# Investigation of Using CAPTCHA Keystroke Dynamics to Enhance the Prevention of Phishing Attacks
## 7 Results and Discussion
### Results of Average Hold Time, Up-Down (UD) Time, and Down-Down (DD) Time for Each Phisher
* Although it is possible to mimic a user's typing pattern in fixed-text systems, it is more difficult in free-text systems because it requires the attacker to observe the victim's behaviour for the duration of their logged-in session. Therefore, it is quite rare for an attacker to be able to replicate all typing rhythms of users. * Guessing: the attacker tries to guess the correct password by using the most common words that they expect all the users used. * The attacker needs to obtain the typing pattern of the user to pass the CAPTCHA test. * Dictionary attacks: the attacker attempts to defeat the authentication mechanism by determining the correct password from a large number of possibilities. * If the attacker finds the correct password, they must know the typing rhythm of the user when solving the CAPTCHA  
However, several previous studies [26; 27] used an image-based CAPTCHA to prevent phishing attacks, whereas the proposed system used a text-based CAPTCHA. Thus, the present results cannot be compared to this existing work. Besides, research by the authors of [24] used voice biometrics to protect Mpesa (a Kenyan mobile banking system) from fraud in a mobile money-transfer app. A voice trait, considered as a behaviour biometric in some cases, was adopted in the above study. However, this is incompatible with the proposed approach, which involves typing patterns. Moreover, the Mpesa approach related to a mobile platform, unlike the current study, which was conducted on a Web platform. In contrast, other studies [31; 32; 33] used free-text keystroke dynamics for English language input, and time features were applied to distinguish between user samples. It is, therefore, very tempting to compare the proposed work with previous research in the same domain, but all the earlier studies differ in the number of participants, extracted features, environment in which the experiments were conducted, and the classification methods applied. Hence, it is not possible to rely on the credibility of these comparisons. That said, the three above-mentioned studies are similar to this current work in some respects, such as \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Approach**} & \multirow{2}{*}{**Ease of Use**} & \multirow{2}{*}{\begin{tabular}{c} **Cost-** \\ **Effectiveness** \\ \end{tabular} } & \multirow{2}{*}{\
\begin{tabular}{c} **Observed** \\ **Popularity** \\ \end{tabular} } & \multirow{2}{*}{
\begin{tabular}{c} **General** \\ **Security** \\ \end{tabular} } \\ \hline
[21] & ** & ** & ** & ** \\ \hline
[22] & *** & *** & ** & ** \\ \hline
[23] & ** & ** & ** & ** \\ \hline Current & *** & *** & ** & ** \\ approach & *** & *** & ** & ** \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison between some of the related research and proposed work. in controlling the environment, the use of English language free text, and the application of Euclidean distance as a classification method. Therefore, a simple comparison may be made to identify limitations in the benchmarking of these present results against those reported in Refs. [31; 32; 33], as illustrated in Table 7. However, the proposed approach outperforms these previous studies in terms of sample size and in determining the appropriate threshold for enhancing system performance. Note that equal error rate (EER) is a value of FAR/FRR where FAR equals FRR.