# Investigation of Using CAPTCHA Keystroke Dynamics to Enhance the Prevention of Phishing Attacks
## 2 Related Work and Background  
To address the issue of phishing attacks, several solutions have been proposed to mitigate their effect. These solutions may be classified as technical (using software), non-technical (educational), or a combination of the two. Technical solutions can be further categorised as phishing detection and phishing prevention. Phishing detection involves analysing a website's media content. It can use an image or URL to verify whether the website is genuine [15]. Several anti-phishing detection techniques have been developed to mitigate the impact of phishing attacks, such as security toolbars, search engines [16], black/white lists [17], machine learning [18], and visual similarity-based techniques [19]. Phishing prevention solutions attempt to prevent phishing attacks by enhancing website security. This is endeavoured through the implementation of unique methods of securing authentication schemes and platforms for user interaction [20]. These solutions have achieved widespread success in recent years, especially with the increase in identity theft and data leakage resulting from diverse means of attack, such as phishing, email spoofing, and malware. Therefore, companies, including banks, have focused on integrating strong authentication methods to protect their systems based on the premise that, even if phishers manage to steal victims' information, they cannot use it to achieve their goals. For instance, in one study [21], an OTP and authentication tokens were used to construct a system of two-factor authentication to prevent phishing attacks. In another study [22], a novel authentication system was developed for online banking, which depended on integrated OTP and QR-codes to provide greater security and convenience for users. The authors in Ref. [23] have proposed a two-factor authentication/verification scheme using fingerprint and code verification with a pattern matrix to prevent phishing attacks. In the above study, it was claimed that the scheme would be very useful in the financial sector to provide a high level of security, with a phisher being unable to bypass two levels of authentication and verification. Moreover, [PERSON] introduced a multi-factor authentication scheme to improve the security of a mobile money transfer system (the Mpesa app) in Kenya, integrating username and password, phone number, and voice biometrics to prevent mobile money fraud, including phishing attacks [24]. In a recent study [25], another approach to protecting electronic payment systems was developed, combining password, fingerprint, and OTP verification. This combined approach was intended to provide more reliable user authentication, consisting of multi-factor authentication in three main phases: (1) Registration: with various types of data being required (i.e., the user's biodata, password, and fingerprint), followed by verification of accuracy and storage in the database, (2) Authentication: with the user required to enter a password and biometric fingerprint so that the latter could be checked against the fingerprint stored in the database; if a match was verified, access would be granted, and (3) Transaction: with the user selecting the amount for transfer and being authenticated by scanning their biometric fingerprint. If a match was verified, the system would create an OTP and transmit it to the user's registered phone number. The user would then have to enter the correct OTP to complete the money transfer. In other studies [26; 27], a novel approach was introduced for the detection of phishing websites and authentication of registered users through CAPTCHA-based validation. The first study used visual cryptography to protect the privacy of an image-based CAPTCHA by dividing the original image CAPTCHA into two shares. These were maintained on separate database servers (the user's device and the server). As a result, the original image CAPTCHA was only exposed if both CAPTCHAs were simultaneously available.