# Enhancing Security of Online Interfaces: Adversarial Handwritten Arabic CAPTCHAs Generation
## 3 Methodology
### Evaluation
#### 3.3.1 Security Evaluation  
The goal of the security evaluation was to assess the effectiveness of the perturbation techniques at preventing automated recognition of the generated CAPTCHAs. The recognition results were analyzed to determine the recognized rates achieved by each adversarial perturbation technique. Higher recognition rates indicated better security against bots. The following outlines the experimental set-up and procedure used to test the CAPTCHA system's security:  
* Experimental Set-Up: This section describes the experimental set-up for the security evaluation. * System: To evaluate the security of the adversarial CAPTCHAs, the Google Vision API was used [50] to recognize perturbed images. Google Vision is a model that uses machine learning to identify images that can be considered representative of modern bot capabilities. The Cloud Vision API provided an important benchmark for assessment, given its prevalence and high accuracy. * API Version: the testing was done using the latest stable version of the Google Cloud Vision API, which is currently version v1. * Input Data Format: the Vision API can process a variety of input data formats, including image files (JPEG, PNG, GIF, BMP) and base64-encoded image data. * Computer Vision Tasks: the testing involves evaluating the API's performance on common computer vision tasks, such as the following:* Image labeling: identifying and classifying objects, scenes, and activities in images. * Facial detection and recognition: detecting and identifying faces in images. * Optical character recognition (OCR): extracting text from images. * Logo detection: identifying logos within images. * Web detection: annotating images with information about the web entities they contain. * API Parameters: the testing involves experimenting with different API parameters, such as the following:
* Image source (file, base64-encoded). * Vision feature types to enable (e.g., LABEL_DETECTION, FACE_DETECTION). * Language model to use for text-related features. * Confidence thresholds for detected entities. * Validation (Text Detection (OCR)):
* Arabic Text: validate accuracy for handwritten/printed Arabic text. * Mixed Languages: test images with Arabic + Latin script. Validation:
* Ground Truth: compare API output with known text. * Accuracy Metric: Accuracy = (Correctly Recognized Characters/Total Characters) \(\times\) 100
* Dataset: The experimental set up included creating a dataset of 60 Arabic handwritten word CAPTCHA images (30 meaningful words, 30 meaningless words). The images were generated using [PERSON]'s [PERSON]'s [PERSON] (2018) model for generating meaningless words, with an improved model used to generate the meaningful words. The images were then categorized based on whether they were meaningful or meaningless. Arabic CAPTCHA images with perturbed handwritten words were then produced using five different perturbation techniques. These perturbed images were categorized into five groups based on the perturbation methods used. Finally, a total dataset of 300 perturbed Arabic handwritten word CAPTCHA images was compiled to be used in the security evaluation experiment. * Base dataset: 60 Arabic handwritten CAPTCHAs (30 meaningless, 30 meaningful). * Perturbed dataset: 300 CAPTCHAs (5 techniques \(\times\) 60 images). * Source: synthetic generation using PHP scripts and a MySQL database of 250+ Arabic letter images in varied styles. * Meaningless words: random strings of 3-9 Arabic characters. * Meaningful words: selected from a dictionary of 10,000 common Arabic words, stripped of diacritics. * Training/Testing Split: no traditional split; all CAPTCHAs were generated and evaluated. * Experimental Procedure: This section describes the experimental procedure for the security evaluation. * The 300 perturbed CAPTCHA images with different adversarial perturbations were tested using Google Vision (2018).