Towards Understanding the Security of Modern Image Captchas and Underground Captcha-Solving Services

Image captchas have recently become very popular and are widely deployed across the Internet to defend against abusive programs. However, the ever-advancing capabilities of computer vision have gradually diminished the security of image captchas and made them vulnerable to attack. In this paper, we first classify the currently popular image captchas into three categories: selection-based captchas, slide-based captchas, and click-based captchas. Second, we propose simple yet powerful attack frameworks against each of these categories of image captchas. Third, we systematically evaluate our attack frameworks against 10 popular real-world image captchas,including captchas from tencent.com, google.com, and 12306.cn. Fourth, we compare our attacks against nine online image recognition services and against human labors from eight underground captcha-solving services. Our evaluation results show that(1) each of the popular image captchas that we study is vulnerable to our attacks;(2) our attacks yield the highest captcha-breaking success rate compared with state-of-the-art methods in almost all scenarios; and(3) our attacks achieve almost as high a success rate as human labor while being much faster.Based on our evaluation, we identify some design flaws in these popular schemes, along with some best practices and design principles for more secure captchas. We also examine the underground market for captcha-solving services, identifying 152 such services. We then seek to measure this underground market with data from these services. Our findings shed light on understanding the scale, impact, and commercial landscape of the underground market for captcha solving.

An Improved Text-Based and Image-Based CAPTCHA Based on Solving and Response Time

CAPTCHA is an acronym that stands for Completely Automated Public Turing Test to tell Computers and Humans Apart(CAPTCHA),it is a good example of an authentication system that can be used to determine the true identity of any user.It serves as a security measure to prevent an attack caused by web bots(automatic programs)during an online transaction.It can come as text-based or image-based depending on the project and the programmer.The usability and robustness,as well as level of security,provided each of the varies and call for the development of an improved system.Hence,this paper studied and improved two different CAPTCHA systems(the text-based CAPTCHA and image-based CAPTCHA).The textbased and image-based CAPTCHAwere designed using JavaScript.Response time and solving time are the two metrics used to determine the effectiveness and efficiency of the two CAPTCHA systems.The inclusion of response time and solving time improved the shortfall of the usability and robustness of the existing system.The developed system was tested using 200 students from the Federal College of Animal Health and Production Technology.The results of each of the participants,for the two CAPTCHAs,were extracted from the database and subjected to analysis using SPSS.The result shows that textbased CAPTCHAhas the lowest average solving time(21.3333 s)with a 47.8%success rate while image-based CAPTCHA has the highest average solving time was 23.5138 s with a 52.8%success rate.The average response time for the image-based CAPTCHA was 2.1855 s with a 37.9%success rate lower than the text-based CAPTCHA response time(3.5561 s)with a 62.1%success rate.This indicates that the text-based CAPTCHA is more effective in terms of usability tests while image-based CAPTCHA is more efficient in terms of system responsiveness and recommended for potential users.

子图验证码

本文提出一种简单的方法用于区分人类用户和计算机程序,称之为子图验证码。在子图验证码中,采用中文随机特征码,通过设置字体、背景加噪、扭曲图像等步骤完成对子图验证码的预处理。之后,以子图形式把子图验证码呈现出来。考虑到计算机程序在识别中文、噪声、粘连字符、扭曲图像、分离图像等方面的缺陷,人类用户很容易被区分出来,子图验证码正是利用这一特点来区分人类用户和计算机程序。最后,子图验证码采用C#语言并结合ASP.NET技术实现。

基于二维RNN的CAPTCHA识别

全自动开放式人机区分图灵测试(CAPTCHA)是基于人工智能领域开放性问题而设计的网络安全技术,CAPTCHA识别是该研究领域的重要分支.长短时记忆(Long Short Term Memory,LSTM)型递归神经网络(Recurrent Neural Network,RNN)已被成功应用于CAPTCHA识别,LSTM型RNN实质上是一维RNN,而文本型CAPTCHA为二维图像.提出使用二维RNN对CAPTCHA进行识别.二维RNN能够很好的将特征提取同识别相结合,同时具有较好的上下文保持特性,从而更适合文本型CAPTCHA识别.同时为了进一步提高识别的可靠性,提出一种基于支持向量机(Support vector machine,SVM)的拒识策略,实验结果表明二维RNN较一维RNN能够获得更好的识别率,并且新的拒识策略较其他拒识策略取得更好的拒识效果.

即时通信系统中蠕虫病毒的防范策略研究

对IM面临的来自蠕虫病毒的威胁进行分析,并对现有应用、研究工作中的解决方案进行分析,借鉴其中的成功点,提出一套IM系统中蠕虫病毒的防范策略,引入PKI机制,利用CAPTCHA等技术,通过签名、验证签名、CAPTCHA验证和IM消息流量监控等方法,确保IM消息的有效性,防范IM蠕虫病毒攻击、减轻其带来的威胁.

一种基于拒识的高可靠性CAPTCHA识别算法

CAPTCHA是一种阻止机器人滥用自然人资源的网络安全机制.研究CAPTCHA识别技术有助于发现CAPTCHA自身的缺陷,促使其变得更加安全.针对现有方法难以识别的高粘着CAPTCHA,本文提出了一种新的识别算法.该算法首先使用递归神经网络(Recurrent neural network,RNN)对CAPTCHA进行识别,然后为了提高识别结果的可靠性,提出了一种基于SVM的拒识新算法,并使用数据降维方法对拒识特征进行降维.实验结果表明:1)本文所提识别算法能够识别高粘着型CAPTCHA,并且识别结果具有高可靠性;2)新的拒识算法相对于其他拒识算法具有明显优势;3)数据降维方法能够进一步改善拒识算法的性能,从而取得更高的可靠性.

即时通信蠕虫研究综述

即时通信为个人和企业提供了更加快捷方便的通信服务,随着互联网的飞速发展,即时通信得到更为普及和广泛的应用,而即时通信蠕虫是一种利用即时通信服务进行传播的网络蠕虫,它的出现严重威胁了网络的安全。文中首先介绍了即时通信蠕虫的研究背景;然后论述了即时通信蠕虫的基本定义;接着讨论了即时通信蠕虫的网络拓扑和传播模型,归纳总结了最新防御即时通信蠕虫的技术;最后展望了需要进一步研究的方向,并探讨目前研究中存在的问题。

覆盖约简算法在Captcha识别方面的应用

Captcha是用来区分计算机与人类的一种程序,图像验证码是一种典型的Captcha。对图像验证码的发展历程进行了总结,比较了几种目前最常见验证码的特点和设计思路,提出了对一般验证码的破解方法,并设计实现了提取验证码数据的图片信息提取系统;应用基于条件信息熵的覆盖约简算法,对验证码进行识别,对比实验结果证明,识别效果良好。

结合Ajax技术开发符合JSF规范的Captcha组件

本文将JSF定制组件技术与Ajax技术结合起来开发制作了一个Captcha组件。整个组件分为两大部分:Ajax支持部分和JSF支持部分。前者主要利用Ajax技术完成组件显示图片部分的即时切换,能够实现Web页面的局部刷新,可以在切换图片的同时不对页面中其他部分产生影响;后者主要利用JSF组件封装机制将Captcha模块封装成符合JSF规范的组件,从而使该组件可以像其他JSF组件一样在Web系统中方便地部署。最后,结合具体实例介绍了该组件在Web系统中的具体使用方式。

运用C#图形编程技术实现验证码技术

该文简要讨论了验证码的基本形式、原理和作用,通过源代码较详细地分析了图片验证码ASP.NET的实现过程。

即时通信的PKI保护策略研究

对IM的主要安全威胁进行分析,提出采用SSL对通信连接进行保护;用PKI对配置信息进行加密存储,对传输的数据进行签名,加密以及解密,验证签名等安全处理;引入签名验证机制和CAPTCHA验证机制来防范可能的蠕虫病毒攻击。通过一系列的安全保护策略,对IM实行一种全方位的保护。

基于3D的CAPTCHA验证码研究

使用验证码的主要目的是保证网络的用户是真实的用户而非机器自动产生的用户,这有利于保证网站的安全,而CAPTCHA技术主要用于验证码的生成,传统的验证码生成采用的是2D-CAPTCHA技术,目前该技术已经比较成熟,因此,针对此技术的攻击的研究也比较多,导致了该技术使用的不安全性系数增加.针对这一问题,文章研究了CAPTCHA技术的发展新动向3D-CAPTCHA技术.

The Recognition of CAPTCHA

CAPTCHA is a completely automated program designed to distinguish whether the user is a computer or human. As the problems of Internet security are worsening, it is of great significance to do research on CAPTCHA. This article starts from the recognition of CAPTCHAs, then analyses the weaknesses in its design and gives corresponding recognition proposals according to various weaknesses, finally offers suggestions related to the improvement of CAPTCHAs. Firstly, this article briefly introduces the basic steps during the decoding process and their principles. And during each step we choose methods which are better adapted to the features of different CAPTCHA images. Methods chosen are as followings: bimodal method in binarization, improved corrosion algorithm in denoising, projection segmentation method in denoised image processing and SVM in recognition. Then, we demonstrate detailed process through the samples taken from the online registration system of ICBC, show the recognition effect and correct the results according to the statistical data in the process. This article decodes CAPTCHAS from three other large banks in the same way but just provides the recognition results. Finally, this article offers targeted suggestions to the four banks based on the recognition effect and analysis process stated above.

基于卷积神经网络的数字验证码识别研究

验证码技术是确保网站安全性和用户信息隐私性的第一道保障。针对多样化的验证码,其识别技术也很多,传统验证码技术主要分为人工识别、字典模型识别和验证码图像分割识别,其中字典模型中较为典型的Tesseract-OCR,其识别率相对较低,过程操作复杂,需要对识别错误的文字做出修改不适合对复杂验证码做出高效迅速的识别。本文使用TensorFlow框架实现卷积神经网络算法对验证码进行识别,利用Captcha包下提供的ImageCaptcha()方法生成模拟现实网站的验证码,利用卷积神经网络对生成的验证码进行训练生成训练模型,通过训练模型进行对测试集的测试得到识别率,识别率可达到97%以上远超传统验证码识别算法。

融合多重风格迁移和对抗样本技术的验证码安全性增强方法

验证码对于防御Web服务的自动攻击具有重要作用,但面对具有自动识别技术的破解工具时,难以实现有效的安全保护。如果采用高度失真等方式增强验证码的安全性,会使验证码失去原来的形状,导致人眼也难以识别。文章提出一种融合多重风格迁移和对抗样本技术的验证码安全性增强方法,在保留原有内容的同时利用多重风格迁移方式抵御未知的机器识别,再通过对抗样本技术攻击已知的常见模型,从而欺骗神经网络。在文本验证码数据集上的实验结果表明,文章提出的生成算法具有更低的机器识别率,有效提高了文本验证码的安全性。

Adaptive Median Filtering Algorithm Based on Divide and Conquer and Its Application in CAPTCHA Recognition

As the first barrier to protect cyberspace,the CAPTCHA has made significant contributions to maintaining Internet security and preventing malicious attacks.By researching the CAPTCHA,we can find its vulnerability and improve the security of CAPTCHA.Recently,many studies have shown that improving the image preprocessing effect of the CAPTCHA,which can achieve a better recognition rate by the state-of-theart machine learning algorithms.There are many kinds of noise and distortion in the CAPTCHA images of this experiment.We propose an adaptive median filtering algorithm based on divide and conquer in this paper.Firstly,the filtering window data quickly sorted by the data correlation,which can greatly improve the filtering efficiency.Secondly,the size of the filtering window is adaptively adjusted according to the noise density.As demonstrated in the experimental results,the proposed scheme can achieve superior performance compared with the conventional median filter.The algorithm can not only effectively detect the noise and remove it,but also has a good effect in preservation details.Therefore,this algorithm can be one of the most strong tools for various CAPTCHA image recognition and related applications.

浅析基于特征提取的垃圾图像过滤算法的实现

随着现代社会科学技术的进一步发展，人们使用电子邮件作为通讯手段的频率也随之增加，但垃圾电子邮件不断的泛滥，如何过滤这些垃圾邮件已成为当前的一个热门研究方向。本文提出了一种基于Kolmogorov（柯尔莫哥洛夫）复杂性的垃圾图像命誊过滤模型，希望能为垃撂图像过滤机制的发展提供参考性的建议。

手写口令系统的设计与实现

本文主要介绍了对android手写口令方法的改进,阐述了手势图像获取和SVM模型训练的基本原理。描述了在android平台上对手写口令系统的设计与实现,采用CAPTCHA图片验证码提高系统的安全性。实验结果说明系统具有一定的鲁棒性,并在此基础上提出进一步的工作。

Your CAPTCHA Recognition Method Based on DEEP Learning Using MSER Descriptor

Individuals and PCs(personal computers)can be recognized using CAPTCHAs(Completely Automated Public Turing test to distinguish Computers and Humans)which are mechanized for distinguishing them.Further,CAPTCHAs are intended to be solved by the people,but are unsolvable by the machines.As a result,using Convolutional Neural Networks(CNNs)these tests can similarly be unraveled.Moreover,the CNNs quality depends majorly on:the size of preparation set and the information that the classifier is found out on.Next,it is almost unmanageable to handle issue with CNNs.A new method of detecting CAPTCHA has been proposed,which simultaneously solves the challenges like preprocessing of images,proper segmentation of CAPTCHA using strokes,and the data training.The hyper parameters such as:Recall,Precision,Accuracy,Execution time,F-Measure(H-mean)and Error Rate are used for computation and comparison.In preprocessing,image enhancement and binarization are performed based on the stroke region of the CAPTCHA.The key points of these areas are based on the SURF feature.The exploratory outcomes show that the model has a decent acknowledgment impact on CAPTCHA with foundation commotion and character grip bending.

Usability and Security of Arabic Text-based CAPTCHA Using Visual Cryptography

Recently,with the spread of online services involving websites,attack-ers have the opportunity to expose these services to malicious actions.To protect these services,A Completely Automated Public Turing Test to Tell Computers and Humans Apart(CAPTCHA)is a proposed technique.Since many Arabic countries have developed their online services in Arabic,Arabic text-based CAPTCHA has been introduced to improve the usability for their users.More-over,there exist a visual cryptography(VC)technique which can be exploited in order to enhance the security of text-based CAPTCHA by encrypting a CAPTCHA image into two shares and decrypting it by asking the user to stack them on each other.However,as yet,the implementation of this technique with regard to Arabic text-based CAPTCHA has not been carried out.Therefore,this paper aims to implement an Arabic printed and handwritten text-based CAPTCHA scheme based on the VC technique.To evaluate this scheme,experi-mental studies are conducted,and the results show that the implemented scheme offers a reasonable security and usability levels with text-based CAPTCHA itself.