Abstract A Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA) is a simple test that is used on websites to differentiate between human users and automated attacks that indulge in spamming and other fraudulent activities. A text‐based CAPTCHA is the most popular security technique used by many websites on the Internet, such as Microsoft, Google and eBay, to secure their sites from automated attacks. By design, however, a CAPTCHA is unable to differentiate between a legitimate human user and a human‐based attacker. This may make websites vulnerable to human‐based attacks while using CAPTCHAs. Hence this article proposes a novel defence system using the keystroke dynamic approach. To evaluate our system, a laboratory experiment was conducted and the results showed that the proposed system is able to detect human‐based attacks on text‐based CAPTCHAs effectively with a 100% detection rate.

Authentication in mobile devices is inherently vulnerable to attacks and has the weakness of being susceptible to shoulder-surfing attack. Shoulder-surfing attack is a type of attack that uses direct observation techniques such as looking over someone’s shoulder to get information. This paper aims to introduce a novel way of concealing the password within a contingent of randomly selected entries. In particular, the traditional password concept where what you input is what you get is redefined by proposing the camouflage characters approach. Based on this approach, three defensive techniques are introduced for mobile devices. By using an Android platform, the introduced techniques are implemented. Experimental studies are conducted in order to evaluate both security and usability perspectives. The empirical results showed that the proposed approach is reasonably resistant against shoulder-surfing attacks and usable for participants. Moreover, it is possible to choose very short passwords, while insuring that the password remains hidden amongst a large number of key presses. Based on the achieved results, the proposed approach is recommended to be a new avenue in the field of security to produce very simple and yet very complicated passwords, to be observed by the attacker, at the same time.

The keystroke dynamic authentication (KDA) technique was proposed in the literature to develop a more effective authentication technique than traditional methods. KDA analyzes the rhythmic typing of the owner on a keypad or keyboard as a source of verification. In this study, we extend the findings of the system by analyzing the existing literature and validating its effectiveness in Arabic. In particular, we examined the effectiveness of the KDA system in Arabic for touchscreen‐based digital devices using two KDA classes: fixed and free text. To this end, a KDA system was developed and applied to a selected device operating on the Android platform, and various classification methods were used to assess the similarity between log‐in and enrolment sessions. The developed system was experimentally evaluated. The results showed that using Arabic KDA on touchscreen devices is possible and can enhance security. It attains a higher accuracy with average equal error rates of 0.0% and 0.08% by using the free text and fixed text classes, respectively, implying that free text is more secure than fixed text.

Purpose Nowadays, there is a high demand for online services and applications. However, there is a challenge to keep these applications secured by applying different methods rather than using the traditional approaches such as passwords and usernames. Keystroke dynamics is one of the alternative authentication methods that provide high level of security in which the used keyboard plays an important role in the recognition accuracy. To guarantee the robustness of a system in different practical situations, there is a need to examine how much the performance of the system is affected by changing the keyboard layout. This paper aims to investigate the impact of using different keyboards on the recognition accuracy for Arabic free-text typing. Design/methodology/approach To evaluate how much the performance of the system is affected by changing the keyboard layout, an experimental study is conducted by using two different keyboards which are a Mac’s keyboard and an HP’s keyboard. Findings By using the Mac’s keyboard, the results showed that the false rejection rate (FRR) was 0.20, whilst the false acceptance rate (FAR) was 0.44. However, these values have changed when using the HP’s keyboard where the FRR was equal to 0.08 and the FAR was equal to 0.60. Research limitations/implications The number of participants in the experiment, as the authors were targeting much more participants. Originality/value These results showed for the first time the impact of the keyboards on the system’s performance regarding the recognition accuracy when using Arabic free-text.

Handwritten CAPTCHAs can be generated from pre-written or synthesized words, with added distortions and noise to survive OCR attacks. This paper takes a different approach for generating CAPTCHAs: use OCR operations themselves to secure the CAPTCHAs. Therefore, we utilize a number of operations found in many handwriting recognition systems (like, segmentation, baseline detection, etc.) to distort a pre-written word image itself, so that breaking the resulting CAPTCHA becomes more difficult. These OCR operations are in addition to the global image distortions that are generally done on the CAPTCHAs. The proposed method is reported for Arabic handwritten words as the cursive script of Arabic allows various OCR operations on it. To the best of our knowledge, this work is the first to generate Arabic handwritten CAPTCHAs. We evaluate our method on KHATT database of offline Arabic handwritten text. In terms of usability, we have achieved 88% to 90% accuracy. Security evaluation is done using holistic word recognition with accuracy less than 0.5%. Lexicon based attack is made difficult by working at Arabic sub-word level and then randomly selecting sub-words to build a CAPTCHA.

While security algorithms are utilized to protect system resources from misuse, using a single algorithm such as CAPTCHAs and Spam-Filters as a defence mechanism can work to protect a system against current attacks. However, as attackers learn from their attempts, this algorithm will eventually become useless and the system is no longer protected. We propose to look at a set of algorithms as a combined defence mechanism to maximize the time taken by attackers to break a system. When studying sets of algorithms, diverse issues arise in terms of how to construct them and in which order or in which combination to release them. In this paper, we propose a model based on Stochastic Petri Nets, which describe the interaction between an attacker, the set of algorithms used by a system, and the knowledge gained by the attacker with each attack. In particular, we investigate the interleaving of dependent algorithms, which have overlapping rules, with independent algorithms, which have a disjoint set of rules. Based on the proposed model, we have analyzed and evaluated how the order can impact the time taken by an attacker to break a set of algorithms. Given the mean time to security failure (MTTSF) for a system to reach a failure state, we identify an improved approach to the release order of a set of algorithms in terms of maximizing the time taken by the attacker to break them. Further, we show a prediction of the attacker's knowledge acquisition progress during the attack process.

An intrusion and attack detection system usually focuses on classifying a record as either normal or abnormal. In some cases such as insider attacks, attackers rely on feedback from the attacked system, which enables them to gradually manipulate their attempts in order to avoid detection. This paper proposes the notion of accumulative manipulation that can be observed through a number of attempts accomplished by the attacker, which forms the basis of the Attacker Learning Curve (ALC). Based on a controlled experiment, we first show that the ALC for three different attack strategies are consistent between two different groups of subjects. We then define a strategy detection mechanism, which is experimentally shown to be accurate more than 70% of the time.

CAPTCHA is a test that can, automatically, tell human and computer programmes apart. It is now almost a standard security technology, and has found widespread application on commercial websites. Robustness and usability are two fundamental aspects with CAPTCHA. The robustness of a text CAPTCHA is typically determined by the strength of its segmentation-resistance mechanism. The mechanism of Crowding Character Together (CCT) has been shown to be reasonably resistant to known attacks. On the other hand, such an approach can reduce the usability by making characters very difficult to recognize. This paper proposes an optimiser that automatically enhances the usability of a CAPTCHA design. A key point of this optimiser is that the usability of the CAPTCHA scheme is improved without sacrificing its robustness level. Applying the proposed optimiser will be shown to achieve a significant improvement in the usability of CAPTCHA.