Dynamic Cognitive Game CAPTCHA Usability and Detection of Streaming-Based Farming

Abstract

CAPTCHAs are a widely deployed mechanism to distinguish a legitimate human user from a computerized program trying to abuse online services. Attackers, however, have devised a clever and an economical way to bypass the security provided by CAPTCHAs by simply relaying CAPTCHA challenges to remote human-solvers. Most existing varieties of CAPTCHAs are completely vulnerable to such relay attacks, routinely executed in the wild. Dynamic Cognitive Game (DCG) CAPTCHAs are an upcoming CAPTCHA category which require the user to play a simple moving object matching game. Due to the dynamic and interactive nature of the underlying games, DCG CAPTCHAs may offer resistance to relay attacks. In this paper, we focus on a streaming-based DCG CAPTCHA relay attack whereby the game frames and responses are simply streamed between the attacker and a human-solver. We present a mechanism for detecting such a streaming-enabled game captcha farming based on realtime game statistics, such as play duration, mouse clicks and incorrect drags, fed to machine learning detection algorithms. To demonstrate the feasibility of our detection mechanism, we report on a three-dimensional study measuring: (1) the performance of legitimate DCG CAPTCHA users, (2) the performance of remote human-solvers in a DCG CAPTCHA streaming attack, and (3) the performance of gameplay behavioral features and machine learning classifiers in distinguishing human-solvers in a streaming attack from legitimate users. Our results show that it is possible to detect the streaming-based relay attack against many instances of DCG CAPTCHAs with a high overall accuracy (low false negatives and false positives). Broadly, DCG CAPTCHAs appear to be one of the first CAPTCHA schemes that enable reliable detection of relay attacks. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

CAPTCHaStar! A Novel CAPTCHA Based on Interactive Shape Discovery

“…• Increase the number of possible answers (against A12). • Analyze the behavioral features, identifying suspicious pattern of movement [24] (against A13 and A14).…”

An examination of the interactive video CAPTCHA method to resist relay attack

“…There is a DCG-CAPTCHA as an existing technique of relay attack measures [3]. In this CAPTCHA, the user has to perform a game-like cognitive task interacting with a series of dynamic images, such as playing a simple object matching game.…”

“…Relay attack was reproduced on a virtual environment using VirtualBox (see Fig.2). Furthermore, we transfer CAPTCHA challenge using VNC (Virtual Networking Computer) that was used as software for reproducing relay attack in literature [3].…”

Emerging Image Game CAPTCHAs for Resisting Automated and Human-Solver Relay Attacks

“…To answer this question, we turn to two categories of CAPTCHAs from the current literature -Emerging Image (EI) CAPTCHAs [17,18] (known to be resistant to automated attacks) and Dynamic Cognitive Game (DCG) CAPTCHAs [12,13] (known to be resistant to relay attacks). However, no current scheme is known to be simultaneously resistant to both attacks.…”

“…DCG CAPTCHA [12] is a CAPTCHA that challenges the user to perform a game-like cognitive task interacting with a series of dynamic objects in a static scene. A simple form of DCG CAPTCHAs requires the user to identify the answer object(s) from a set of moving objects, and drag-drop them to the corresponding target object(s).…”