# Investigation of Using CAPTCHA Keystroke Dynamics to Enhance the Prevention of Phishing Attacks
###### Abstract
Furthermore, biometric authentication is another promising trend for combatting phishing attacks. There are a number of different systems that apply biometric information as a means of identifying people, as in the case of civil, government, and healthcare identification. Biometric authentication schemes have been gaining popularity over other types of authentication in recent years since they provide high security to protect people's identities and are easily combined with traditional authentication techniques. Biometric information may be divided approximately into physiological and behavioural characteristics. The biometric information used in physiological authentication techniques is derived from an individual's physical traits, such as fingerprint and face recognition. However, the measurement of these characteristics is very costly to deploy, as is the accompanying hardware. Conversely, behavioural characteristics are based on what users have learned or acquired that differentiates them from others. These include keystroke and mouse dynamics. Out of the many possible biometric traits, keystroke dynamics are the most popular and have been extensively studied for recognition purposes [12]. Recent research has investigated the effectiveness of keystroke dynamics in order to increase the level of security in authentication systems. These studies have varied in their approach, adopting different classes of keystroke dynamics (for example, free- and fixed-text), pattern classification techniques (such as statistical and machine-learning), and experimental environments (controlling or non-controlling). All have yielded promising results, but the results obtained with free text are undoubtedly more secure than those produced with fixed text. Moreover, numerous studies have sought to explore the intrinsic benefits of free-text keystroke dynamics in providing continuous and non-intrusive authentication. Therefore, this current study investigates the effectiveness of incorporating free-text keystroke dynamics into completely automated public Turing test sentences (CAPTCHAs) in order to be able to distinguish between computers and humans (CAPTCHAs), thereby preventing phishing attacks. CAPTCHA technology has played a significant role as a defence mechanism, protecting Web security from malicious bot programmers across the Internet. It is one of the recognised shields used to distinguish between humans and computer programs (bots). CAPTCHA technology generates simple tests based on problems that humans can solve with ease but that are difficult for computers (i.e., artificial intelligence [AI]) [13]. When the right answer is received, it is, consequently, assumed that it was entered by a human, so the user is given access to the system [14]. CAPTCHAs exist on most websites and are mainly classified into four types: image-, audio-, video-, and text-based. Text-based CAPTCHAs are one of the most widely used CAPTCHA schemes, requiring users to read distorted text (digits/letters) that is presented in an image in registration or log-in forms. Users must recognise and write the text in the input text box to obtain validation. Only then will they be granted access to the site, provided that the input text matches the CAPTCHA characters and/or digits. This task supposedly cannot be solved by AI programs. Popular platforms, such as Microsoft, Google, eBay, and Yahoo, have used this scheme as a security arrangement to authenticate users and enhance website security. In this study, the term 'CAPTCHA' refers solely to text-based CAPTCHAs. The following is a summary of this study:  
* Designed and implemented an effective and secure approach to investigate the effectiveness of using CAPTCHA keystroke dynamics in enhancing the prevention of phishing attacks. * Analysed the existing schemes to design effective CAPTCHA, which helps to take advantage of keystroke dynamics to prevent phishing attacks. * Significant time features were selected, representing users' typing behaviour, and measured according to the existing literature.