# Investigation of Using CAPTCHA Keystroke Dynamics to Enhance the Prevention of Phishing Attacks
## 4 Methodology
### Typing Text  
There are two main phases in this study, as in all keystroke dynamics systems: enrolment and verification. The proposed study deals with free text because text-based CAPTCHA provides completely different text each time. Thus, it does not require the user to memorise any text. For the purpose of usability, the system generates a CAPTCHA that combines lowercase letters (a-z) and digits (1-9). The proposed solution targets strings with lowercase letters to exclude the use of shift and caps lock keys because the system need only focus on collecting key events for the character keys, thereby avoiding any other keystroke sequences. Informed by the pilot experiment, some confusable letters were removed to increase the usability and accuracy of the proposed solution. For example, the numerical digit '0' was removed because it is often confused with the letter 'O', and the capital letter 'I' was removed because it is often confused with the lowercase letter 'I'. The lowercase letters 'I','s', and 'g' were also removed because they are often mistaken for the numbers '1', '5', and '9', respectively, as suggested in Ref. [36]. In addition, the font size was increased to 48 points to ensure that all the characters could be clearly read by the users. The Verdana font was selected because it is stated in the literature that users solve CAPTCHAs more accurately when using the Arial or Verdana fonts [37]. Figure 4 shows a generated sample. Previous studies have focused on using a long-text system to obtain a large amount of timing information. However, this method has a longer training phase and is not user-friendly. In addition, the accuracy of this technique is not high because the user must pause frequently to look at the text during the copy task, which can lead to inconsistencies in the collected data [38]. Therefore, in the proposed solution, a text length of 10 characters was adopted to authenticate keystroke dynamics. This text length was selected based on Ref. [39], in which the authors investigated a number of studies on anomaly detection using authentication via keystroke dynamics, wherein they observed that a text length of 10 characters was typical in keystroke dynamics authentication. This text length has proved to be effective when applied with a text-based CAPTCHA to detect attacks from humans [40]. However, the proposed system asks the user to solve a CAPTCHA seven  
Figure 4: A generated sample. times. This was inspired by Ref. [41], in which the authors achieved the best performance, consisting of 0.00% FAR and 0.00% FRR. Moreover, a large sample can help ensure an accurate and conclusive test result. In this study, the generated CAPTCHA word was presented on a grey background with no background lines or noise. The main aim was to prove the effectiveness of the proposed solution and increase acceptance of the submitted idea. Finally, the intention was to display the CAPTCHA to the user on the signup and log-in webpage. A'refresh CAPTCHA' button was also included, which would allow the user to view a new problem. In addition, instructions were provided to clarify that all characters were lowercase with no spaces between them. * Typed Text in the Sign-up (Enrolment) Phase During the enrolment phase of this experiment, the system began to create a biometric template for each user by asking them to enter their credentials (username, email, and password) and to solve a CAPTCHA seven times. Moreover, guidelines appeared in the sign-up and log-in pages, explaining that all characters of the CAPTCHA were lowercase letters with no spaces between them. In addition, the participants were informed that any information entered would only be used for the purposes of the research. Figure 5 depicts a screenshot of the sign-up page. * Text in the Log-in (Verification) Phase During this phase, the participants were required to enter their username and password, and to solve a CAPTCHA once on the log-in page.