacing between letter and overlapping letter are used. We recommend that CAPTCHA with no spacing letter and combined with disturbing line using the same color as the background is suitable for users and its robustness. This can be concluded that letter segmenting technique is not too hard for users (passed 88 %) while it is not too easy for bot attacks (passed 39 %). In terms of security, more studies can still be carried on the CAPTCHA to enabled more robustness against new crime technologies. In terms of usability, on other age groups could be consider.

Deep Learning Based CAPTCHA Recognition Network with Grouping Strategy

Websites can improve their security and protect against harmful Internet attacks by incorporating CAPTCHA verification, which assists in distinguishing between human users and robots. Among the various types of CAPTCHA, the most prevalent variant involves text-based challenges that are intentionally designed to be easily understandable by humans while presenting a difficulty for machines or robots in recognizing them. Nevertheless, due to significant advancements in deep learning, constructing convolutional neural network (CNN)-based models that possess the capability of effectively recognizing text-based CAPTCHAs has become considerably simpler. In this regard, we present a CAPTCHA recognition method that entails creating multiple duplicates of the original CAPTCHA images and generating separate binary images that encode the exact locations of each group of CAPTCHA characters. These replicated images are subsequently fed into a well-trained CNN, one after another, for obtaining the final output characters. The model possesses a straightforward architecture with a relatively small storage in system, eliminating the need for CAPTCHA segmentation into individual characters. Following the training and testing of the suggested CNN model for CAPTCHA recognition, the experimental results demonstrate the model’s effectiveness in accurately recognizing CAPTCHA characters.

Extended Research on the Security of Visual Reasoning CAPTCHA

CAPTCHA is an effective mechanism for protecting computers from malicious bots. With the development of deep learning techniques, current mainstream text-based and traditional image-based CAPTCHAs have been proven to be insecure. Therefore, a major effort has been directed toward developing new CAPTCHAs by utilizing some other hard Artificial Intelligence (AI) problems. Recently, some commercial companies (Tencent, NetEase, Geetest, etc.) have begun deploying a new type of CAPTCHA based on visual reasoning to defend against bots. As a newly proposed CAPTCHA, it is therefore natural to ask a fundamental question: are visual reasoning CAPTCHAs as secure as their designers expect? This paper explores the security of visual reasoning CAPTCHAs. We proposed a modular attack and evaluated it on six different real-world visual reasoning CAPTCHAs, which achieved overall success rates ranging from 79.2% to 98.6%. The results show that visual reasoning CAPTCHAs are not as secure as anticipated; this latest effort to use novel, hard AI problems for CAPTCHAs has not yet succeeded. Then, we summarize some guidelines for designing better visual-based CAPTCHAs, and based on the lessons we learned from our attacks, we propose a new CAPTCHA based on commonsense knowledge (CsCAPTCHA) and show its security and usability experimentally.

Devanagari CAPTCHA: For the Security in Web

Completely Automated Public Turing Test to Tell Computers and Humans Apart or CAPTCHA is a solution for cyber-attack. CAPTCHA is a small challenge that an internet user has to pass before accessing any online service. The most common type of CAPTCHA is text-based CAPTCHA, in which a small image (contains a random number of alphabets) is presented before the user. The user has to identify and then type the alphabet in a text box. The textual information in the CAPTCHA must not be identified by a bot (computer code). So, artificial noise and distortion are applied in the image. Earlier text-based schemes use English alphabets, but over time non-English language-based text CAPTCHAs also came into the picture. Native language-based text CAPTCHA is very useful for internet users who do not know the English language. This article is an effort towards the current status of the Devanagari script-based CAPTCHAs. We have analyzed 28 unique Devanagari CAPTCHAs from a security and usability point of view. Total 28000 different samples are collected for this experiment. For the success of a text-based CAPTCHA, it must be very secure from the bot and easy for human beings. Devanagari CAPTCHA can be very beneficial for Indian websites. This paper is written by keeping the importance of Devanagari script-based CAPTCHA.

Decoding the animated text-based captchas to verify their robustness against automated attacks

In order to protect the web against automated attacks, CAPTCHAs are most widely used mechanism on the internet. Numerous types of CAPTCHAs are introduced due to weaknesses in the earlier designs. Animated CAPTCHAs are one of the design alternatives. Instead of presenting the whole information at once, animated CAPTCHAs present information in various frames over the specific interval of time. As CATPCHAs are ubiquitously used to avoid the serious threats from bots therefore it is important to verify their effectiveness. In this research we have verified their robustness against machine learning attacks. It has been proved that adding the extra time dimension does not necessarily ensure protection against automated attacks. We have attacked the Hello CAPTCHA scheme, which is the most popular animated CAPTCHA scheme available on the internet. By applying novel image processing and machine learning techniques, these CAPTCHAs are decoded with high precision. A pre-trained CNN is used to recognize the extracted characters. In this research, 6 popular types of animated CAPTCHAs along with 41 sub types were successfully deciphered with an overall precision of up to 99.5 %.

Practicality analysis of utilizing text-based CAPTCHA vs. graphic-based CAPTCHA authentication.

CAPTCHA as "Completely Automated Public Turing test to tell Computers and Humans Apart" is becoming an essential tool to help reduce many automated security authentication attacks. This research focused on studying differences running text-based CAPTCHA vs. graphical-based CAPTCHA in a utilization applicable dominant practicality manner. The ordinary text-based CAPTCHA works simple to prevent automated submissions as thought of being relatively easy to exploit. On the other hand, graphic-based CAPTCHA can be more preferred from users side, but can be providing some complexities making clear tradeoff analysis need between its usability and security. Even though graphic-based CAPTCHA has been generally considered as improvement of text-based CAPTCHA with respect to security, its usage is still not common, raising a practicality gap needing some search for comparing the two methods side by side comprehensively involving usability applicability and cultural preference beside security. In this regard, this research contributes towards filling the gap in knowledge running thorough local experimentations for finding different CAPTCHA performance tradeoffs in terms of real statistical humanoid possibilities of practicality easiness, repetition secrecy, and configuration solving timing, that can be used as basis for conducting further techno improvement human-oriented research.

An Experimental Investigation of Text-based CAPTCHA Attacks and Their Robustness

Text-based CAPTCHA has become one of the most popular methods for preventing bot attacks. With the rapid development of deep learning techniques, many new methods to break text-based CAPTCHAs have been developed in recent years. However, a holistic and uniform investigation and comparison of these attacks’ effects is lacking due to inconsistent choices of model structures, training datasets, and evaluation metrics. In this article, we perform an experimental investigation on the effects of existing attacks on text-based CAPTCHA schemes. We first summarize existing text-based CAPTCHAs using a newly proposed taxonomy based on their resistance mechanisms and systematically review corresponding attacks in terms of methods and pros/cons. Then, we introduce a unified attack framework that contains a number of different attack modules and transfer learning strategies. Applying this framework, we extensively evaluate the performance of known attacks on 20 CAPTCHA schemes in terms of accuracy and efficiency; then, we investigate the robustness of these widely used schemes and discover the effects of previously unexplored attacks. Finally, we discuss future CAPTCHA designs based on our experimental results and findings. Our work also contributes to the CAPTCHA community by offering an open-access dataset that contains 22 different CAPTCHA sample sets.

A secure annuli CAPTCHA system

Many websites and applications rely on CAPTCHA for protection from bot attacks. Otherwise, users and businesses will be exposed to risks. Although several different CAPTCHA systems have been proposed, the development of deep learning algorithms allows attackers to create more efficient and accurate attack methods. Many studies have shown that existing CAPTCHA systems are no longer safe, especially text-based CAPTCHA. To resolve this issue, a simple, secure, and effective annuli CAPTCHA system is proposed in this paper. In the proposed system, the annuli CAPTCHA image containing the overlapping of circles and ovals is randomly generated. The user wishing to gain access to the system is required to answer correctly the total number of circles and ovals in the image to prove that he/she is not a bot. The security of our proposed CAPTCHA system is verified by three attack methods. Additionally, the usability survey of our CAPTCHA system conducted by anonymous questionnaires shows that our system is user friendly. In other words, the proposed system maintains a high level of usability under the premise of high security. Compared with the existing CAPTCHA system, our CAPTCHA system is significantly better in terms of security, usability and ease of implementation.

A Novel Design of Audio CAPTCHA for Visually Impaired Users

CAPTCHAs are widely used by web applications for the purpose of security and privacy. However, traditional text-based CAPTCHAs are not suitable for sighted users much less users with visual impairments. To address the issue, this paper proposes a new mechanism for CAPTCHA called HearAct, which is a real-time audio-based CAPTCHA that enables easy access for users with visual impairments. The user listens to the sound of something (the “sound-maker”), and he/she must identify what the sound-maker is. After that, HearAct identifies a word and requires the user to analyze a word and determine whether it has the stated letter or not. If the word has the letter, the user must tap and if not, they swipe. This paper presents our HearAct pilot study conducted with thirteen blind users. The preliminary user study results suggest the new form of CAPTCHA has a lot of potential for both blind and visual users. The results also show that the HearAct CAPTCHA can be solved in a shorter time than the text-based CAPTCHAs because HearAct allows users to solve the CAPTCHA using gestures instead of typing. Thus, participants preferred HearAct over audio-based CAPTCHAs. The results of the study also show that the success rate of solving the HearAct CAPTCHA is 82.05% and 43.58% for audio CAPTCHA. A significant usability differences between the System Usability score for HearAct CAPTCHA method was 88.07 compared to audio CAPTCHA was 52.11%. Using gestures to solve the CAPTCHA challenge is the most preferable feature in the HearAct solution. To increase the security of HearAct, it is necessary to increase the number of sounds in the CAPTCHA. There is also a need to improve the CAPTCHA solution to cover wide range of users by adding corresponding image with each sound to meet deaf users’ needs; they then need to identify the spelling of the sound maker’s word.

A novel CAPTCHA solver framework using deep skipping Convolutional Neural Networks.

A Completely Automated Public Turing Test to tell Computers and Humans Apart (CAPTCHA) is used in web systems to secure authentication purposes; it may break using Optical Character Recognition (OCR) type methods. CAPTCHA breakers make web systems highly insecure. However, several techniques to break CAPTCHA suggest CAPTCHA designers about their designed CAPTCHA’s need improvement to prevent computer vision-based malicious attacks. This research primarily used deep learning methods to break state-of-the-art CAPTCHA codes; however, the validation scheme and conventional Convolutional Neural Network (CNN) design still need more confident validation and multi-aspect covering feature schemes. Several public datasets are available of text-based CAPTCHa, including Kaggle and other dataset repositories where self-generation of CAPTCHA datasets are available. The previous studies are dataset-specific only and cannot perform well on other CAPTCHA’s. Therefore, the proposed study uses two publicly available datasets of 4- and 5-character text-based CAPTCHA images to propose a CAPTCHA solver. Furthermore, the proposed study used a skip-connection-based CNN model to solve a CAPTCHA. The proposed research employed 5-folds on data that delivers 10 different CNN models on two datasets with promising results compared to the other studies.

Counteracting Dark Web Text-Based CAPTCHA with Generative Adversarial Learning for Proactive Cyber Threat Intelligence

Automated monitoring of dark web (DW) platforms on a large scale is the first step toward developing proactive Cyber Threat Intelligence (CTI). While there are efficient methods for collecting data from the surface web, large-scale dark web data collection is often hindered by anti-crawling measures. In particular, text-based CAPTCHA serves as the most prevalent and prohibiting type of these measures in the dark web. Text-based CAPTCHA identifies and blocks automated crawlers by forcing the user to enter a combination of hard-to-recognize alphanumeric characters. In the dark web, CAPTCHA images are meticulously designed with additional background noise and variable character length to prevent automated CAPTCHA breaking. Existing automated CAPTCHA breaking methods have difficulties in overcoming these dark web challenges. As such, solving dark web text-based CAPTCHA has been relying heavily on human involvement, which is labor-intensive and time-consuming. In this study, we propose a novel framework for automated breaking of dark web CAPTCHA to facilitate dark web data collection. This framework encompasses a novel generative method to recognize dark web text-based CAPTCHA with noisy background and variable character length. To eliminate the need for human involvement, the proposed framework utilizes Generative Adversarial Network (GAN) to counteract dark web background noise and leverages an enhanced character segmentation algorithm to handle CAPTCHA images with variable character length. Our proposed framework, DW-GAN, was systematically evaluated on multiple dark web CAPTCHA testbeds. DW-GAN significantly outperformed the state-of-the-art benchmark methods on all datasets, achieving over 94.4% success rate on a carefully collected real-world dark web dataset. We further conducted a case study on an emergent Dark Net Marketplace (DNM) to demonstrate that DW-GAN eliminated human involvement by automatically solving CAPTCHA challenges with no more than three attempts. Our research enables the CTI community to develop advanced, large-scale dark web monitoring. We make DW-GAN code available to the community as an open-source tool in GitHub.

De-CAPTCHA: A novel DFS based approach to solve CAPTCHA schemes

CAPTCHA stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart. CAPTCHAs are used as security mechanism in web applications to differentiate between real users and automated users, also known as bots. Text-based CAPTCHAs are the popularly used CAPTCHA schemes due to their simplicity and thus, they are still being used despite the proposal of several attack mechanisms. In this work, the authors have proposed a novel approach to solve CAPTCHA schemes. In this approach, the authors have used Depth First Search algorithm for the extraction of characters from CAPTCHAs and Convolutional Neural Network for recognizing these extracted characters. The proposed approach was validated on 3000+ CAPTCHA schemes and proved to be efficient by providing an average accuracy of more than 92.0% in detecting CAPTCHA schemes.

A deep learning‐based attack on text CAPTCHAs by using object detection techniques

Text-based CAPTCHAs have been widely deployed by many popular websites, and many have been attacked. However, most previous cracks were based on classification algorithms that typically rely on a series of preprocessing operations or on many training samples, thus making such attacks complicated and costly. In this study, a simple, generic, fast and end-to-end attack based on advanced object detection technologies is introduced. The proposed attack combines a feature extraction module, a character location and recognition module and a coordinate matching module. The experiments show that the attack can break a wide range of real-world text CAPTCHAs deployed by the 50 most popular websites on Alexa.com and that the method achieves a high attack accuracy with only 2000 samples at an attack speed of less than 0.10 s. The attack was also evaluated on four click-based CAPTCHAs that cannot be attacked in the end-to-end manner used by previous attacks, and the results demonstrated that within one step, the proposed approach achieves high success rates on both click-based CAPTCHAs and schemes based on large-scale character sets, such as Chinese character sets.

Make complex CAPTCHAs simple: A fast text captcha solver based on a small number of samples

Text-based captchas are still widely used by many websites such as Wikipedia and Microsoft despite the emergence of many alternative captchas. Recently, the design of text-based captchas has become more and more complex to resist attacks from automatic cracking programs. However, most of the existing captcha solving methods have certain shortcomings, such as insufficient accuracy, poor generalization performance, and the need for a large number of labeled samples. This study proposes a fast captcha solver that can effectively break text-based captchas with complex security features using a small amount of labeled data. The solver was achieved by constructing a captcha transformation model based on generative adversarial networks to simplify the captcha images before character segmentation and recognition. Results showed that the proposed captcha solver achieved a high success rate of over 96% character accuracy and 74% captcha accuracy for all evaluated schemes. Moreover, the average time to process a single captcha image using a laptop GPU was only 4–8 ms. The effectiveness of this work may encourage captcha designers to reconsider a more secure human–machine distinction mechanism.

Augmented Data Selector to Initiate Text-Based CAPTCHA Attack

In the past decades, due to the low design cost and easy maintenance, text-based CAPTCHAs have been extensively used in constructing security mechanisms for user authentications. With the recent advances in machine/deep learning in recognizing CAPTCHA images, growing attack methods are presented to break text-based CAPTCHAs. These machine learning/deep learning-based attacks often rely on training models on massive volumes of training data. The poorly constructed CAPTCHA data also leads to low accuracy of attacks. To investigate this issue, we propose a simple, generic, and effective preprocessing approach to filter and enhance the original CAPTCHA data set so as to improve the accuracy of the previous attack methods. In particular, the proposed preprocessing approach consists of a data selector and a data augmentor. The data selector can automatically filter out a training data set with training significance. Meanwhile, the data augmentor uses four different image noises to generate different CAPTCHA images. The well-constructed CAPTCHA data set can better train deep learning models to further improve the accuracy rate. Extensive experiments demonstrate that the accuracy rates of five commonly used attack methods after combining our preprocessing approach are 2.62% to 8.31% higher than those without preprocessing approach. Moreover, we also discuss potential research directions for future work.

Design and Development of Sindhi Text Based CAPTCHAs for Regional Websites

Bots are created to use the resources maliciously on World Wide Web. The misuse of the resources could be prevented by employing CAPTCHAs. Several types of CAPTCHAs are being used against the bots (robot) attacks but text-based CAPTCHA type is the most popular being very secured and easy to use. Latin language based text CAPTCHAs can be found ubiquitously on Internet but English text based CAPTCHAs are already decoded by many researchers. Thus, a novel Sindhi language based text CAPTCHA was proposed for regional websites where Arabic style script was utilized. This scheme offered two fold benefits: first, the proposed scheme could easily be understood by averagely literate person; second, this scheme paved a way for Arabic style OCR developers to understand Sindhi language specific features and facilitate Sindhi text recognition in future. A survey was also conducted to analyze the usability and strength of proposed CAPTCHA.