# Investigation of Using CAPTCHA Keystroke Dynamics to Enhance the Prevention of Phishing Attacks
## 7 Results and Discussion
### Results of Average Hold Time, Up-Down (UD) Time, and Down-Down (DD) Time for Each Phisher  
Figure 12 shows the average hold time, UD time, and DD time for all phishing attempts to gain unauthorised access to the system. It should be noted that the system recorded the timestamp in milliseconds, as mentioned previously. The results prove the effectiveness of the proposed system for preventing phishing attacks. \begin{table}
\begin{tabular}{c c} \hline \hline
**ID** & **IP Address** \\ \hline  
\hline \hline \end{tabular}
\end{table} 
Table 4: Blocked IP addresses. Figure 11: Number of attempts made by attackers to gain access to the system. Figure 10 and 12 illustrate the unique rhythm of each participant (genuine users and phishers) generated when solving the text-based CAPTCHA. Although the values were close, there were no duplicates. Keystroke dynamics were, therefore, found to be effective in preventing phishing attacks. In addition, Figure 11 shows that some phishers made more than one attempt to gain access to the system. These repeated attempts indicate that, although the phishers obtained information about a genuine user's credentials, it was difficult to mimic the genuine user's typing dynamics when solving the CAPTCHA because the participants' typing rhythms were recorded in milliseconds. Moreover, the proposed system appeared to have many usability advantages over traditional systems in terms of its ability to operate in stealth mode, together with its low cost, lack of additional hardware, user acceptance, and ease of integration into existing security systems. However, keystroke dynamics have two disadvantages: lower accuracy (they are affected by external factors, such as fatigue or stress) and lower permanence (a user's typing pattern may change over time). The proposed system overcame these disadvantages as the experiment was conducted in a controlled environment to prove that each user's typing pattern differed. In addition, the system stored new user profiles with each successful attempt to update the user profiles stored in the database. From Table 5, it shall be inferred that the proposed model is capable of preventing phishing attacks through identifying each user from their own typing pattern as well, with promising results. Furthermore, the proposed approach was compared with those of previous studies, such as Refs. [21; 22; 23], in terms of ease of use, cost-effectiveness, observed popularity, and general security. Each of these terms is briefly explained below, as defined in Ref. [42], while the comparison is shown in Table 6.  
* Ease of use is a basic concept referring to the facility of the authentication method adopted in terms of the level of user acceptance and system availability. * Cost-effectiveness refers to an authentication method that provides excellent results without requiring high expenditure. * Observed popularity indicates the percentage popularity of the method used as compared to other types of authentication. Figure 12: Average hold time, UD time, and DD time for each phisher. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Approach** & **TPR** & **TNR** & **FPR** & **FNR** & **Accuracy** \\ \hline The proposed approach & 82.2\% & 100\% & 0\% & 17.8\% & 85\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Performance of the proposed system. General security refers to an evaluation of the safety provided by the authentication method used. In addition, the proposed study provides a high level of security to protect against traditional attacks, such as brute force, shoulder surfing, guessing, and dictionary attacks, as explained in the following:  
* Brute force: the attackers attempt to try all possible combinations of characters in the hopes to find the username and password. * If the attacker finds the username and password, they must know the typing rhythm of the user when solving the CAPTCHA. * Shoulder surfing: the attacker observes the typing pattern of the victim when solving the CAPTCHA to try mimicking typing rhythms.