# Investigation of Using CAPTCHA Keystroke Dynamics to Enhance the Prevention of Phishing Attacks
###### Abstract  
Phishing is a cybercrime that is increasing exponentially day by day. In phishing, a phisher employs social engineering and technology to misdirect victims towards revealing their personal information, which can then be exploited. Despite ongoing research to find effective anti-phishing solutions, phishing remains a serious security problem for Internet users. In this paper, an investigation of using CAPTCHA keystroke dynamics to enhance the prevention of phishing attacks was presented. A controlled laboratory experiment was conducted, with the results indicating the proposed approach as highly effective in protecting online services from phishing attacks. The results showed a 0% false-positive rate and 17.8% false-negative rate. Overall, the proposed solution provided a practical and effective way of preventing phishing attacks. phishing attacks; keystroke dynamics; text-based CAPTCHA; authentication +
Footnote †: journal: _Future Internet_  
history. Figure 1 shows the number of phishing occurrences from the first quarter of 2021 to the third quarter of 2021. Statistics indicate that the incidence of phishing scams has doubled in recent years due to the 2019 coronavirus (COVID-19) pandemic, which suggests that phishers are seeking opportunities to exploit current events. As stated by the World Health Organization (WHO), COVID-19 has established an 'infodemic' that actually benefits phishers [6]. In addition, the FBI claims that over 11 times as many phishing complaints were logged in 2020 as in 2016 [7] since phishing attacks often tailor their campaigns to current events. Nonetheless, the number of phishing scams declined during the first quarter of 2021, as shown in Figure 1, with users becoming more aware of COVID-19 phishing scams. This resulted in phishers being less successful with emails related to the pandemic. However, phishers continued to exploit the pandemic, especially with the COVID-19 vaccination rollout [8]. In addition, phishers frequently impersonate leading brands in a bid to steal confidential information from users, such as their payment credentials. New reports show that the most frequently imitated brands in global phishing attempts are Microsoft and the DHL delivery service provider [9]. All previous statistical explanations refer to the risk of phishing attacks. Phishing is considered as a lucrative criminal activity, which targets individuals and organisations and incurs millions of dollars in losses every day. Moreover, it is seldom prosecuted. According to a recent study conducted by the Ponemon Institute, the annual cost of phishing attacks in the US has increased significantly in the last six years to the point where large US companies are now paying out $15 million each year. This amounts to nearly $1500 per employee annually [10]. To date, anti-phishing techniques have not been sufficiently effective to reduce the risk of phishing attacks. Due to phishers seeking to identify the weaknesses and vulnerabilities of a given solution so that these can be exploited to carry out a successful attack, it is essential to protect users' data from phishing attacks by educating them in the correct course of action and reporting methods if a phishing email is received. For example, Qassim University is about to launch a new awareness programme to mitigate phishing attacks. This programme is similar to one that was implemented in Stanford University, which now has a phishing awareness service [11]. Moreover, online services need to adopt a reliable phishing-prevention mechanism to ensure that only genuine users gain access to their systems. Consequently, many organisations currently seek to protect their systems by implementing stronger authentication requirements as a means of preventing unauthorised access. For example, online banking services exclusively use  
Figure 1: Detection of unique phishing sites [5]. one-time passwords (OTP) to prevent identity theft, wherein a new password is generated and required to enter for each log-in attempt.