Detecting human attacks on text‐based CAPTCHAs using the keystroke dynamic approach

IET Information SecurityVolume 15, Issue 2 p. 191-204 ORIGINAL RESEARCH PAPEROpen Access Detecting human attacks on text-based CAPTCHAs using the keystroke dynamic approach Suliman A. Alsuhibany, Corresponding Author Suliman A. Alsuhibany salsuhibany@qu.edu.sa orcid.org/0000-0001-7735-9781 Department of Computer Science, College of Computer, Qassim University, Buraydah, Saudi Arabia Correspondence Suliman A. Alsuhibany, College of Computer, Qassim University, Buraydah 52571, Saudi Arabia. Email: salsuhibany@qu.edu.saSearch for more papers by this authorLatifah A. Alreshoodi, Latifah A. Alreshoodi orcid.org/0000-0002-6473-915X Department of Computer Science, College of Computer, Qassim University, Buraydah, Saudi ArabiaSearch for more papers by this author Suliman A. Alsuhibany, Corresponding Author Suliman A. Alsuhibany salsuhibany@qu.edu.sa orcid.org/0000-0001-7735-9781 Department of Computer Science, College of Computer, Qassim University, Buraydah, Saudi Arabia Correspondence Suliman A. Alsuhibany, College of Computer, Qassim University, Buraydah 52571, Saudi Arabia. Email: salsuhibany@qu.edu.saSearch for more papers by this authorLatifah A. Alreshoodi, Latifah A. Alreshoodi orcid.org/0000-0002-6473-915X Department of Computer Science, College of Computer, Qassim University, Buraydah, Saudi ArabiaSearch for more papers by this author First published: 18 March 2021 https://doi.org/10.1049/ise2.12018AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract A Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA) is a simple test that is used on websites to differentiate between human users and automated attacks that indulge in spamming and other fraudulent activities. A text-based CAPTCHA is the most popular security technique used by many websites on the Internet, such as Microsoft, Google and eBay, to secure their sites from automated attacks. By design, however, a CAPTCHA is unable to differentiate between a legitimate human user and a human-based attacker. This may make websites vulnerable to human-based attacks while using CAPTCHAs. Hence this article proposes a novel defence system using the keystroke dynamic approach. To evaluate our system, a laboratory experiment was conducted and the results showed that the proposed system is able to detect human-based attacks on text-based CAPTCHAs effectively with a 100% detection rate. 1 INTRODUCTION Distinguishing between humans and computers is one of the main security problems for online services and websites. To address this, a Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA) was introduced as a challenge–response test to distinguish between a human user and a malicious bot (i.e. computer automated programme, sometimes called script or bot) [1]. It is used mainly to protect the online service provider's systems, resources and web applications from malicious attacks and misuse [2]. There are many categories of CAPTCHA, such as audio-based, image-based and text-based. Text-based CAPTCHAs are the most common security technique used by many online services such as ticket reservations as well as several websites on the Internet (e.g. Microsoft, eBay, Google). This is because they are simple to implement [3] and are easy for users worldwide to solve without much instruction because they require users only to recognise characters and/or digits [4]. A text-based CAPTCHA works by automatically generating a test on an image in the registration form or login form. This image includes some numbers and upper- and lower-case letters that the user is asked to solve. The test is designed to be easily solved by users, but it is difficult for computers. If the user solves the test correctly, it is confirmed that he or she is human and the registration is completed successfully [5]. In this article, the term CAPTCHA refers to text-based CAPTCHA only. The use of CAPTCHA has grown in recent years; over 100 million CAPTCHAs are solved daily [6]. There are generally two types of attacks against CAPTCHAs: automated and human-based. Automated attacks are based on image processing and machine-learning algorithms to solve CAPTCHAs [7], whereas human-based attacks are based on human intelligence that involves hiring a human solver who is paid for a specific number of successful attempts [8]. This can be done by exploiting cheap human labour located in developing countries (sweatshops) [8]. Previously, the dominant type of attack to break the security provided by CAPTCHAs was automated [9]. However, with the improvement in CAPTCHAs, this attack has become complex and costly, as in Zi et al. [34] and Wang et al. [10]. A human-based attack is simpler and less costly because a human solver earns $0.75 per 1000 CAPTCHAs solved in an hour [8]. Also, it is a guaranteed way to bypass security provided by CAPTCHAs because the solvers are human, not automated codes [11]. Most existing studies concentrate on developing or preventing automated attacks; only a few focus on preventing human-based attacks. Thus, malicious entities continue to defeat the security provided by CAPTCHAs through human-based attacks [8]. Furthermore, most if not all existing text-based CAPTCHAs are vulnerable to human-based attacks because they do not use a reliable technique to detect human-based attacks by differentiating between a legitimate human user and a human attacker [7]. For these reasons, there has been an increase in the use of human-based attacks; it has become an effective and economical attack option for malicious entities [8, 11]. Accordingly, it is necessary to improve the security of the text-based CAPTCHA to protect it not only from automated attacks but also from human-based attacks. Keystroke dynamics has become an active research field owing to its low cost and the ease with which it can be integrated into the targeted systems [12]. Keystroke dynamics is a behavioural biometric authentication method that uses a person's typing patterns (typing rhythm) on digital devices such as a computer keyboard to validate her or his identity [13]. As mentioned in Monrose and Rubin [14], the keystroke dynamics is ‘not what you type, but how you type’. In this type of authentication, it can be done without the knowledge of a user and there is no need for additional work by the user to authenticate; he or she types in text as usual [13]. A unique keystroke profile or template can be created from different typing features [12] detected when a user presses or releases keys on a keyboard, such as the duration of a key or key hold time (i.e. the time a certain key is held down), the latency (i.e. the time between two consecutive keys such as releasing the first key and pressing the second key) [15], the typing speed, the pressure applied on the keys, finger positions on the keys [12], typing error and shift key use [16] and so on. Thus, the user's typing patterns have neurophysiological factors that make them unique [12]. Therefore, this technique can be used for distinguishing among individuals. This article proposes a CAPTCHA system against human-based attacks by exploiting the keystroke dynamics authentication system. This system is designed, implemented and evaluated through an experimental study. The contributions of this article are as follows: first, we developed a new methodology for detecting human-based attacks on text-based CAPTCHAs using the keystroke dynamics approach. We then applied three time features to identify the typing patterns of the user. Next, we used the Euclidean distance as a classification method to measure similarities between users' attempts to detect human attackers. These three time features have not been used before to detect human-based attacks. Finally, we conducted an experimental study to demonstrate the effectiveness of the proposed system. The rest of the article is organised as follows: Section 2 reviews the related works. Section 3 describes the proposed system through a general abstract model. The methodology is explained in Section 4. Section 5 explains the experimental studies. Section 6 presents the results, whereas Section 7 discusses them. Finally, Section 8 concludes the article. 2 RELATED WORKS This section reviews related studies for protecting CAPTCHAs in which the CAPTCHAs are redirected to third-party users to help attackers [11, 17-22]. The Drag-n-Drop Interactive Masking CAPTCHA designed in Bin Ye et al. [17] applied drag and drop, interaction, and masking techniques to text-based CAPTCHA to differentiate legitimate users from computer bots and third-party human users. These techniques made their CAPTCHA system able to resist traditional attacks with a success rate of 64% for a CAPTCHA-length 5, 9% for a CAPTCHA-length 6 and 1% for a CAPTCHA-length 7. However, they did not test their CAPTCHA against third-party human attacks. In Wei et al. [18], a GeoCAPTCHA is proposed to defend against third-party human attack by combining personalised information with an image-based CAPTCHA. The answer is known only by the user, so it can successfully prevent human attacks. A user has to remember a geolocation street view scene image that is preselected by him and preregistered with the server. To pass the test, the user has to rotate a given street view challenge to match the preregistered scene image. This will determine whether the user is a third-party solver. Payal and Challa [19] proposed a new CAPTCHA scheme, AJIGJAX CAPTCHA, for websites that need high security and the requirement to authenticate a user. It also defends against third-party human attack. AJIGJAX CAPTCHA is a drag and drop–based CAPTCHA in the form of a linear jigsaw puzzle. In this type of CAPTCHA, the user needs to follow two phases: registration and login. In registration, the user uploads an image and then creates a pass-point on that image and types a label string using a virtual keyboard. In login, the user has to click on the right pass-point of the uploaded image at the registration phase (limited with three chances). If the user clicks on the right pass-point, the pictures for each character in the labelled string are formed and presented in a linear jigsaw puzzle manner in a random fashion that forms a dynamic CAPTCHA test for the user. The user is required to remember the label and solve the puzzle by drag and drop functionality using a mouse. The CAPTCHA is implemented using jQuery, Asynchronous JavaScript and XML (AJAX) and Java Server Pages. The proposed AJIGJAX CAPTCHA is expected to prevent third-party human attack because an illegal human user cannot solve this type of CAPTCHA even if he or she clicks on the right pass-point. Only a legitimate human user can solve the CAPTCHA, which is a kind of password that only the authorised user knows. In Nanglae and Bhattarakosol [20], the authors proposed a method to identify an authorised user from an unauthorised user using a combination of the attributes of text-based CAPTCHA and human capabilities, called a biodetection function (BDF). They conducted an experiment to prove that the BDF for each person using a CAPTCHA is different. They developed a CAPTCHA system running on Adobe Flash CS5.5, written in PHP. First, the user is asked to fill in his or her demographic information (age, sex, occupation, eye problems, eyesight and any colour blindness). This information is used to indicate the user characteristics under the CAPTCHA tests. Then, the user has to solve a simple text-based CAPTCHA that contains four random digits and randomly selected colours of font and background. The authors used the input time for the user to type the CAPTCHA solution as the key point index for BDF. They had 100 participants in their experiment. Their method of analysis was the chi-square test with a 95% confidence interval (α = 0.05). The result showed that there is some limitation in human BDF under the text-based CAPTCHA mechanisms depending on the colours, position and shape of the number used. Thus, CAPTCHA can be used to indicate a personal characteristic of the user by considering all combinations of colours, shapes, positions and typing time. This proposed method can also be used to protect a text-based CAPTCHA from third-party human attack. The study by Truong et al. [11] proposed an interactive CAPTCHA (iCAPTCHA), which is a text-based CAPTCHA to defend against third-party human attacks. First, they developed a streamlined human-based CAPTCHA attack that uses Instant Messenger (IM) infrastructure to clarify the threat of the human solver attacks. This attack allows iCAPTCHA challenges to be delivered to third-party human solvers by IM technology at speeds that defy detection by CAPTCHA timeout values (30 s) that are used as a defence against third-party human attacks in many CAPTCHAs. Finally, they proposed a defence system called iCAPTCHA, which involves a series of user interactions that require a user to enter each character individually with mouse clicks on the displayed characters' buttons until all characters are recognised. The multistep back-and-forth traffic between client and server amplifies the statistical timing difference between a legitimate user and a human solver, which enables them to detect third-party human attacks. Finally, two research papers use behavioural biometrics integrated with CAPTCHA systems to be more secure. The first, in Souza [21], used an image-based CAPTCHA integrated with Mouse Dynamics, which is one of the behavioural biometrics. Mouse Dynamics monitors the mouse interaction of a human user. To solve the challenge, the user must identify and select a certain class of images. While the user tries to solve the CAPTCHA, the way each user interacts with the mouse (i.e. mouse clicks, mouse movements, mouse cursor screen coordinates) is recorded. These recorded mouse movements form the mouse dynamics signature (MDS) of the user. This MDS is an extra secure technique to differentiate humans from bots. The authors tested the security of the CAPTCHA by having an adversary execute a mouse bot attempting to solve the CAPTCHA challenges. They observed that their linear support vector machine classifier performed well in detecting the bot with 100% accuracy, whereas it had an accuracy of close to 86% in detecting humans attempting to solve the CAPTCHA samples. The second study, in Al-naymat et al. [22], proposed merging keystroke dynamics with text-based CAPTCHA for the identification process of differentiating humans from computers (bots) to enhance the security of the CAPTCHA and protect it from automated or bot attack. They conducted an experiment to examine three cases of employing keystroke dynamics in a text-based CAPTCHA. In the first case, they assumed that the bots did not know about using keystroke dynamics in the text-based CAPTCHA. Thus, the classification result between humans and bots would be 100% correct. The software can distinguish between human and bot by checking whether the time features exist. If they exist, the CAPTCHA solver is human; if they do not exist, the CAPTCHA solver is the bot. That is, if a human solves the CAPTCHA, it will send the time features with the text answer to the server; on the other hand, if a bot solves the CAPTCHA, it will send only the text without the time features. Because of this, the authors did not conduct an experiment for this case. In the second case, they assumed that the bot knew about the time features sent with the CAPTCHA text and the number of features by attacking the code of the website. Thus, the bots would try to generate random numbers for time features from any keystroke data set and send them with the text answer to be similar to the human answer. To imitate this case, they created 20 fake users and generated random numbers for their time features; they also randomly chose 20 users from their data set, which was generated from their other experiment in which they studied the use of keystroke dynamics with a short password containing 56 users, nine records for each person and seven time features to represent the typing style of a user. They then divided the data set into a training set and testing set. In the third case, they assumed that the bot was smarter than in the second case and knew everything about the time features and their calculation methods. To imitate this case, they selected the same 20 users as in the second case, created 20 fake users, generated random numbers for only two main time features (hold time and flight time) and calculated the other time features based on the two main features. They then divided the data set into a training set and testing set. They used the WEKA tool to run their experiment and used three classifiers: Multi-Layer Perceptron (MLP), Random Forest and J48. They used accuracy to evaluate the data. For the case two data set, the accuracy results achieved for the Random Forest classifier and J48 classifier were 98.13%, which was higher than the 95% achieved by the MLP classifier. For the case three data set, the accuracy result achieved for the Random Forest classifier was 93.13%, which was the best accuracy result in case three, and the result achieved by the MLP classifier was 90.63%, which was higher than the 88.75% achieved by the J48. Their accuracy result was great, proving the effectiveness of their method to secure text-based CAPTCHA and protect it from bot attacks. This research in Al-naymat et al. [22] used keystroke dynamics with text-based CAPTCHA to detect an automated or bot attack, whereas our proposal is to detect a third-party human attack on text-based CAPTCHA to enhance its security. Therefore, a CAPTCHA system still needs considerable research and enhancement to defend against human-based attacks to be more secure and usable. Moreover, to the best of our knowledge, there has not been a study on differentiating between a legitimate user and a human attacker of text-based CAPTCHA using keystroke dynamics (behavioural biometrics). Therefore, this article investigates the application of this approach by developing a text-based CAPTCHA that includes keystroke dynamics as one system. 3 ABSTRACT SYSTEM MODEL To define the proposed system under consideration precisely, we start by providing an abstract system model of the attack steps, involving a text-based CAPTCHA to be redirected to third-party users to help attackers, as shown in Figure 1. This model provides the basis of the experimental study that we present in Section 5. FIGURE 1Open in figure viewerPowerPoint System model In this system model, (1) a text-based CAPTCHA is shown on the website; (2) then, an attacker targets this website using human-based attackers. For this, this CAPTCHA is redirected by the attacker to human workers (3) to solve it. (4) Once the redirected CAPTCHA is solved by the workers, the solution as well as the keystroke timing data will be submitted to the targeted website. Accordingly, this attack fulfils the definition of CAPTCHAs, as introduced in von Ahn et al. [5], that it is a programme that generates tests that humans can pass easily, whereas computers cannot. For this, there is a need to detect not only the automated attack, but also the human-based attacks. Thus, the proposed system in this article takes advantage of keystroke timing data to detect human-based attacks. The following section details the detection methodology. 4 METHODOLOGY In this section, we describe our proposed system and how it can detect human-based attacks. As mentioned earlier, the system includes two subsystems: a text-based CAPTCHA generator and keystroke dynamics. Each will be explained in detail in the following subsections. 4.1 CAPTCHA generator We have developed a CAPTCHA generator that can generate a word containing English characters and/or Arabic digits (A–Z, a–z, and 1–9) randomly selected, as suggested in Alsuhibany [23]. According to the study by Killourhy and Maxion [24], which investigated research on anomaly detection using keystroke dynamics authentication, using 10 characters as the text length for keystroke dynamics authentication is typical. Based on this, we have selected this length for the keystroke dynamics authentication applied in our system. Finally, the CAPTCHA will be displayed to the user on a web page. For each request from the user, the generator generates a new CAPTCHA. Figure 2 shows a generated sample. FIGURE 2Open in figure viewerPowerPoint A generated sample We have not applied anti-segmentation techniques in the developed generator, such as crowding characters together; instead, we added space between characters. This is only to demonstrate the effectiveness of the proposed system and approve the concept of the proposed idea. However, the antisegmentation features will be investigated and applied in our future research. Character confusion is one of the common usability problems in a CAPTCHA [25]. We observed some character confusion when we conducted the primary experiment. Therefore, we removed the following characters from the character set of the generator: I (capital i) and l (small L), because they may confuse the user and affect CAPTCHA usability; the number 0 was also removed because the user may confuse it with the character O. 4.2 Keystroke dynamics system for detecting human-based CAPTCHA attacks This section highlights the keystroke dynamics system and the proposed detection methodology. 4.2.1 Keystroke dynamics We have exploited the keystroke dynamics authentication system to detect human-based CAPTCHA attacks for the following advantages [26]. First, a user's typing patterns are unique, and it is hard to reproduce because the keystroke dynamics system can calculate the keystroke action up to milliseconds precision. Also, the typing patterns cannot be lost or shared. Furthermore, it is easy to integrate with other existing systems and no extra hardware is required. In addition, it is considered the least expensive biometric authentication method because it is a software-based technique and requires only a keyboard, which is a necessary part of every computer [22]. Finally, it is transparent and nonintrusive, because the user's typing pattern on a keyboard can be collected without the knowledge of the user. Therefore, there is no need for users to change their behaviour and no need for them to do additional work to be authenticated [13]. The applied keystroke dynamics authentication system consists of two phases: enrolment and verification. For the enrolment phase, the user is asked to solve the CAPTCHA test several times. Specifically, the user types the CAPTCHA word that appears in the image. Meanwhile, the system collects the raw keystroke timing data (i.e. the press and release timestamp of each key typed to solve the CAPTCHA) and extracts the timing features that represent the typing patterns of each user. For the verification phase, the keystroke dynamics system tries to detect the human attacker by verifying whether the previous CAPTCHA tests were solved by the same user who has the same IP. This phase starts when the user reaches attempt number 100 to solve the CAPTCHA. We have decided that the verification phase relies on 100 attempts, which is inspired by the detection method of spam email for the email server of this study [27]. The authors of this study [27] specified the spam threshold to be 100 in their spam filter. Furthermore, they were able to detect spam email messages when a message was transferred more than 100 times. In addition to this study, the work of Motoyama et al. [8] stated that a real human attacker solves 1000 CAPTCHA tests in an hour. However, because the participants in our experiment were not real attackers, they were a little bit slower and hence were expected to solve 100 tests in approximately 1 hour. Furthermore, there are four stages in the applied keystroke dynamics authentication system: data collection, feature extraction and file creation, classification method, and evaluation. In the following, each component is discussed in detail (except for evaluation, which will be discussed in Section 7). For data collection, which is the first step of our keystroke dynamics detection system, we have decided to develop a web application that generates a CAPTCHA and asks the user to solve and type it in a text box. The system collects the raw keystroke data while the user is typing the generated CAPTCHA. We used the generated CAPTCHAs as input text for our keystroke dynamics system. It is a free text that is not predefined and is randomly generated at the user's request. The collected keystroke timing data will be used to extract features. For the feature extraction and file creation, the collected keystroke times are used, and the time differences among them measured to generate time features that would be used to authenticate the user. These features are calculated from the key press timestamp and key release timestamp in milliseconds for each key typed. Furthermore, we have used three di-graph timing features, as suggested in Alsuhibany et al. [28]: the first is the Hold time or dwell time, which is the time period from a key press until it is released: for example, hold time for key 1 = release time of key 1 – press time of key 1. The second and third are represented by the flight time (or latencies), which has two types: Down–Down (DD) (or Press–Press) and Up–Down (UD) (or Release–Press). The former is the time difference between a key press and the press of the next key: for example, DD time = press time of key 2 – press time of key 1. The latter is the time difference between a key release and the press of the next key: for example UD time = press time of key 2 – release time of key 1. Figure 3 shows the pseudocode of acquiring these timing features. FIGURE 3Open in figure viewerPowerPoint The pseudocode of acquiring timing features Figure 4 shows an example of extracting these time features for two keys. Based on this example, the hold time for key K = 450 – 000 = 450 ms (milliseconds), DD time (for K and M keys) = 600 – 000 = 600 ms and UD (or Release–Press) time = 600 – 450 = 150 ms. FIGURE 4Open in figure viewerPowerPoint Example of extracting the time features used for two keys Afterward, the system computes the average for each time feature, that is the DD, UD and Hold times, to form a timing vector that will be stored in the database as the user's profile to be used for classification, as suggested in Alsuhibany et al. [28]. Figure 5 representing one of the user's profiles. FIGURE 5Open in figure viewerPowerPoint Example representing one of the user's profiles 4.2.2 Proposed detection method In our proposed detection method, we need to compare user data only with the data of the user himself or herself to verify that the user is the same as the one who solved the CAPTCHA tests more than 99 times to attack the system. Therefore, we proposed using the IP address as an identifier for the user data to differentiate between users, and using keystroke dynamics verification to detect human attackers. We were inspired by Bursztein and Bethard [29], because they used the IP address to reduce attacks by limiting the number of attempts to solve the CAPTCHA for each IP address. In our research, we assumed that the user does not change his or her IP address. To find the distance and detection method, the Euclidean distance, which is a commonly used distance metric, is used as a classification method for user profiles of typing patterns, owing to its simplicity and effective performance, as demonstrated in several studies [28, 30]. Moreover, we computed the Euclidean distance to find how close the user's test data is to the user's profile for detecting a human-based CAPTCHA attack. In particular, we computed the distance between two time vectors: one reference time vector obtained previously (i.e. the user's profile stored in the database) and a new test time vector, using the Euclidean distance equation in three-dimensional space [31]: d ( a , b ) = ( a 1 − b 1 ) 2 + ( a 2 − b 2 ) 2 + ( a 3 − b 3 ) 2 (1)where the two time vectors are a and b. In our research, the user's test vector is represented by the letter "a" and the user's profile vector is represented by the letter "b". Furthermore, d(a),(b) is equal to or greater than 0 (i.e. d(a),(b) ≥ 0) [31]. To find a threshold for the Euclidean distance to classify the data and identify the users, the standard deviation (SD) of a user's profile vector is selected, as used in Alsuhibany et al. [28]. Also, the SD is commonly used to measure the variability or diversity of a set of values [32]: S D = ∑ i = 1 N ( x i − x ¯ ) 2 N − 1 (2)where x i = {x1, x2, …} represents the values of the time features, which are {mean of hold time, mean of UD time and mean of DD time} and x ¯ represents the mean value of these three features. Also, N represents the number of items, which is three time features [32]. Table 1 shows the determined thresholds in our system derived in the primary experiment, as detailed in Section 5.1. TABLE 1. Determined thresholds in our system Threshold name Threshold value Description Verification starting 100 Verification phase starts at attempt number 100 Standard dev