# CAPTCHA Types and Breaking Techniques: Design Issues, Challenges, and Future
Research Directions

Noshina Tariq<EMAIL_ADDRESS>1234-5678-9012 Department of
Avionics Engineering,  Air UniversityService Road E-9/E-8IslamabadPakistan ,
Farrukh Aslam Khan  Center of Excellence in Information Assurance, King Saud
UniversityP.O. Box 92144Riyadh, 11653Saudi Arabia<EMAIL_ADDRESS>,  Syed
Atif Moqurrab<EMAIL_ADDRESS>School of Computing, Gachon University1342,
Seongnam-daero, Sujeong-gu, Seongnam-si, 13120SeongnamSouth Korea and  Gautam
Srivastava<EMAIL_ADDRESS>Brandon UniversityBrandon, MB R7A
6A9,BrandonCanada

(2018)

###### Abstract.

The proliferation of the Internet and mobile devices has resulted in malicious
bots’ access to genuine resources and data. Bots may instigate phishing,
unauthorized access, denial-of-service, and spoofing attacks, to mention a
few. Authentication and testing mechanisms to verify the end-users and
prohibit malicious programs from infiltrating the services and data are strong
defense systems against malicious bots. Completely Automated Public Turing
test to tell Computers and Humans Apart (CAPTCHA) is an authentication process
to confirm that the user is a human; hence, access is granted. This paper
provides an in-depth survey on CAPTCHAs and focuses on two main things: (1) a
detailed discussion on various CAPTCHA types along with their advantages,
disadvantages, and design recommendations, and (2) an in-depth analysis of
different CAPTCHA breaking techniques. The survey is based on over two hundred
studies on the subject matter conducted since 2003 to date. The analysis
reinforces the need to design more attack-resistant CAPTCHAs while keeping
their usability intact. The paper also highlights the design challenges and
open issues related to CAPTCHAs. Furthermore, it also provides useful
recommendations for breaking CAPTCHAs.

††copyright: acmcopyright††journalyear: 2023††doi:
10.1145/1122445.1122456††journal: CSUR††journalvolume: 00††journalnumber:
0††article: 000††publicationmonth: 2††ccs: CAPTCHA††ccs: CAPTCHA types††ccs:
CAPTCHA breaking techniques

##  1\. Introduction

The Internet is a primary mode of communication in the modern age of the
Internet of Things (IoT) (tariq2021blockchain, ). The availability of a
diverse range of mobile devices and more affordable high-speed data
subscriptions boosted consumers’ interest in Internet use. From its inception,
Internet security has been the primary concern of web developers. As the
Internet continues to grow for providing various websites, services, and blogs
likewise grow. Today’s websites are dedicated to the public, transportation,
entertainment, financial services, food items, healthcare, and hotel
reservations, to mention a few. In this regard, the growing user base also
necessitates the deployment of high-end computing power at the websites
(derhab2021tweet, ). However, these high-end processors are rendered
ineffective if the high-end automated device targets them. Therefore, the
defense against such automated attacks is imperative. However in an open-
access network environment, the ubiquity of the Internet is encouraging
security threats for individuals gaining network access. It is not an easy
task for the web service providers to understand whether a certain application
is accessed by a bot or a human user (tanthavech2019captcha, ).

Nonetheless, bot programs are extremely useful to carry out cyclic and time
intense operations. Oppressed for malevolent work, bot programs have human
behavior reproduction ability. Therefore, security is the main ingredient in a
reliable communication interface (chow2019CAPTCHA, ). It points to sheltering
and protecting networks from vicious attacks. Introducing security services in
computer networks seeks to deliver convenient, reliable, and classified
application environment (ul2021ctrust, ) (ahmed2018malicious, )
(imran2019toward, ), and (ouyang2021cloud, ). There is various computer
exploitation, including worms, spoofing, viruses, and network crossing.
Moreover, other kinds of attacks would be unauthorized ones: covert channels,
Denial of Services (DoS), and compromised and malicious nodes, to name a few
(gonen2018secure, ). A majority of Completely Automated Public Turning test to
tell Computers and Humans Apart (CAPTCHA) systems have been proposed that use
various features, such as characters, images, and audio, to generate
challenges that effectively prevent automated bots. However, recent
advancements in Artificial Intelligence (AI) in general and Computer Vision
(CV) in particular have greatly improved automated systems’ ability to solve
such tasks (wang2023experimental, ; zhang2023secure, ). As a consequence,
almost all conventional CAPTCHA systems have been compromised. Hence, there
needs to have an in-depth analysis of CAPTCHA formation and its breaking
techniques to make them more robust and usable.

CAPTCHA (AKA Human Interaction Proof (HIP)) is introduced to mitigate spurious
network resources access (wang2023extended, ; tariq2019securing, ;
kumar2021benchmarks, ). It was coined in 2000 by Luis Von Ahn at Carnegie
Mellon University (tariq2018match, ). It is a protection method for avoiding
electronic registration, spam, and harmful bot applications. They are well-
known for providing practical security by differentiating humans from
computers; for example, lock-free Email services, shielding online polling
against online voting bots, or malicious email sign-ups. They are effective in
handling email worms and spam and in preventing dictionary-based password
attacks (von2003CAPTCHA, ). In general, a test that is simple for people to
solve and difficult for computers is generated and evaluated. It is deemed
successful if its success rate in human solutions is greater than 90%, and
computers reach just a success rate of less than 1% (lazar2012soundsright, ).
A strong CAPTCHA is generally known, not only functional but stable. It is
continuously evolving technology and is increasingly growing in literature and
practice. The emerging literature references must be summarised, and a more
comprehensive analysis of CAPTCHAs must be carried out.

Various models have appeared after CAPTCHAs have been produced. Among
different types of CAPTCHAs, text-based CAPTCHAs are widely used
(chow2019CAPTCHA, ), Fig. 1 shows some examples of text-based CAPTCHAs
(banday2009image, ). However, researchers attack CAPTCHAs to identify which
interface features are good for its protection to make it resilient. This
paper presents an in-depth and exhaustive study of different CAPTCHA schemes
and their breaking techniques proposed from 2003 to date. We analyzed its
types regarding their strengths and weaknesses. This paper also presents the
major applications of CAPTCHAs. We also studied several CAPTCHA breaking
techniques, which are discussed later in the paper. Based on our comprehensive
study and analysis, we classified CAPTCHA types into OCR and non-OCR
categories presented in Section 4. We also classified CAPTCHA breaking
techniques into four categories discussed in Section 6. Later, we present
several challenges and open issues related to CAPTCHA designs and breaking.

Figure 1. Different kinds of text CAPTCHAs.

This paper has the following major contributions:

  1. (1)

The classifications (taxonomies) of CAPTCHA types and breaking techniques is
presented and thoroughly analyzed.

  2. (2)

An analysis of state-of-the-art CAPTCHA survey papers (for both construction
and breaking) is done, highlighting their contributions and missing research
areas in the said domain.

  3. (3)

CAPTCHA practices and applications are discussed, helping readers better
understanding the areas where CAPTCHAs may be useful.

  4. (4)

Based on CAPTCHA formation, exhaustive state-of-the-art study and analysis are
presented. In line with CAPTCHA types, advantages and disadvantages accordant
with the proposed taxonomies are also provided for engineering better designs.

  5. (5)

Based on CAPTCHA breaking techniques, a comprehensive state-of-the-art study
and analysis are presented to fix the loopholes in CAPTCHA designs that may be
exploited by the attackers.

  6. (6)

In-depth analysis and future prospects of design issues and challenges are
imparted encompassing a prolific discussion on CAPTCHA sturdiness and
usability.

In this survey paper, Section 2 presents related work that provides a
comparison among state-of-the-art survey. In Section 3, important CAPTCHA
application areas are discussed. Section 4 presents different CAPTCHA
techniques based on their formation and design. Challenges and open issues in
CAPTCHAs designs are discussed in Section 5. Section 6 represents the survey
of state-of-the-art CAPTCHA breaking algorithms. Section 7 presents a
productive discussion on CAPTCHA robustness and usability along with the
challenges and open issues, and Section 8 gives the conclusion and future
directions.

##  2\. Related surveys

This section briefly discusses state-of-the-art surveys from 2010 to date.
Table 1 presents a comparison between state-of-the-art and this paper. We
compared contributions and the subject matter, such as the survey about
CAPTCHA types, attacks on CAPTCHAs or both. It is also investigated that the
survey has proposed any taxonomy of CAPTCHA types or its breaking techniques
or not. That helps readers to understand the subject matter in a modular way.
It is also essential that a survey discusses challenges and open issues
associated with the subject matter from our perspective. That helps the
readers to find the gaps and future research directions.

Table 1. Comparison among state-of-the-art surveys Ref. | Year | Type-based | Attack-based | Applications | Taxonomy | Challenges & Open issues | Recommendations
---|---|---|---|---|---|---|---
This paper | 2023 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
(alsuhibany2023survey, ) | 2023 | ✓ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
(kumar2022systematic, ) | 2022 | ✓ | ✓ | ✓ | $\times$ | $\times$ | $\times$
(magdy2021comprehensive, ) | 2021 | ✓ | ✓ | $\times$ | ✓ | $\times$ | $\times$
(kumar2021systematic, ) | 2021 | ✓ | ✓ | ✓ | $\times$ | $\times$ | $\times$
(srivastava2021survey, ) | 2021 | $\times$ | ✓ | $\times$ | $\times$ | $\times$ | $\times$
(kumar2021captcha, ) | 2021 | ✓ | $\times$ | $\checkmark$ | $\times$ | $\times$ | $\times$
(Zhang2019survey, ) | 2019 | ✓ | ✓ | $\times$ | $\times$ | ✓ | $\times$
(xu2020survey, ) | 2020 | ✓ | ✓ | $\times$ | $\times$ | $\times$ | $\times$
(dionysiou2020sok, ) | 2020 | $\times$ | ✓ | $\times$ | $\times$ | $\times$ | $\times$
(divyashree2016survey, ) | 2016 | ✓ | $\times$ | ✓ | $\times$ | $\times$ | $\times$
(guerar2018completely, ) | 2018 | ✓ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
(greene2018large, ) | 2018 | ✓ | ✓ | $\times$ | $\times$ | $\times$ | $\times$
(roshanbin2013survey, ) | 2013 | ✓ | ✓ | $\times$ | $\times$ | ✓ | $\times$
(moradi2015captcha, ) | 2015 | ✓ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
(bursztein2010good, ) | 2010 | ✓ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
(banday2011study, ) | 2011 | ✓ | ✓ | $\times$ | $\times$ | $\times$ | $\times$

Magdy et al. (magdy2021comprehensive, ) presented a survey on CAPTCHA types
and breaking techniques. Though they have discussed its different types and
limited usability issues; however, the survey is not comprehensive. Kumar et
al. (kumar2021systematic, ) presented a systematic survey on CAPTCHAs. This
paper encompasses a good discussion of different CAPTCHAs and their breaking.
However, types and attacks are not classified as the techniques used in their
breaking. Moreover, it does not discuss challenges and open issues in CAPTCHA
designing and breaking. However, our paper provides a more comprehensive
survey on CAPTCHA types and breaking techniques. Still, it also discusses
challenges and open issues in this regard, along with the recommendations for
designing and breaking CAPTCHAs. Zhang et al. (Zhang2019survey, ) discuss the
advancements made scientifically and technologically on CAPTCHAs’ design and
attacks. They discussed the usability, robustness, and limitations of
different types of CAPTCHAs. Besides, the attack techniques and differences
between the formation of CAPTCHAs are categorically debated. This paper
discusses recommendations for future studies and suggests several issues that
require extra analysis. However, a taxonomy of types and breaking techniques
is not presented.

The CAPTCHA usability and its progression technology are also assessed in
(xu2020survey, ). It examines the CAPTCHA mechanisms from usability and
security aspects, unlike other studies that have been done on it. The
introduction of new CAPTCHA formats (game CAPTCHA) and attacking methods (deep
learning-based attacking) are also included in this paper. However, they do
not present a taxonomy and a discussion about challenges and open issues.
Besides, (dionysiou2020sok, ) carries out methodical investigation and
categorization. The study is based on the ultramodern ML-based method for
self-operating text-based CAPTCHA breaking issues. An investigation into the
present status and robustness of text-based CAPTCHA is also presented. The
present-day Internet users use it to counter ML-based automated breaking tools
in this paper. This literature also recommends that ML-based as a breaking
tool is very efficacious because of its speed, precision, and reverie in the
CAPTCHA solution. This paper encourages combatting the issues associated with
current internet services and ML-based methods; a reverse Turing test is
encouraged in this paper. Reverse Turing systems are recommended because they
offer less stress to human users and give computer/robots challenging
problems. However, the paper does not present a taxonomy of the CAPTCHA types
or their breaking techniques. It also lacks in discussing challenges and open
issues in this regard.

CAPTCHA types, their usability, and deficiencies are discussed in
(divyashree2016survey, ). However, this survey focuses on CAPTCHA types only.
Moreover, it does not discuss attacks made on CAPTCHAs. It also does not
present a taxonomy and the challenges and open issues associated with CAPTCHA
types. (guerar2018completely, ) compares CAPTCHA and completely automated
public physical test to tell computers and humans apart (CAPPCHA). CAPPCHA and
CAPTCHA are alike because they are both used to protect websites from abusive
automated programs. As discussed in this paper, CAPPCHA improves the
authentication technique required for mobile devices. Besides, a proof of
concept is also provided. However, an extensive analysis of the subject must
be carried out to confirm the efficiency of CAPPCHA. Therefore, this paper
aims to thoroughly investigate CAPTCHA’s officiousness and its usability
involving several human users. However, this paper also does not talk about
CAPTCHA breaking techniques, taxonomy, and challenges.

In (greene2018large, ), keywords, such as; login, cart, registration, account,
post, auth, join, register, sign, password, and subscribe, were used by a
personally web designed crawler. The crawler makes use of a beautiful soup
library to investigate 30,000 websites and check if they use CAPTCHA to
protect their URLs. This paper also examines and categorizes CAPTCHA as
regards its limitations. Out of 30,000 web pages, only 10,017 uses CAPTCHA.
According to the facts provided by this survey, the most used CAPTCHA
includes; text/image-based CAPTCHA, reCAPTCHA, text-based CAPTCHA, math,
slider, FunCAPTCHA, custom, and audio-based CAPTCHA. However, taxonomy and
open issues are not addressed in this paper.

(roshanbin2013survey, ) discusses three essential things. They include; recent
CAPTCHAs and associative attacks, the inquiry into the vigor and usefulness of
recently introduced CAPTCHAs, and propose new techniques to improve recently
introduced CAPTCHAs. However, the paper does not suggest a taxonomy.
(moradi2015captcha, ) explores substitutes of CAPTCHA, usability, and services
provide researchers with enough information so that new techniques and
solutions can be suggested. Thus far, the positive strides made in CAPTCHA
advancements, various CAPTCHAs substitutes, were categorized, evaluated, and
compared with their shortcomings. Solutions to the shortcoming were also
proposed. However, CAPTCHA breaking is out of the scope of this paper.
Besides, there is no proposed taxonomy, and no discussion on open issues are
discussed either.

From the human standpoint, (bursztein2010good, ) extensively reviews CAPTCHAs
to gauge how much an average user is affected by CAPTCHA. However, this paper
focuses only on CAPTCHA types. There is no taxonomy presented. There is no
discussion on open issues and challenges presented in the paper. Similarly,
Bandy et al. (banday2011study, ) presented a classification of CAPTCHAs and
compared its different kinds. The CAPTCHAs are classified and compared as
regards their usability and security. Conventional methods for generating and
breaking text and image-based CAPTCHA are also introduced. Lastly, this paper
recommends various ways to enhance vigor, usability and to tackle security
issues. However, taxonomy and open issues are not discussed.

##  3\. CAPTCHA Practices

There are several CAPTCHA practices and applications; this section highlights
some of the most common practised CAPTCHA applications below:

###  3.1. Mitigating e-mail (address) security and spams

Ahn et al. (von2004labeling, ) described how web scrapers (programs that
extract data from websites) might be prevented from obtaining users’ e-mail
addresses by requiring them to answer a CAPTCHA prior to revealing their
e-mail addresses. It may also be used for the prohibition on the use of fake
e-mail addresses. Most businesses offer complimentary e-mail services in
today’s information era. They are the targeted victims of bot assaults.
Numerous businesses adopt such methods to obtain complimentary e-mail
addresses to distribute spam. A most effective yet simplest way of avoiding
unwanted bot assaults is to utilise CAPTCHA-based security. Pope and Kaur
(pope2005human, ) highlighted that the majority of e-mail providers had
implemented such an approach.

###  3.2. Phishing Attacks Prevention

Phishing is a technique used by unethical attackers (e.g., hackers and
crackers) to gain access to online banking, e-voting, social media, and e-mail
accounts by displaying a similar false web page to the account owner
(kheshaifaty2020preventing, ) (tariq2018match, ). For instance, these
attackers send a link to certain targeted account holders through the e-mail
accounts, and by clicking the link, they submit sensitive details, such as
usernames and passwords. It results in the loss of confidential information
such as official records or project bids. Phishing attackers collect bank
information such as usernames, passwords, and credit/debit card information.
Certain websites are legitimate financial websites, and some are duped into
providing personal and private web to these false websites. These attackers do
not utilise their method to break internet accounts, which makes the tracking
very challenging. Additionally, cyber law is not sufficient to prosecute such
unethical hackers (kumar2021systematic, ). Under such cases, certain
countermeasures must be adopted in conjunction with a strong authentication
process. Hence, CAPTCHA is inevitable in both bot and phishing attack
scenarios.

###  3.3. Banning robots from playing games

Using the CAPTCHA is easier than previously thought to restrict online bot
gaming. It is extremely simple to keep robots and computers from playing
online games, as found by (kheshaifaty2020preventing, ), (li2018captcha, ),
and (golle2005preventing, ).

###  3.4. Ensuring a strong internet protection

A recent online paper outlined the theory of dictionary attack, which aims to
find the passphrase or password of an authentication system by accessing
probable alternatives. CAPTCHA is particularly efficient in protecting against
such dictionary assaults in these types of circumstances, according to
(chakrabarti2007password, ), (alajmi2020password, ), and (khan2020captcha, ).

###  3.5. A way to handle worms and spam

CAPTCHA is used to combat worms and spam and accept mail only if no computer
program is present, proving that humans are behind it (magdy2021comprehensive,
), (saxena2017handling, ), and (vaithyasubramanian2019enhancing, ).

###  3.6. Stronger password security

Attempting to enter the password after too many incorrect tries may result in
an account being locked, but this is not a superior approach. Ahn et al.
(von2004telling, ) claim that if a computer program tries to complete a task,
it may be overridden by requiring the user to input a CAPTCHA to demonstrate
that it is a person and not a computer program.

###  3.7. A search engine bot’s barrier

Pope and Kaur (pope2005human, ) and Kim and Luke (kim2019search, ) pointed out
that if a business wants its web pages to remain undisturbed, CAPTCHA will
help to block computers from indexing the sites.

###  3.8. Keep automatic online polls to a minimum

CAPTCHA may also be used to prevent a computer program from voting in online
polls. The claims of (von2004telling, ) and (pope2005human, ) asserted that
even while it cannot be used to prevent a person from voting more than once,
it cannot be used to allow them to vote more than once either.

Figure 2. The proposed taxonomy of CAPTCHA types.

###  3.9. A Rejecting Shopping Agent Solution

This kind of software is quite popular today: You may build one that provides
you with a full cost comparison from many comparable websites, for example,
trivago or makemytrip (kumar2021systematic, ). Since the customer cannot view
all the ads from these online shops, the online stores lose out. Rejecting
this kind of program from disclosing pricing information is extremely
successful using the CAPTCHA (kute2018video, ).

##  4\. Classification of CAPTCHAs based on their types

The CAPTCHA schemes may be broadly classified into Optical Character Reader
(OCR) and non-OCR CAPTCHA formations. They can further be classified into
different types, as shown in Fig. 2. This section presents different CAPTCHA
schemes classified based on OCR-based and Non-OCR CAPTCHAs, along with each
approach’s pros and cons.

###  4.1. OCR-Based CAPTCHA Schemes

This section presents the most commonly OCR-based CAPTCHA schemes.

####  4.1.1. Text-based CAPTCHAs

In 1997, the first bot attack was made on Alta Vista that submitted automated
URLs. Therefore, distorted arbitrary text CAPTCHAs were generated by Andrei
Border to deter bots (bandaystudy, ).

Figure 3. Text CAPTCHAs at CAPTCHAservice.org.

Text-based CAPTCHAs are categorized as reading-based CAPTCHAs. The user reads
a text made up using only letters or a random combination of numbers or
letters and inputs them into a given box in the same sequence
(kumar2022usability, ). It is quite troublesome for a computerized program to
read twisted letters or numbers from clutter. This clutter could consist of
anything like a grid, noise, shapes, lines, hues, shades, or contrasting
colors. These CAPTCHAs are broadly used by many websites such as Google,
rapid-share, MSN, Yahoo, YouTube, and Badongo. An example of a text-based
CAPTCHA is shown in Fig. 3 (yan2007breaking, ).

Figure 4. EZ-Gimpy challenge image. Figure 5. Gimpy-r challenge image.

Gimpy-r and EZ-Gimpy are a few examples of a text-based CAPTCHA, as shown in
Fig. 4 and 5 (moy2004distortion, ). In Gimpy, an image is shown with the
variegated text, and the user has to input three different texts or words by
looking at them (mori2003recognizing, ). reCAPTCHA is another severe form of a
text-based CAPTCHA. Text-based CAPTCHA’s benefit lies in its formation, where
simple 4-8 letter words or arbitrarily written letters or numbers may be used.
It is not very complicated for a user to recognize; however, it might not be
the case as development has been done to make them robust. The deformation and
noise are enhanced to make it attack-resistant, making it difficult for users
to understand and recognize the letters. People with visual restraints may
also find it cumbersome and fail. Moreover, if dictionary-based words are
used, a huge database is required. They are also vulnerable to various attacks
(yan2016simple, ), (ye2018yet, ), (uzun2018rtcaptcha, ). Most of the attacks
on text-based CAPTCHAs are based on OCR techniques. Therefore, the designing
of a robust text CAPTCHA is inevitable (george2017generative, ). Similarly,
Shao et al. (shao2021robust, ) proposed an attack-resistant text based-CAPTCHA
using adversarial examples.

####  4.1.2. 3D CAPTCHAs

Many websites have employed the 2D text CAPTCHAs to protect themselves from
automated bots. These CAPTCHAs are designed using random characters, symbols,
and numbers in a 2D space format, as shown in Fig. 1 (woo2019design, ). The
most significant disadvantage with these approaches is that they can easily be
cracked through automated offline post-processing attacks (woo2019design, ).
These approaches work by segmenting the whole CAPTCHA and then recognize each
character individually. Many attempts have been made to improve security by
including dots and lines across the CAPTCHAs. Deep Neural Networks (DNNs) for
cracking the 2D CAPTCHAs have posed severe security threats with an accuracy
of 83% (zhou2017east, ). The use of 2D text CAPTCHAs can easily be compromised
with improved OCR technology. (kim2019dotcha, ) is a new type of text-based
CAPTCHA known as DotCHA, which depends on human interaction. In this approach,
the user has to rotate the 3D text model to identify the correct letters. In
nature, the 3D text model is the twisted and sequential 3D text having a
centre pivot axis, which depicts different letters upon rotation. This type of
CAPTCHA is protected from segmentation attacks. It is composed of different
spheres of each letter, i.e., it is a scatter-type CAPTCHA. This type of
CAPTCHA is also protected from machine Learning (ML) attacks due to its unique
working way.

Figure 6. A DotCHA image.

####  4.1.3.  Hand-written CAPTCHAs

Lin and Wan (lin2007style, ) gave an idea of a synthesized form of hand-
written CAPTCHAs. GUI interface to accumulate and build samples. Mori et al.
(mori2000generating, ) used a method that produces samples of naturally
written characters. Parvez et al. (parvez2020segmentation, ) proposed an
Arabic hand-written CAPTCHA scheme based on the ’segmentation-validation’
generation. Recently, another example is presented in kumar2022design using
Hindi language. One such example is shown in Fig. 7 (arica2001overview, ).

Figure 7. Showing synthesized handwritten CAPTCHA.

One main advantage of hand-written CAPTCHA is that it is challenging for a
computer to apply techniques like segmentation, making it grueling to
recognize. However, collecting samples of hand-written words is a real
problem. The size of the collection and maintaining the dataset is a large
problem. It is also vulnerable to attacks, such as brute force dictionary
attacks. Another issue with hand-written CAPTCHAs is the cursive writing that
can also make it a little problematic for humans to identify
(thomas2009synthetic, ).

###  4.2. Hollow CAPTCHA

Another newly emerged text-based CAPTCHA is hollow. These CAPTCHAs are
deployed by many well-known websites like Yahoo!, Tencent, Sina, China Mobile,
and Baidu. It uses contour lines as its‘ main feature in fabricating the
connected hollow characters. The main aim of these contour lines is to improve
the security and usability of the scheme. The standard segmentation and
recognition techniques fail to break connected characters. Hollow CAPTCHA
models come in different designs with various design features, such as use
interference arcs, varied lengths, and thickness of hollow portions and
randomly-generated contours. However, too much teeming and overlapping may
confuse character pairs, compromising its usability (gao2013robustness,
)(chen2017survey, ), as illustrated in Fig. 8.

Figure 8. Showing hollow CAPTCHAs.

###  4.3. Non-OCR CAPTCHAs

This section presents Non-OCR CAPTCHA schemes.

####  4.3.1. Image-based CAPTCHAs

Progress made in the making of CAPTCHAs has turned towards image-based
CAPTCHAs (egele2010captcha, ). The user has to identify and select a specific
picture from several listed images, as shown in Fig. 9 (banday2009image, ). It
uses advancements in the field of image identification and blew out the
inherent issues of text-based CAPTCHAs. One such example is presented in
(krishna2022spiral, ) using adversarial perturbation and they used
Convolutional Neural Network (CNN) for its security analysis.

Figure 9. Different image-based challenges.

Initially, Chew and Tygar (chew2004image, ) used labeled allied images in
Google Image Search. After that, Ahen and Dabbish (von2004labeling, )
established labels in ”ESP Games.” However, these required classes of objects
and a substantial database. Similarly, images of Kittens were utilized by Oli
Warner (warner2006kittenauth, ). Once again, the issue of a small database
size arose. However, playing with pictures is simpler and more efficient as
they are less distorted and deformed; hence they are agreeable.

Figure 10. Images with various orientation properties. Figure 11. An ASIRRA
challenge.

After that, ASIRRA ”Animal Species Image Recognition for Restricted Access”
(elson7asirra, ) arrived with a three million images database prepared by
Petfinder.com. This database had two distinctive picture types (cats and
dogs), which were real and innocuous, as shown in Fig. 11. The test was simple
as the user simply differentiates a cat from the list of dogs. This test
provided 99.6% usability relief, which the user can solve in less than 30
seconds. Compared to other CAPTCHAs, ASIRRA used attractive images; however,
an algorithm and a centralized web server must be generalized and confirmed.
Pictures require more storage as the database has to be maintained and
displayed on-screen. There are many image-based CAPTCHAs found in literature
(aleksandrovich2012image, ) (zhu2013image, ) (goswami2014facedcaptcha, )
(truong2020generating, ). An example is shown in Fig. 12. Another approach is
presented by Kwon et al.in (kwon2019captcha, ). The same authors proposed
another image-based CAPTCHA (kwon2020robust, ) based on adversarial example
processes, such as FGSM, I-FGSM, or DeepFool. Another type of two-way image-
based CAPTCHA is proposed in (bhat2020two, ). The proposed scheme used a
homography transformation to match two given images.

####  4.3.2.  Audio CAPTCHAs

Data can be perceived in the sense of visual portrayal as well as in the form
of audio (xiaojuan2010semantic, ). However, image-based CAPTCHAs are less
preferred over audio CAPTCHAs as some visually impaired people also utilize
the Internet. Consequently, sound CAPTCHAs were created to help visually
impaired users (bursztein2009decaptcha, ), (choi2018poster, ),
(chithra2021scanning, ). Diverse speakers speak letters or numbers after a
certain time interval. The user inputs the correct number or letter in a file.
Automated speech recognition (ASR) software is utilized for this
functionality. Background noise is used to mystify it (bursztein2009decaptcha,
). Audio CAPTCHAs may be made more robust using audio-based watermarking
techniques (huang2021attacking, )

Figure 12. An example of text CAPTCHA.

Shahreza et al. (shirali2007captcha, ) proposed a non-OCR CAPTCHA for visually
impaired users based on Text-To-Speech (TTS) system to generate a mathematical
question, and then converting it to speech. One advantage of this particular
method is that automated software needs to make itself familiar with speech-
based questions. In order to solve the problem and answer the questions, it
needs to be smart enough. One other advantage is that a visually impaired
person would not have to input long words. Just a number as a reply would be
enough. Hence, it saves time as it is easy to knob.

Haichang et al. (haichang2010audio, ) used waveform diagrams for the spoken
phrases or words to help the user. The phrase or word is arbitrarily made or
chosen from different types of books. Such sentences appear on the screen, and
the user is asked to speak them out loud. At that point, it is decided that
whether the speaker is a bot or a human. This strategy analyzes sound
characteristics and exploits the discrepancy between a simulated machine
speech and humans. It offers a high sanctuary; however, this particular
scheme’s problem is settling on synthetic sound software. The issue with audio
CAPTCHAs is background noise, which might affect the user’s hearing acuity. We
may also say that accent problems may also occur and impact recognition for
non-native users. Another issue is that most audio strategies utilize audio
files, which determines its span and challenge (haichang2010audio,
)(lazar2012soundsright, ).

Figure 13. Example of audio CAPTCHA.

Similarly, four different types of audio CAPTCHAs are proposed by Fanelle et
al. (fanelle2020blind, ) with improved precision and speed. An example image
is shown in Fig. 13. They conducted worldwide experimentation in three-
sessions with 67 PVIs. Shekhar et al. (shekhar2019exploring, ) proposed a
robust CAPTCHA scheme, resistant to Deep Learning (DL) and ML attacks.

####  4.3.3. Collage CAPTCHAs

CAPTCHAs mainly established on Non-OCR methods are the collage CAPTCHAs. It
usually has contorted shapes that asks for the user to select a certain one. A
certain Collage CAPTCHA was presented by Ritury soni (soni2010improved, ). On
the left of the screen, the image of objects is displayed. However, on the
right side, it displays other images with the name of the left image, as shown
in Fig. 14. The user selects both the left image and the most appropriate word
image from the right of the screen. The user in the given box would type the
name in.Similarly, Shanker et al. (shankar2013hybrid, ) introduced another
hybrid Collage CAPTCHA to reduce CAPTCHA attacks.

Figure 14. A collage challenge.

If text and image-based CAPTCHAs are distorted, they usually displease the
user and are open to attacks. The database of various pictures of a Collage
CAPTCHA (animals, flags, or humans.) is displayed in different places randomly
without overlapping in different places and is used after minor alternation.
This objective approach is to spot the desired picture and then guess is
complicated for a computer. Identification is not an easy process. The
computer must be well-versed with the picture’s knowledge and shapes. It has
to track down the precise position of the picture displayed on the screen.
Thus, resistance brews against their attacks. Such a method can be carried out
on other devices with touch screens. Though it is easy to use, it still
requires a database of a fixed amount of pictures that inevitably will be
repeated. Another novel collage-based CAPTCHA, SCAPTCHA, is proposed in
(nguyen2020secure, ). An example image is shown in Fig. 15. It is based on
different artifact segments and associated metadata, such as sizes and
positions. However, users need to answer the questions associated with the
CAPTCHA.

Figure 15. An example of SCAPTCHA along with a text-based and reCAPTCHA
example.

####  4.3.4. Mouse-intrusion CAPTCHAs

Among CAPTCHA breaking schemes, a text-based CAPTCHA breaking scheme is the
most profitable. It is the success rate that is greater than the others.
Therefore, the idea of ’Drag and Drop’ CAPTCHA was introduced by Desai and
Patadia (desai2009drag, ). Example images are in Fig. 17 and Fig. 18. For such
kinds of CAPTCHA, mouse intrusion is mandatory. It follows the Artificial
Intelligence (AI) technique. A simple mouse-intervention CAPTCHA image is
shown in Fig. 16 (Giangmouse, ). Complicated or intricate types of CAPTCHAs
usually use redirection and laundry attacks where the CAPTCHA is diverted to
’human sweatshop’ after which hired humans are used so the computer can solve
it (baird2005highly, ).

Figure 16. Mouse-intervention CAPTCHA.

In (ridzuan2019image, ), another click-based CAPTCHA scheme is brought forth.
The mouse clicks help identify a human by analyzing the clicking on certain
image components (athanasopoulos2006enhanced, ). It also does that through the
process of dragging and dropping a letter on the destination. The need for a
keyboard in this is nil (athanasopoulos2006enhanced, ). According to this
approach, the users drag and drop the letters at appropriate place. In this
approach, technological scrutiny is not mandatory that ends in relief for the
users (chu2018bot, ). ’DND’ CAPTCHAs do not require any noise and chaotic
backgrounds, making it apt in bandwidth use (desai2009drag, ). Developed in
JavaScript, HTML, and Java applets make it comprehensible, easy, and simple to
design and needless bandwidth. A similar approach is proposed by Shah et al.
(shah2021design, ), recently.

Figure 17. DND CAPTHA image. Figure 18. DND CAPTCHA right or wrong placed.

Another click-based graphical CAPTCHA is presented in (sharma2018highly, ).
Such CAPTCHAs are vital and robust (desai2009drag, ), (chu2018bot, ),
(cotta2019game, ). However, it requires the user to properly fall through with
the order and the character’s exact destination. Another technique involves
displaying a panel of changing colors. The user, as soon as the green color is
shown, has to click the button (Giangmouse, ). The mouse is also used in Bongo
sentences where the clicks help the user find and then type it in the
respective place (desai2009drag, ). Likewise, game-like CAPTCHA is proposed in
(kirkbridegame, ) for intrusion detection providing account authentication.
Based on flash-gaming, another gaming CAPTCHA is proposed in
(aldwairi2020efficient, ).

####  4.3.5. Question-based CAPTCHAs

A new approach uses arithmetic problems by keeping four essential abilities
that humans possess (kaur2016non, ). This approach involves understanding the
question’s text, disclosing question images, comprehending the problem, and
then solving it. The arithmetic problem, to the user, is presented as an
image. For example, see 19 (shirali2007question, ). Question-based CAPTCHAs
are formulated to overcome the limitations of both OCR- and Non-OCR-Based
CAPTCHAs (shirali2007question, ), (levesque2018haptic, ). Gimpy method
(blumcaptcha, ) was introduced in OCR-based CAPTCHA to take any word from the
dictionary to use as CAPTCHA. Though, it was not scalable with only 850 words
in the dictionary.

Figure 19. A sample Question.

To lower the quality of a word to be used as CAPTCHA, a pessimal print method
(coates2001pessimal, ) was used. However, they are also liable to hacking. The
method proposed that in (shirali2006persian, ) would surmount the problem.
This method also makes it easy, so that, non-English speakers can benefit from
it. After this new approach (coates2001pessimal, ), Implicit CAPTCHA
(shirali2006persian, ) would not be in use. It is also a very costly method.
To make it hard for computers to be acquainted with the speech, Text-to-Speech
method (chan2003using, ) is used. However, the user has to make certain
calculations, which people are not well-versed with it. This method is used
both by the OCR and non-OCR techniques, for a bot has to go through more
calculations. At times, the images can be extremely incoherent and can lead to
incorrect entries by the users.

####  4.3.6. Video CAPTCHAs

A novel content-oriented video CAPTCHA was enlisted to increase user security
from 70% to 90% and reduce attacks with only 2% (kluever2009balancing, ).
However, in this approach, video labeling is required. Every time that a video
is uploaded on YouTube, it is usually tagged by it is loaded. Accordingly,
every time a user plays the video, they need to type three different words,
for that certain video, to describe the video. A video will be played if any
of the three words match the stored database related to that video. However,
the users get irritated due to wrong entries. By ensuring the Kerchkhoffs’
Principle, tests are produced and checked automatically. All of the tests need
to be solved with minimal exertions put by humans. Finally, it must be very
challenging for the machine to be algorithmically solved
(kluever2009balancing, ). An example of video CAPTCHA is given in Fig. 20. It
must be noted that this examination was conducted on a minimal scale video
database; it would be ineffective to expand its size.

Figure 20. An example of video CAPTCHA.

Thus, for large scale video collection, the results would not be reliable.
Video-based CAPTCHA solutions are discussed in (hu2013captcha, ), where the
text is embedded in a matter of seconds of flash video. However, the users,
even without watching the whole clip, may recognize and remember characters
instantly. Another problem is the equipment and software needed, such as the
availability of a flash player or a compatible decoder. Therefore, the absence
of such facilities can make a video playing a failure.

####  4.3.7. SKETCHA: A Drawing CAPTCHA

As compared to computers, humans are much better at recognizing 3D images. A
new CAPTCHA called ”sketcha” was devised by Ross et al. (ross2010sketcha, ),
with a huge database to display a 3D image in different rotations, as shown in
Fig. 21. To bring it to 90 degrees, the user has to click. It is very
accessible and friendly to the user, as a user can comprehend drawing more
than photographs (gooch2004human, ). However, overlapping, deformation, or
addition of clutter is not required in the image, which makes a drawing
CAPTCHA coherent and apparent. They are more user-friendly and have no
language dependency (ross2010sketcha, ). The 3D approach makes it difficult
for the machine by giving different picture styles (gossweiler2009s, ).
Though, to bring the image to 90 degrees, several clicks may be needed, as
shown in Fig. 10. However to save the images, a database is also required.

Figure 21. A drawing CAPTCHA.

####  4.3.8. Game CAPTCHAs

CAPTCHAs are mainly seen in the form of various numbers, letters, and a
variety of pictures. The core reason for CAPTCHAs appearance on screen is to
ward off users from bot programs. Not only do suspicious users get this
unrelenting task of solving a CAPTCHA, but the genuine users also receive
them. Judging this uncomfortably from the user end, Chein-Ju et al.
(ho2011deviltyper, ) came up with a great initiative, namely ”DevilType.” The
maximum numbers of devils are overthrown by using CAPTCHA tests, as shown in
image Fig. 22 and 23.

Figure 22. A CAPTCHA is attached to each devil. Figure 23. The devil moves
from upside to downside.

Ultimately this effective strategy helped to get exceptionally credible
experiments that gave positive results. This technique owns two integral
benefits, i.e., human’s entertainment and playing become meaningful. Secondly,
the game programmers take leverage when the game logo is displayed several
times. The CAPTCHA is further segregated into different levels for users to
choose from based on their convenience. In order to make CAPTCHA look a little
more complicated and intrigued, more detail is added. It may be fun, however,
at the same time, strenuous as well. Manar et al. (mohamed2014dynamic, )
proposed a relay attack-resistant Dynamic Cognitive Game (DCG) CAPTCHA. It had
simple moving objects. The user plays an object matching game to pass the
test, as shown in Fig. 24 and 25.

Figure 24. An example of parking games. Figure 25. An example of ships games.

Aldwairi et al. (aldwairi2020efficient, ) proposes another CAPTCHA, as shown
in Fig. 26. It is a flash-based CAPTCHA that is naive and easy to solve yet
with the least chances of errors. It can be solved in the shortest time with
easy recall capabilities. However, one needs to have technical skills to
attempt the test.

Figure 26. Flash-Based Gaming CAPTCHA. Figure 27. A taxonomy of Hybrid CAPTCHA
schemes.

####  4.3.9. Hybrid CAPTCHA schemes

This section presents different CAPTCHA approaches based on mixed-use
formations, such as text and audio, text and multimedia, and special purpose
CAPTCHA schemes. Some examples of hybrid CAPTCHA may be found in
(singh2020hybrid, ), (li2021vrcaptcha, ), and (shi2021adversarial, ). A
taxonomy of hybrid CAPTCHA scheme is shown in Fig. 27 and the types are
discussed below:

  * -

CAPTCHAs as Public key: All types of CAPTCHAs, whether OCR or non-OCR, are
used for bot attack prevention. In Man-in-the-Middle (MitM) attack situation,
they fail in securing the resources. Keeping such scenarios in mind, public-
key embedded CAPTCHAs are introduced by Samir Saklikar (saklikar2008public, ).
To ensure the validity of such CAPTCHAs, public key installation is a
mandatory process along with the surety of a secured channel. However,
handshaking and public/private keys pose communication overhead in such
schemes.

  * -

Audio-visual CAPTCHA: This kind of CAPTCHA scheme is appropriate for
illiterate persons. Tariq and Khan (tariq2018match, ) proposed a novel hybrid
CAPTCHA scheme based on images and related sounds. This approach is based on
the cognitive abilities of human users. It is a user-friendly approach;
however, databases of images and sounds are required. Similar work examples
are (shirali2007localized, ) and (holman2007developing, ).

  * -

Tree-based hand-written CAPTCHA: This CAPTCHA scheme is based on the
combination of text and graphics. It exploits the reading abilities of human
users. A synthetic hand-written tool is used along with some random
transformations to generate a tree structure test (rusu2010leveraging, )
randomly. However, an understanding of the tree structure is required.

  * -

CAPTCHAs for smart devices: Ubiquity of Internet browsing in smart IoT devices
has led to the design of CAPTCHA with special features. Due to constrained
resources like memory and energy, it is inevitable to design light-weight
CAPTCHAs. These schemes should promote certain characteristics of touch-screen
devices (roshanbin2016enhancing, ),(kalgi2015mobile, ). Highlighting CAPTCHA
(shirali2008highlighting, ), multilingual highlighting CAPTCHA
(shirali2011multilingual, ), CAPTCHA zoo (lin2011new, ) and seeSay and hearSay
CAPTCHA (shirali2013seesay, ) are few examples of such domain.

  * -

CAPTCHAs for Mobile devices: There are some specially designed CAPTCHAs for
mobile devices. They make use of touch screens and the sensors embedded on the
device. Such examples encompass (pritom2020combining, ), (acien2020becaptcha,
), (aburada2019implementation, ), (perera2019ocaptcha, ), (acien2020captcha,
), and (acien2021becaptcha, ).

  * -

Special purpose CAPTCHA schemes: Special purpose CAPTCHA schemes are meant for
special people, such as visually or deaf and hard of hearing people. The
examples of special-purpose CAPTCHAs include (holman2007developing, ),
(lazar2012soundsright, ), and (shirali2008new, ). Another CAPTCHA scheme
specifically presented for children in (shirali2008captcha, ).

  * -

CAPTCHA-based passwords: Alajmi et al. (alajmi2020password, ) presented a
CAPTCHA-based password authentication mechanism using AI problem. Another
video-based CAPTCHA is proposed in (kute2018video, ). This scheme is proposed
as a graphical password scheme. Muhammad et al. (mohammed20183c, ) also
proposed a graphical password scheme using click-based CAPTCHAs. Khan et al.
(khan2018new, ) also proposed a graphical password scheme for security using
CAPTCHA. A detailed study on CAPTCHAs as graphical passwords is presented in
(patel2021survey, ).

Table 2. Performance analysis of different CAPTCHA Types. Types |  CAPTCHA |  Dictionary-based |  Database-based |  Usability |  Vulnerability |  Speed and Storage cost
---|---|---|---|---|---|---
OCR |  Text-Based |  ✓ |  ✓ |  Low |  High |  Low
OCR |  3D-text |  ✓ |  ✓ |  Medium |  Medium |  low
OCR |  Hand-written |  ✓ |  ✓ |  Low |  High |  Low
NON-OCR |  Image-based |  $\times$ |  ✓ |  High |  Low |  Medium
NON-OCR |  Audio |  $\times$ |  ✓ |  Low |  Low |  High
NON-OCR |  Collage |  $\times$ |  ✓ |  Medium |  Medium |  High
NON-OCR |  Mouse-intervention |  ✓ |  ✓ |  high |  Medium |  Medium
NON-OCR |  Video |  $\times$ |  ✓ |  High |  Low |  Medium
NON-OCR |  Sketcha |  $\times$ |  ✓ |  High |  Medium |  Medium
NON-OCR |  Public key embedded |  $\times$ |  ✓ |  High |  Medium |  Low
NON-OCR |  Game |  $\times$ |  ✓ |  Low |  Low |  High
NON-OCR |  Question-based |  $\times$ |  ✓ |  Low |  Medium |  Low

##  5\. Challenges and open issues in CAPTCHAs designs

A CAPTCHA is considered good if it is easy for humans to solve and resist
potential attacks. However, designing such CAPTCHAs is a difficult task. A
CAPTCHA is considered usable if it is easy for human users. It is considered
strong if it resists computers and with a success rate as low as 0.01%
(el2011captcha, ). Most of the CAPTCHA breaking techniques are designed for
text-based CAPTCHAs, as it is widely used (shi2020text, ). To improve the
user-friendliness of CAPTCHA, the presentation of its user interface needs to
be up to par. There is a myriad of qualities that affect the practicality of
CAPTCHAs (brodic2020captcha, ). Some of which are; font size, font style, and
image size. Problems usually arise when humans do not easily recognize the
font style and situations that look similar. For instance, a sizeable font is
the most suitable in text-based CAPTCHA as it improves human users’ clarity.

Similarly, the size is a fundamental property of image-based CAPTCHA as it
also improves usability. Small images are preferable because they depreciate
server-processing time, increase the download process, and inhabits smaller
spaces in webpages (noorjahan2019bio, ). However, large images are more
precise and more descriptive for human users. They also improve the security
prowess of the CAPTCHA and reduce the probability of speculations
(roshanbin2016adamas, ). Furthermore, the importance of sizeable images is of
high importance. A resolution must be made between usability and vigor.

Audio-based CAPTCHA is quite different from its other CAPTCHA counterpart, as
it does not depend on presentation. Some studies have shown that audio-based
CAPTCHA might be complicated for visually impaired users. Bigham and Cavender
(bigham2009evaluating, ) debated that most current audio CAPTCHAs are
exasperating for visually impaired users. The latter use screen readers to
understand CAPTCHA. The rationale behind the debate is that navigation
elements cause them to lose concentration and fail to hear the CAPTCHA’s
beginning, even as they try to listen and answer the CAPTCHA questions. The
load time can be altered about the user’s network constraint to improve the
image’s usability- and motion-based CAPTCHAs (truong2011icaptcha, )
(gao2014gaming, ). Conversion of the animation quality and dimensions to the
grayscale can improve performance.

The inference that can be drawn from this is that intellectually disabled
users are faced with more difficulties, followed by visually impaired users
(berton2020captchas, ). The rationale behind this inference is that
intellectually disabled users do not understand CAPTCHAs. For the visually
impaired, most CAPTCHAs are understood through a visual canal. Although
several steps have been taken to improve CAPTCHAs’ accessibility for disabled
individuals, complete eradication of the problems will make CAPTCHAs more
accessible by computers and robots. The use of substitute methods instead of
CAPTCHAs to avoid spam should be significantly considered. Because after the
analysis done on the subject, substitute methods handle accessibility hurdles
better (moreno2014captcha, ).

To enhance CAPTCHA usability and assist human users in identifying aim objects
in noisy backgrounds, zooming. Color filtering tools should be made available.
Unavailability of the listed tools can frustrate human users because of
background noises in the suggested CAPTCHA, which is the same as some Unicode
characters in terms of shape, color, and location (roshanbin2013survey, ). The
importance of colors in improving CAPTCHA usability cannot be overemphasized
as color eases human identification and confound OCR systems
(kaladgi2019applying, ), (el2011captcha, ). Although colors have their
usefulness, one has to be careful in their application, impairing security and
usability. The perplexity associated with exploiting desirable color patterns
and arrangements is one of the adverse effects on human usability. Another
adverse effect is the inability to counter-attack.

There is a constant comparison between CAPTCHA and other substitute methods
(moradi2015captcha, ). These substitute methods, while some may be more
efficacious, user friendly, and secure than CAPTCHA. CAPTCHA is still the most
common method among users, such as security administrators and business
owners. Nevertheless, some substitute methods like spam detection and Askimet
plugs are prevalent among users (begum2015collaborative, ). The rationale
behind this penchant is explained below:

  * •

Most administrators use third-party solutions (lopresti2005leveraging, ). They
do not code their CAPTCHAs from the beginning on the premise of vigor,
popularity, cheap execution charge, and low management overhead. Except in
crucial and delicate situations, the rationale behind the use of substitute
methods is not feasible.

  * •

Most administrators are unaware of the new substitute methods, and there is
not enough information about them (moradi2015captcha, ). Nevertheless, there
are third party solutions that provide substitutes to users, unlike CAPTCHA.
The substitute methods are still upcoming in terms of their diversity and
popularity viewpoint.

  * •

The fact that most of these substitute methods are not adequately organized
and packaged is responsible for most users not using them. The unavailability
of these features decreases their usability and makes them informal.

  * •

Website owners should continue using substitute methods because of CAPTCHAs’
effect on accessibility, conversion rate, usability, and user satisfaction.
Managers that are aware of the consequences of using CAPTCHAs and, at the same
time, unaware of substitutes have removed CAPTCHAs from their websites. They
now care about their users than they do attackers (moradi2015captcha, ).

Table 3. Comparison among different CAPTCHA techniques

Reference | Year | Type | Technique | Characteristics
---|---|---|---|---
|  |  |  | Clutter/Noise | Deformation | Orientation | Overlapping | User-friendly | Scalability
(banday2009image, ) | 2009 | Non-OCR | Image | ✓ | ✓ | ✓ | $\times$ | Medium | Low
(tariq2018match, ) | 2018 | Non-OCR | Match the sound | $\times$ | $\times$ | $\times$ | $\times$ | High | Low
(yan2007breaking, ) | 2007 | OCR | Google, MSN | $\times$ | ✓ | ✓ | ✓ | Medium | Low
(moy2004distortion, ) | 2004 | OCR | Gimpy-r and EZ-Gimpy | ✓ | ✓ | $\times$ | ✓ | Low | Low
(woo2019design, ) | 2019 | OCR | 3D DotCHA | $\times$ | ✓ | ✓ | $\times$ | Low | Low
(arica2001overview, ) | 2001 | OCR | Hand written | ✓ | ✓ | $\times$ | ✓ | Low | Low
(gao2013robustness, ) | 2013 | OCR | Hollow text | ✓ | ✓ | $\times$ | ✓ | Low | Low
(elson7asirra, ) | 2007 | Non-OCR | ASIRRA | ✓ | ✓ | ✓ | $\times$ | High | Low
(aleksandrovich2012image, ) | 2012 | Non-OCR | Image | ✓ | ✓ | ✓ | ✓ | High | Low
(zhu2013image, ) | 2013 | Non-OCR | Object recognition | ✓ | $\times$ | $\times$ | ✓ | High | Low
(kwon2020robust, ) | 2020 | Non-OCR | FGSM, I-FGSM | ✓ | ✓ | $\times$ | $\times$ | High | Low
(bursztein2009decaptcha, ) | 2009 | Non-OCR | Automated Speech Recognition (ASR) | ✓ | $\times$ | $\times$ | $\times$ | Medium | Low
(shirali2007captcha, ) | 2007 | Non-OCR | Text to Speech (TTS) | ✓ | $\times$ | $\times$ | $\times$ | High | Medium
(haichang2010audio, ) | 2010 | Non-OCR | Waveform diagrams | ✓ | $\times$ | $\times$ | $\times$ | High | Medium
(lazar2012soundsright, ) | 2012 | Non-OCR | Audio | ✓ | ✓ | ✓ | ✓ | High | Medium
(shekhar2019exploring, ) | 2019 | Non-OCR | Contemporary architecture | ✓ | ✓ | ✓ | ✓ | High | Medium
(shankar2013hybrid, ) | 2013 | Non-OCR | Hybrid | ✓ | ✓ | ✓ | $\times$ | High | Medium
(nguyen2020secure, ) | 2020 | Non-OCR | Object Segmentation | ✓ | ✓ | ✓ | ✓ | High | Low
(desai2009drag, ) | 2009 | Non-OCR | DND draggable character | $\times$ | ✓ | $\times$ | ✓ | High | Medium
(shirali2007question, ) | 2007 | Non-OCR | Question-based | $\times$ | ✓ | $\times$ | $\times$ | High | low
(shirali2006persian, ) | 2006 | Non-OCR | Persian and Arabic writing | ✓ | $\times$ | $\times$ | ✓ | Medium | Low
(kluever2009balancing, ) | 2009 | Non-OCR | Kerckhoffs’ Principle | ✓ | ✓ | ✓ | ✓ | Medium | Low
(hu2013captcha, ) | 2013 | Non-OCR | Video-based | ✓ | $\times$ | ✓ | ✓ | Medium | Medium
(ross2010sketcha, ) | 2010 | Non-OCR | Drawing CAPTCHA | $\times$ | $\times$ | ✓ | $\times$ | High | Medium
(ho2011deviltyper, ) | 2011 | Non-OCR | A DevilType, Video Captcha | $\times$ | $\times$ | $\times$ | ✓ | High | Low
(mohamed2014dynamic, ) | 2014 | Non-OCR | Dynamic Cognitive Game (DCG) | $\times$ | $\times$ | ✓ | $\times$ | High | Low
(aldwairi2020efficient, ) | 2020 | Non-OCR | Flash-based | $\times$ | $\times$ | ✓ | $\times$ | Medium | Medium
(saklikar2008public, ) | 2008 | Non-OCR | Hybrid | ✓ | $\times$ | $\times$ | $\times$ | High | Medium
(von2008recaptcha, ) | 2008 | OCR | reCAPTCHA | ✓ | ✓ | ✓ | ✓ | Low | Low
(gao2010audio, ) | 2010 | Non-OCR | Audio | ✓ | $\times$ | $\times$ | $\times$ | High | Medium
(giang2006mouse, ) | 2006 | Non-OCR | Mouse Intervention | $\times$ | $\times$ | ✓ | $\times$ | High | Low
(baird2003pessimalprint, ) | 2003 | Non-OCR | Turing test using pessimal print | ✓ | ✓ | $\times$ | $\times$ | High | Low

###  5.1. Performance analysis

Since time immemorial, the text-based CAPTCHA has been the most preferred type
of CAPTCHA. Although it is unsafe in recent times, text-based security can
still be improved using various means due to its wide usage and complexity.
These means may include; use of font styles or noise. Recently, the most
widely used CAPTCHA is image-based. It is advantageous in the sense that it is
easier to use than its text-based counterpart. However, this CAPTCHA might be
prone to adversarial attacks; there is still room for improvement. The most
uncommon type of CAPTCHA is the audio/video-based CAPTCHA. Its atypicality is
owed to the premise that it requires higher bandwidth and does not save time.
Above all, they get broken with ease. Based on our study, the performance
analysis of different CAPTCHA schemes is illustrated in Table 2. Similarly, a
comparison based on different CAPTCHA characteristics is presented in Table 3.

We observed that the OCR-based CAPTCHAs are mostly dictionary- and database-
based. The trade-off between usability and robustness is the main challenge in
the design of a CAPTCHA. Text-based CAPTCHAs are the ones that are most
frequently used by several websites and web-based applications. Text-based
CAPTCHAs are mainly preferred due to low latency and storage costs. However,
they are more vulnerable than the other CAPTCHA schemes, such as image, audio,
or video. Besides, text-based CAPTCHAs are annoying to use due to usability
issues. Different security features make it attack-resistant in CAPTCHA
designing, such as ’font tricks,’ diversified font styles, upper or lower case
letters, deformation, alteration, distortion, twists, and sizes. Another such
feature is the ’noise’ (yan2007breaking, ), which is also referred to as
clutter. For noise and clutter, different shapes (such as circles, squares, or
rectangles), lines (vertical, diagonal, or horizontal), colors, dots may be
used for CAPTCHA security. Similarly, the objects or text may be overlapped to
make CAPTCHA resilient against potential segmentation attacks.

On the contrary, non-OCR-based CAPTCHA tests do not require word dictionaries.
However, a substantially larger database is needed to store images, videos, or
sounds. They have different disadvantages, such as vulnerability, unfriendly,
massive image libraries, server loads, downloading delays, and timely access
(banday2009image, ). However, they are less vulnerable than text-based
CAPTCHAs. They are more usable than text-based because they require less
noise, clutter, deformation, and overlapping. These features make them more
enjoyable and easy to pass.

Similarly, audio-based CAPTCHAs are less supported as non-native
listeners/users might face problems recognizing words/phrases due to accent
problems. Moreover, non-native speakers may not have enough vocabulary.
Downloading issues make video-based CAPTCHAs less attractive than the others.
Besides, network delay and the file size may also strain a user’s resources
interested in the desired task and not in CAPTCHA solving.

###  5.2. Recommendations for designers

According to our study, the following are some of the ineluctable factors in
designing a robust CAPTCHA.

  1. (1)

A good CAPTCHA must be resistant against segmentation attacks.

  2. (2)

Deformation, fragmentation of text/images, lines, and clutter must be added to
avoid recognition attacks.

  3. (3)

Distortion, rotations, wrapping of text/images, and random scaling may also
make it robust.

  4. (4)

False boundaries of text/images are also helpful in designing a good CAPTCHA.

  5. (5)

Apposite selection of multiple backgrounds and foreground colors also enhances
security.

  6. (6)

CAPTCHA must be generated at run-time with enough randomness.

  7. (7)

Random length and combination of characters must be promoted.

  8. (8)

Make it sturdy against pixel count attacks, such as by using random wrapping
of text.

  9. (9)

Clever use of words, phrases, and images is required.

  10. (10)

To avoid database attacks, the use of a large-sized database is mandatory.

  11. (11)

Feature deformation is helpful in image-based CAPTCHA designing to deter ML-
based attacks.

  12. (12)

A good CAPTCHA must be resilient against random guessing attacks.

  13. (13)

We can confine the number of attempts and the time taken to solve a CAPTCHA.

  14. (14)

Question-based CAPTCHA may be based on the logical thinking of humans rather
than on computations only.

  15. (15)

A combination of text and images is a good strategy.

  16. (16)

Make more human interactions through mouse-clicking, screen tapping, drag-n-
drop, or drop-down lists.

  17. (17)

Machine learning technology is used in both breaking and security enhancements
in the CAPTCHA. An example of this technology is the adversarial and neutral
style that may give better directives for designing CAPTCHA (kwon2020robust,
).

  18. (18)

While the need to solve the different challenges might be pressing, some
confidential information is also required (kalaichelvi2020image, ).
Confidential information, such as pass time, pass speed, and the operation
tracks, are needed to differentiate humans from robots.

  19. (19)

Language comprehension should be paid more attention. As the ability to
understand language is a required human skill to improve CAPTCHA in its
entirety. Associative power is just another advanced human skill that can
improve CAPTCHA.

Figure 28. The proposed taxonomy of CAPTCHA breaking techniques.

However, if these factors are applied eminently, the usability of the
resultant challenge will decrease. As said earlier that there is a trade-off
between robustness and usability. For example, adding more clutter,
distortion, or overlapping will result in robust yet less readable and
annoying CAPTCHA for human users. Therefore, we need to balance robustness and
usability at the same time in a healthy proportion.

##  6\. CAPTCHA breaking techniques

Mori and Malik (mori2003recognizing, ) gave the idea of CAPTCHA breaking in
2003. They made recognition-based attacks on Gimpy and EZ-Gimpy CAPTCHAs. They
attacked many schemes and revealed the weaknesses of different CAPTCHA
schemes. This section presents different attacks made on various CAPTCHA
schemes. A taxonomy of different CAPTCHA breaking techniques is shown in Fig.
28.

###  6.1. Segmentation Attacks

In breaking a CAPTCHA, segmentation is the most crucial step. A CAPTCHA
challenge can only be well-recognized if the segmentation step is done
properly (wang2018optimized, ). Chellapilla et al. (chellapilla2004using, )
claimed that once CAPTCHA texts are segmented well, recognizing a single
character is much better in automated programs than humans. Pre-processing is
done first to remove noise and clutter. Once Pre-processing has been done, the
process of segmentation is started. A well-segmented image is then going
through the recognition process to break a CAPTCHA scheme (chen2017survey, ).
A generic view of CAPTCHA breaking steps is given in Fig. 29 followed by some
segmentation-based attacks made on different CAPTCHA schemes.

Figure 29. A generic view of CAPTCHA breaking steps.

####  6.1.1. Vertical segmentation

Many visual CAPTCHA schemes are attached by Chellapilla et al.
(chellapilla2004using, ). According to the estimate, the success rate shot
from 4.89% to 66.2% in this segmentation. The authors stated that humans
feasibly detected the twisted/distorted word into a complete word on account
of this. Therefore, it is pertinent to mention that they can easily break a
segmented text as well.

Microsoft, Yahoo, and Google CAPTCHA were termed the weakest ones as humans’
capability to break them were relatively higher, says Jeff Yan and Ahmed Salah
(yan2007breaking, ). They took six improperly sequenced letters or numerical
digits from services.org CAPTCHA. Even though they were not in a sequence,
overlapping words could not become possible, making humans rethink every time
they click the expected digit. Hence, segmentation was possible in a vertical
position. Each word was then counted in pixel table after segmentation for
recognition, as seen in Fig. 30 and 31.

Figure 30. Showing vertical segmentation. Figure 31. Letter A-Z and their pixel count. Table 4. Pixel-count lookup table. Alphabet | Pixel-count
---|---
A | 183
B | 217
C | 159
D | 192
E | 163
F | 133
G | 190
H | 186
I | 121
J | 111
K | 178
L | 111
M | 233
N | 239
O | 178
P | 162
Q | 229
R | 208
S | 194
T | 175
U | 164
V | 162
W | 234
X | 181
Y | 153
Z | 193

Table 4 represents the lookup table used in letter-pixel count. The success
rate of this approach was nearly 100%. In contrast, the strategy fails to
function in letters with the same number of pixels (highlighted red in Table
4), especially when they overlap. Additionally, suppose the same pixel refers
to more than one character. In that case, it paves the way for ambiguity and
malfunctioning of the segmentation algorithm.

####  6.1.2. Snake segmentation

To get rid of the simple segmentation, snake Segmentation (yan2007breaking, )
was used. There is no such rule in Snake Segmentation that it has to be
vertical only. As shown in Fig. 32, the snake can move forward and backwards
and up and down to break a picture. Standardization is done to see the letter,
and that happens when the segmentation is done. A success ratio of 96% in the
examples given and 99% on pictures selected randomly was attained. The images
with alphabets, words, or numbers are difficult to break down because they are
either joint or overlapping images.

Figure 32. Snake segmentation:(a) Pre-processing,(b) Prior to segmentation(c)
After segmentation.

####  6.1.3. Color filling Segmentation

Color filling segmentation was used for pictures that contain only two colors,
one of them being the background (el2010robustness, ). The other color is used
for the text; therefore, the foreground. The foreground letters are dispersed,
and to form an image, different colors are combined, and each pixel’s count in
the segment is done. The count done here is then compared with the count that
is in the pixel table. If the count falls short, it is added with its
adjoining right and left segment to figure out the correct letter or digit, as
shown in Fig. 33.

Figure 33. Component identification:(a) Original CAPTCHA(b) Background
removal(c) Loop removal. Figure 34. Final recognized characters.

If there are many arcs placed, then this method is not successful. Megaupload
(el2010robustness, ) made a new segmentation resistance that was not like
Google, Yahoo, or even Microsoft. There are a total of 4 digits and letters
that are placed horizontally. Some of the parts have overlapped in them. They
are eliminated and are only in two colors, black and white. For color
segmentation to be done, the black and white parts are taken out one after
another. They are added to recognize the white components, and any clutter or
background loops are cut off. They are added together to make a letter in the
end. In 100 sample tests, the success ratio is 82% with sufficient attack
speed; 400 different samples had a success ratio of 78.25%. However, serious
problems can be caused if two or more of the characters are joined to the
black part, as shown in Fig. 34.

If the loop is not recognized accurately, a problem can occur. Another similar
attack is launched on image-based CAPTCHAs, IMAGINATION, in (zhu2010attacks,
). They used a color-edge and line-segmentation detection mechanism. One
hundred and nine (109) images of the said CAPTCHA scheme were brought together
online, and with a success ratio of 74.31%, they broke 81 CAPTCHA images.

####  6.1.4. Projection-based segmentation

To break the CAPTCHA scheme, there are two basic methods; identification and
segmentation (huang2008projection, ). The procedure of identification
acknowledges a character when it has been segmented well. Letters and clutter
were identified separately through label segmentation, and Chellapilla
(chellapilla2005computers, ) also used it. The segmentation method fails of
the difference is not much, and the characters tend to break to eliminate
noise. As shown in Fig. 35, projection-based segmentation was used by Huang et
al. (huang2008projection, ) for Yahoo and MSN CAPTCHAs. The technique used by
them had a rate of success of 9% more than the Chellapilla. As it helps to get
rid of the clutter and noise, that is the advantage it has over Chellapilla.
To analyze the CAPTCHAs, this technique helps to give a new dimension.

Figure 35. (a) Test image (b) Projection-based image.

####  6.1.5. DeCAPTCHA

Bursztien and Bethard (bursztein2009decaptcha, ) attacked eBay audio CAPTCHA.
They represented a proposal, ’DeCAPTCHA’, in order to break the sound-based
CAPTCHA schemes. ’CAPTCHA chorus’ is made by the scraper to make such an
attack. To break Sound CAPTCHAs, we can use Sphinx (walker2004sphinx, ), which
is a state-of-the-art sound recognizer. A graph is made when the audio is
changed to features to decode the words and letters that are said. For this
purpose, auditory and language modules are needed. The DeCAPTCHA broke a total
of 75% of the sound-based CAPTCHAs, and the downloads were limited for this
reason.

####  6.1.6. K-Means layered segmentation

As shown in Fig. 36, there are transactions conducted in the e-banking on the
CAPTCHA verification bases to avoid attacks by the bot. They help prevent
unauthorized access and keep it safe from attacks by a Man-in-the-Middle
(MitM). The pattern detected is processed by a tool, namely K- mean layered
segmentation. There are three layers of e-banking CAPTCHAs, the first one
having grids that are placed erratically. User birthday entrenched is the
second layer, with each letter and digits having font style, location, and
random alternation. The final uppermost layer has a transaction date on it.
There are several steps to carry the attack out. To better the e-banking
CAPTCHA, there are good lines provided. The rate of success is around 100% for
breaking e-banking CAPTCHA. Li and Khayam (li2010breaking, ) suggested not to
use the e-banking CAPTCHA and use hardware security accomplishment instead.

Figure 36. Segmentation results of a Ge-Captcha image.

####  6.1.7. Filter-based segmentation

A low cost yet powerful attack based on Log-Gabor filters is proposed in
(yan2016simple, ) to break various designed text-based CAPTCHAs. The attack
shows a 5% to 77% success rate with less than 5 seconds on average to break a
single instance of text CAPTCHA. They also compared Log-Gabor filters accuracy
with other filter-based segmentation schemes, such as 2D Gabor filters and
steerable filters. The results show that the Log-Gabor filter segmentation
outperformed on character extraction than the two, as shown in Fig. 37.

Figure 37. character component extraction using Gabor filters.

###  6.2. ML- and DL-based attacks on CAPTCHAs

Automated processes can also break CAPTCHAs with ML and speech recognition
algorithms. Golle (golle2008machine, ) showed that ML-based attacks have a
10.3% success rate on Asirra. Similarly, in (zhu2010attacks, ), an ML-based
attack is made on image-based CAPTCHAs with a 40% success rate. Saroha et al.
(saroha2021strengthening, ) used a backpropagation-based mechanism for CAPTCHA
recognition. The following are some ML-based techniques used in CAPTCHA
breaking.

####  6.2.1. Convolutional Neural Network (CNN)

CNN is used for analyzing visual imagery, and they are good in areas like
image classification (krizhevsky2012imagenet, ). The other variants of CNN,
such as Regions with CNN features (RCNN) and Fast-RCNN, Faster RCNN, YOLO, and
SSD, are integrated with improved security features and object detection
accuracy (weng2019towards, ), (du2017captcha, ), (liu2017cnn, ), and
(sachdev2020breaking, ). CNN is equipped with a better mechanism with enhanced
accuracy and time complexity. However, CNN’s establishment requires much
effort, including pre-trained staff members and much homework (shu2019end, ).
Furthermore, it requires a large quantity of high-quality data along with a
dependable neural network. Hence, it requires a high initial cost
(wang2018optimized, ). A CNN-based Chinese text-based CAPTCHA breaking
mechanism is proposed in (jia2018approach, ). Similarly, Stephen and Lu
(dankwa2021efficient, ) assessed cyber security vulnerabilities by breaking
CAPTCHAs using CNN. A semi-supervised DL-based (CNN) approach is used in
(bostik2021semi, ) for breaking common CAPTCHA schemes.

Figure 38. CNN network structure.

(chen2018attack, ) proposed non-redundant merging with an accurate filling
scheme for cracking the hollow CAPTCHA. In solid characters, they applied the
nearest-minimum neighbor merging algorithm for gaining the correct individual
characters. They used CNN to obtain the final recognition results with a
success rate of 97.50% for individual characters and 91.00% for single images.
A depiction is shown in Fig. 38 (weng2019towards, ) discussed three different
proof-of-concept attacks for selection-based CAPTCHAs, slide-based CAPTCHAs,
and click-based CAPTCHAs. They break the CAPTCHA of 10 real-world security
systems. They also discussed this method’s working efficiency with previous
methods, i.e., image recognition service and humans involved in the CAPTCHA
solving process. The success rate of the scheme is 85.72%-99.65%.

A Deep Convolutional Neural Network (DCNN) was presented to break such
CAPTCHAs based on a confusion class. However, it has low recognition accuracy.
Therefore, the selective-learning confusion class was introduced to overcome
this problem for text-based CAPTCHAs in (chen2019selective, ). The process
involves a two-stage DCNN framework based on the confusion relation matrix.
The partitioning algorithm improved 1.4%-39.4% for confusing characters for
confusion class DCNN and the validation and training algorithm. Another DCNN-
based attack is made on image-based CAPTCHAs in (singh2018machine, ). They
took 25,000 test images, and the accuracy rate is as high as 95.2%. Similarly,
Zhang et al. (zhang2021development, ) propounded Captchanet as a
classification mechanism for Chinese character-based CAPTCHAs with better
accuracy than other DL-based mechanisms. Another CAPTCHA recognition scheme is
presented by Wand and Shi (wang2021captcha, ) based on CNN with 99%, 97.84%,
and 98.5%, recognition rate.

####  6.2.2. Deep learning

Deep learning is considered the most dominating method among different
existing techniques from the last few years. Due to this method, the existing
techniques have developed significantly better recognition than humans. Deep
neural networks usually are integrated with all the levels of features and
end-to-end based classifiers involving the multiple layer fashion enriched
with the numbers of depths (vatanen2013pushing, ). They have the degradation
issue when these start to converge, which increases with the increasing depth
and results in reduced accuracy (he2016deep, ). This technology is employed in
different recognition fields, such as image, text, and audio recognition.
These techniques, such as CNN, RNN, LSTM-RNN, are some to mention, which are
used in CAPTCHA recognition (chen2017survey, ).

As discussed earlier, the CNN approach recognises characters’ images without
extracting the features and is strong in displace, deformation, and scaling.
The research (goodfellow2013multi, ) shows that the recognition of CAPTCHA
with a distributed deep convolutional neural network has an accuracy of 99.8%.
However, it cannot be combined with context information recognition due to
time constraints. Hence, feedback and time parameters based RNN was proposed
for handling time series data. However, despite that, this scheme has a
dispersing gradient issue. Therefore, the LSTM approach was proposed
(liang2011highly, ), using the 2D LSTM-RNN for recognizing CCT CAPTCHAs with
the accuracy of 55.2%. This approach was successful in obtaining the relevant
information on the horizontal as well as the vertical axis. This paper
proposes the generic, simple, and fast attack approach for decoding text
CAPTCHA with a superposition challenge. Similarly, Tang et al.
(tang2018research, ) proposed a generic, simple, yet fast approach for
decoding CAPTCHA schemes with the superposition. The deep learning-based
breaking of roman-text-based character CAPTCHA with the success rate of
10.1%-90.0%. The scheme also attacked three Chinese CAPTCHAs with success
rates of 93.0%, 32.2% and 28.6%, respectively.

Figure 39. LeNet-5 feed-forward architecture.

Sivakorn et al. (sivakorn2016robot, ) designed a novel low-cost attack that
controls the semantic annotation of images through deep learning technology on
image-reCAPTCHA and Facebook image CAPTCHA schemes. The accuracy rate of the
said scheme is 70.78% for image reCAPTCHA and 83.50% for Facebook image
CAPTCHA.

####  6.2.3. Support Vector Machine (SVM)

SVM is also considered a proficient classification technique. It is based upon
Statistical Learning Theory with many advantages, such as robustness,
accuracy, and effectiveness, even with few training samples. They are non-
parametric binary classifiers by nature. It works by separating classes
through a hyper-plane. The kernel function uses a key, which decodes the
original features and converts them into high-dimensional space in a nonlinear
way, enhancing the separability for data (chen2017survey, ). They are widely
applied in machine vision fields like character, hand-writing digitization,
text recognition, and even satellite image classification
(anthony2007classification, ).

Figure 40. The GUI visualization of character segmentation and SVM-based
recognition used in (starostenko2015breaking, ).

Starostenko et al. (starostenko2015breaking, ) presented an innovative
approach for solving the automatic segmentation and recognizing reCAPTCHAs and
other text-based CAPTCHAs using an SVM-based classifier. Different font sizes
having different waving patterns and rotation in this approach collapse in
random over-lapping characters. The suggested segmentation process is founded
on three-color bar character encoding, which separates the letter in
reCAPTCHA. The average segmentation rate was up to 82%, while the SVM
classifier success rate was almost 94%. However, this technique fails in
decoding the reCAPTCHAs of 2012. Another such technique is proposed in
(golle2008machine, ), broke image-based CAPTCHAs using SVM with an 82.7%
accuracy rate.

####  6.2.4. Fuzzy logic

Out of other techniques in clustering, the most commonly used algorithms is
the Fuzzy C-Means (FCM). Fuzzy logic is widely used for image segmentation.
The mechanism is a well-known clustering approach that uses numerical data
(k-means method) or large datasets, i.e., a tiered method for solving
dissimilarity matrices (gao2012divide, ). It works by partitioning the finite
collection into sets of c fuzzy clusters. It results in the formation of
clusters involving every element to a certain degree. These elements can also
belong to the different clusters at the same time, i.e., soft clustering. A
fuzzy logic-based mechanism is propounded in (fonseca2000using, ) by Fonseca
et al. for recognizing geometrical shapes interactively.

Their algorithm can easily recognize elementary geometrical shapes like
triangles, rectangles, circles, and ellipses. It observes and collects the
geometrical features of different shapes from the database and combines them
to recognize the final geometrical figure. They used the perimeter and area to
recognize features that separate all the geometrical figures, as given by
Grahm’s Algorithm (o1998computational, ). After this, each fuzzy set belonging
to each feature was used for the recognition of shapes. Sasi et al.
(sasi1994handwritten, ) studied the application of fuzzy set theory for the
classification of hand-written characters sets. Initially, all the hand-
written characters were classified into 4x4 matrix cells. They were analyzed
and stored in the database under different categories. Another edge corner-
based segmentation–recognition mechanism is proposed by Nachar et al.
(nachar2015breaking, ) using fuzzy logic for breaking different types of
CAPTCHA schemes. The success rate for eBay, Wikipedia, ReCAPTCHA, and Yahoo
was 68.2%, 76.7%, 62.5%, and 57.3%, respectively.

Figure 41. Edge corner-based fuzzy logic segmentation and recognition.

####  6.2.5. Artificial neural networks (ANN)

For image recognition, different neural network approaches have been proposed.
All interconnected units, called artificial neurons, are trained to solve
complex problems. Each neural network consists of hundreds of layers, which
are the same as the human brain. However, neural networks require intensive
training with thousands of samples along. Moreover, the quality of training
data and feature extraction also play an important role in final recognition
(chen2017survey, ). Simard et al. (simard2003best, ) came forward with their
application for visual documentation analysis. Another ANN-based mechanism is
proposed by Koerich et al. (koerich2005recognition, ) using discrete Hidden
Markov Models (HMM) for unconstrained hand-written words’ recognition and
verification. Furthermore, Kaur et al. (kaur2012artificial, ) showed that an
ANN system could also be used to recognize the character. Barve et al.
(barve2012optical, ) showed that an optical character recognition system
designed with ANNs could have high noise tolerance. In (liang2011highly, ), a
BPNN employed a cross entropy method using Recurrent Neural Network (RNN) to
calculate the network’s performance. The overall precision for the CCT
CAPTCHAs of Taobao is 51.3%. It is 27.1% for MSN and 53.2% for the eBay.
However, the main problem is the extraction character feature of high quality,
limiting the final results.

####  6.2.6. Generative Adversarial Networks (GAN)

A GAN uses a generative network for generating mock examples and a
discriminate network for distinguishing the produced examples from the actual
scenarios. For this purpose, back-propagation is used to train both networks;
after some training iterations, the generators give better mock samples. In
contrast, the discriminator becomes better using flagging synthetic data
(ye2018yet, ). GANs showed the extraordinary results in image (isola2017image,
)(zhu2017unpaired, ) and natural language (yu2017seqgan, )(li2017adversarial,
) processing tasks. However, due to the technique’s freshness, no literature
work is available where GANs were used for solving the text-based CAPTCHAs.
Therefore,a GAN-based bot is proposed in (ye2018yet, ) for solving text-based
CAPTCHAs. The bot uses training data and can solve a wide range of text-based
CAPTCHA schemes. The deviation from the past ML-based attacks requires few
newly created CAPTCHAs for building the solver. It is achieved by learning the
synthesizer and then generating training data for building a solver base. It
them refines the solver through transfer learning on real CAPTCHAs data sets.
The main advantage of this approach is that it requires very little human
intervention for learning.

Figure 42.  A GAN-based Pre-processing model proposed in (ye2018yet, ).

####  6.2.7. K-nearest neighbours (KNN)

KNN is designed on the category having the nearest k samples for determining
the category of a test sample. KNN is the most commonly used recognition
classifier for breaking text-based CAPTCHA systems. However, the accuracy of
KNN classification depends on the size of samples and the value of k. In
(yan2016simple, ), several approaches like SVM, BPNN, template matching, CNN,
and KNN were tested. The results showed that KNN achieved the highest success
rates for most schemes, whereas CNN showed better results in the shortest
time.

###  6.3. Distortion estimation technique

Distortion-estimation techniques break EZ-Gimpy and Gimpy-r CAPTCHAs. A 99%
accuracy on Ez-Gimpy and 78% on Gimpy-r CAPTCHAs is projected by Gabial Moy et
al. (moy2004distortion, ). They used a dictionary of 561-word in breaking Ez-
gimpy and a four-letter word dictionary for Gimpy-r CAPTCHAs. The correlation
is used in matching words by cores and minipatches identification, as shown in
Fig. 43 and 44. The correlation mechanism gave high success and accuracy
rates; however, it failed in identifying high distorted images. Also, the
dictionary used in breaking was small, which made execution ineffective.
However, on the increased size of slicing, the execution time increased, as
well.

Figure 43. Identifying 24 minipatches in the image. Figure 44. Gimpy-r
challenge with background removal.

###  6.4. Dictionary attacks

In networks, a user is likely to encounter a Denial of Services (DoS) attack
(tariq2019security, ). While in an allotted time restriction, if the amount of
guesses is incorrectly made, the account becomes locked. The issue is
encountered by legitimate users who end up facing service poverty. To get the
better of these kinds of issues, EZ-Gimpy and Gimpy CAPTCHAs had been
initiated. Mori and Malik (mori2003recognizing, ) struck the mentioned
variations of CAPTCHAs, turning it uncertain by virtual brute force strikes.
The procedure of this kind of attack is displayed in Fig. 45 and 46.

Figure 45. A basic attack: a failing example where segmentation is not
possible between ’k’ and ’s’.

Text-based CAPTCHAs are where brute force attacks are formed, especially those
containing a file. If not, then a database is linked alongside them. Yan and
Salah (yan2007breaking, ) used gullible arrangement identification techniques
to shatter a category of visual CAPTCHA. The highlighted issue of evident
segmentation and pixel counts was conquered with the use of brute force
strikes. A word is primarily sent through connection and, after that, from
recognition. However, the scheme malfunctions if disconnected or linked
letters are greater than 3 in numbers or all displayed or entered letters are
joined. Brute force strikes are doable for words that are entered in the
English language. However, unsystematic character/inclusion of digit CAPTCHA
cannot be fractured by such variations of strikes.

Figure 46. A basic attack with dictionary enhancement.

###  6.5. Reverse engineering method

Hindle and Michael. (hindle2008reverse, ) came up with the suggestion of
reverse engineering for breaking a particular CAPTCHA scheme, as shown in Fig.
47. They compared CAPTCHAs’ weakness after breaking them to highlight the way
to make them more robust. However, it uses a bit map illustration solely for
CAPTCHAs based on text.

Figure 47. Model of computer CAPTCHA solving.

The accuracy level of the technique used for PHPBB CAPTCHA is 99%. For Rogers
CAPTCHAs, it is 95%, for Piratebay is 61% and for Watercap CAPTCHA is 27%.
This perspective has provided adequate proposals for building CAPTCHAs more
applaudable. However, it is unable to take in the use of sound and visual-
based CAPTCHAs.

##  7\. Challenges and open issues in CAPTCHA breaking techniques

As mentioned before, there are different types of CAPTCHAs, such as text,
image, audio, or video. They provide security against malevolent bot attacks.
Unfortunately, they have the same fate and prone to breaking attacks
(adams2015detecting, ). Their security and usability, at the same time, is a
challenging task. The current study on CAPTCHA reveals that although much work
has been done on their security, however, there are still design
vulnerabilities that make them insecure (Zhang2019survey, ),
(tang2018research, ), (Chow2019, ). Previously (in this paper), it is observed
that several attacks are made on well-known CAPTCHA schemes, such as breaking
of reCAPTCHA used extensively by Google. That is because there is no
standardized mechanisms and practice for designing robust CAPTCHAs. Therefore,
by exploiting their vulnerabilities, the hackers manage to break CAPTCHAs
readily to harm the target source.

Another important reason behind breaking CAPTCHAs is to find their design
vulnerabilities to bring security improvements in their design. There are
different steps that are involved in CAPTCHA breaking, such as pre-processing
(sun2019captcha, ), image processing (wei2019research, ), pattern matching
(sonwalkar2020captcha, ), ML (alqahtani2020image, ), are just to name a few.
The pattern matching-based attacking technique was widely used in the
beginning. The downside of this attack is that it requires manual instructions
to extract features for different CAPTCHA types. On the contrary, segmentation
attacks are the most typical type of attack. Conversely, this method is not
suitable for real-time attacks because it requires a prolonged duration,
affecting the breaking speed. There are other end-to-end attacking models,
which use ML-based models, for example (zi2019end, ), (li2020end, ), and
(shu2019end, ). However, they require more hardware and computational
resources. For instance, a deep learning approach to recognize a CAPTCHA in
its entirety requires high hardware requirements.

Table 5. A summary of different CAPTCHA breaking techniques Attack type | Algorithm | Summary
---|---|---
|  | Ref. | Year | Accuracy | Samples | CAPTCHA
Machine learning | Distortion estimation | (moy2004distortion, ) | 2004 | 99% | 561 | Text
| K-nearest neighbors | (yan2016simple, ) | 2016 | 77.2% | – | Text
| GAN | (ye2018yet, ) | 2018 | 87.4-90% | 500 | Text
| CNN | (chen2017survey, ) | 2018 | 91% | 200 | Text
| CNN | (wang2018optimized, ) | 2018 | 99.75% | – | Text
| ML | (zhu2010attacks, ) | 2010 | 40% | 800 | Image
| SVM | (golle2008machine, ) | 2008 | 82.7% | 13K | Image
| ML | (singh2018machine, ) | 2018 | 95.2% | 25K | Image
| DCNN | (goodfellow2013multi, ) | 2014 | 99.8% | 100k | Text
| RNN | (liang2011highly, ) | 2011 | 27-53.2% | – | Text
| DL | (sivakorn2016robot, ) | 2016 | 70.78% | 700 | Image
| DL | (sivakorn2016robot, ) | 2016 | 83.50% | 700 | Image
| Fuzzy logic | (nachar2015breaking, ) | 2015 | 57.3-76.7% | – | Text
Segmentation | Snake | (yan2007breaking, ) | 2007 | 94% | 100 | Text
| Vertical | (yan2007breaking, ) | 2007 | 99% | 100 | Text
| Divide and Conquer | (gao2013robustness, ) | 2013 | 83% | 1k | Text
| Colour filling | (el2010robustness, ) | 2010 | 78% | 400 | Text
| Color-edge & line segmentation | (zhu2010attacks, ) | 2010 | 74.31% | 109 | Image
| Projection | (huang2008projection, ) | 2008 | 75% | – | Text
| K-Means | (li2010breaking, ) | 2010 | 100% | 100 | Text
Dictionary | OCR | (yan2007breaking, ) | 2007 | 99% | 100 | Text
| TM/OCR | (wang2018optimized, ) | 2018 | 98.98% | – | Text
Distortion Estimation | Reverse engineering | (hindle2008reverse, ) | 2008 | 93% | 100 | Text
Software-based | Decaptcha | (bursztein2009decaptcha, ) | 2011 | 75% | 26k | Audio

Under the light of our findings, The following points must be considered in
designing attacks for breaking a CAPTCHA scheme:

  1. (1)

The CAPTCHAs, especially text-based, are mostly broken using segmentation
attacks. Therefore, segmentation-strategies must be revisited to tranche the
overlapped text/objects.

  2. (2)

A larger size of dictionary/database must be kept updated to launch dictionary
attacks. Besides, pixel statistics should also be revised from time to time.

  3. (3)

The end-to-end attack is one of the most foremost directives for CAPTCHA
breaking (shu2019end, ). These attacks are mostly Dl-based, which pose
particular challenges in terms of required resources. Thus, there needs to
have a lightweight and more convenient DL-based CAPTCHA-breaking approach.

  4. (4)

There is a problem associated with ML techniques, which requires a significant
number of construed datasets. This problem cannot be disregarded, so much so
that a less dependent model on the training dataset is required.

  5. (5)

An exclusive trained system is required to break different CAPTCHA. A more
non-specific network that can be moved to multiple means is needed because
dataset labeling is expensive.

  6. (6)

An ML-based algorithm, such as DL, is a threat to CAPTCHA security. Hence, a
new CAPTCHA defense system is needed to be equipped enough to counter it
(tang2018research, ). Multi-layer feature representations and abstractions
from various kinds of data are the most critical purpose of ML. With deep
learning, a convolution neural network was applied to image classification. A
myriad of other tasks since 1989, such as (zhao2004genetic, ),
(zhao2019object, ), (zhao2016corrupted, ), (wang2008classification, ),
(zhao2012completed, ), and (lecun1989backpropagation, ) have been proposed.
AlexNet, in recent times, has enhanced the architecture of CNN and notably to
improve the classification effect (Zhang2019survey, ). It has also become the
customary trainers for CNN on GPUs (xu2020survey, ).

  7. (7)

There is a limit in ML technology when involved with AI image processing, such
as; symmetry (he20162016, ) and adversarial examples (osadchy2016no, ) and
(szegedy2013intriguing, ). According to Osadchy et al. (osadchy2017no, ),
CAPTCHA designed using concerning deep learning limitations is a viable future
exploration (osadchy2016no, ).

  8. (8)

Web access and software generation are the two ways in which researchers get
the CAPTCHA samples. The importance of standard test databases as a
requirement for breaking in database-based CAPTCHAs, such as traditional test
databases, is necessary for an improved text-based CAPTCHA.

  9. (9)

A database is required to provide dependable testing and training data for
analytical work. Therefore, to gather, categorize, arrange, and initiate a
CAPTCHA database is of high importance.

  10. (10)

There is a myriad of feature changes in a CAPTCHA. Presently, the efficacious
identification of CAPTCHAs by a classifier can only be made when training sets
and set types belong to the same class. Therefore, it is quite onerous and
necessary to design a standard classifier to identify different CAPTCHA types.

  11. (11)

The high success rate that has been achieved by Text-based CAPTCHA breaking is
astounding. Sadly, Crowding Characters Together (CCT) strings have been widely
used in the text-based CAPTCHA, causing a snag in the results
(kwon2019captcha, ). This drawback is due to the problem associated with the
segmentation-free CAPTCHA identification; a situation that requires immediate
attention. This problem may be solved using deep learning because of its new
ideas and techniques.

  12. (12)

Machine learning has been found to deliver quality results than other
conventional techniques (hernandez2023breaking, ). For instance, CNN and its
improved methods, Deep Belief Networks (DBN) (ben2020dbn, ), RNN (li2020alec,
), and Deep Reinforcement Learning (DRL) (uzkent2020efficient, ), are the most
applied techniques. However, they still are not frequented in CAPTCHA
identification. Although careful analysis, the application of fusion and
correlation between the different deep learning types is not thorough. There
is still a need for more effective and efficient learning models to enable
ease in CAPTCHA identification.

  13. (13)

There has been an increase in identification results’ dependability due to
better breaking CAPTCHA techniques. Therefore, there is a need to certify the
correct rejection, dismissal, and improve the accuracy rate of recognition.
Rejection as a concept is not well-known in the CAPTCHA recognition field. It
is, however, quite clear that it can be developed.

  14. (14)

In the extraction of features automatically, using ML, characters with similar
characteristics are handily muddled. Practically, the accuracy of feature
extraction and training methods can be improved by various ML-based
techniques, such as DL and its variants (xu2020survey, ).

Figure 48. Accuracy comparison of different ML-based attacks. Figure 49.
Accuracy comparison of different segmentation attacks. Figure 50. Accuracy
comparison of miscellaneous attacks.

###  7.1. Performance analysis of CAPTCHA breaking techniques

In keeping with our study, Table 5 presents a summary of the comparison among
different state-of-the-art CAPTCHA breaking mechanisms. As said earlier, ML-
based attacks are widely used in CAPTCHA breaking, out of which DL variants
are the most prominent. As depicted in Fig. 48, DCNN (goodfellow2013multi, )
outperformed other ML techniques with a 99.8 percent accuracy rate. Similarly,
we make a comparison of segmentation-based attacks, shown in Fig. 49. Among
all, the K-Means-based (li2010breaking, ) segmentation attack outperformed
others with accuracy as high as 100 percent. And then comes the vertical
segmentation attack (yan2007breaking, ) with a 99 percent accuracy rate.
However, both the breaking techniques are old and were used a decade before.
Thus, they might not work equally well on today’s advanced CAPTCHA schemes. We
also compared other breaking techniques, whose depiction is shown in Fig. 50.

##  8\. Conclusion

Deciding whether the user is a human or a malicious bot program is challenging
for a web service provider. CAPTCHA is a security mechanism used against
automated malicious bot programs. There are different types of CAPTCHA based
on their formation and structure for distinguishing humans and machines apart.
This survey provided an in-depth analysis of various CAPTCHA schemes
categorized as OCR and non-OCR CAPTCHA schemes. We analyzed the usability and
the design loopholes of each CAPTCHA type. The most crucial issue in CAPTCHA
designing is the deformation and noise, compromising its usability and making
it annoying for a human user. This study spotlit the design vulnerabilities
and suggestions to the designers for making CAPTCHA schemes more user-friendly
yet attack-resistant. Besides, it also highlighted the challenges and open
issues in CAPTCHA designing.

However, CAPTCHA security is still a question. They are subject to attacks.
There are different braking techniques, such as segmentation, ML-, and DL-
based attacks. Among others, it is noted that ML-based, especially DL-based
breaking schemes, are more dominantly practiced. This survey showed the
vulnerabilities of different CAPTCHAs schemes based on the state-of-the-art
CAPTCHA breaking schemes. It also provided an in-depth analysis of these
breaking schemes.

Moreover, it highlighted challenges and open issues in breaking the various
CAPTCHA schemes. It also provided a discussion on CAPTCHA breaking techniques
that how better breaking techniques might be designed. The study would help in
the usable and attack-resistant CAPTCHA designing. In the future, we aim to
design a robust and user-friendly image-based CAPTCHA that is also scalable.

## References

  * [1] Noshina Tariq, Muhammad Asim, Farrukh Aslam Khan, Thar Baker, Umair Khalid, and Abdelouahid Derhab.  A blockchain-based multi-mobile code-driven trust mechanism for detecting internal attacks in internet of things.  Sensors, 21(1):23, 2021.
  * [2] Abdelouahid Derhab, Rahaf Alawwad, Khawlah Dehwah, Noshina Tariq, Farrukh Aslam Khan, and Jalal Al-Muhtadi.  Tweet-based bot detection using big data analytics.  IEEE Access, 9:65988–66005, 2021.
  * [3] Nitirat Tanthavech and Apichaya Nimkoompai.  Captcha: Impact of website security on user experience.  In Proceedings of the 2019 4th International Conference on Intelligent Information Technology, pages 37–41, 2019.
  * [4] Yang-Wai Chow, Willy Susilo, and Pairat Thorncharoensri.  Captcha design and security issues.  In Advances in Cyber Security: Principles, Techniques, and Applications, pages 69–92. Springer, 2019.
  * [5] Temur ul Hassan, Muhammad Asim, Thar Baker, Jawad Hassan, and Noshina Tariq.  Ctrust-rpl: A control layer-based trust mechanism for supporting secure routing in routing protocol for low power and lossy networks-based internet of things applications.  Transactions on Emerging Telecommunications Technologies, 32(3):e4224, 2021.
  * [6] Afsheen Ahmed, Rabia Latif, Seemab Latif, Haider Abbas, and Farrukh Aslam Khan.  Malicious insiders attack in iot based multi-cloud e-healthcare environment: a systematic literature review.  Multimedia Tools and Applications, 77(17):21947–21965, 2018.
  * [7] Muhammad Imran, Muhammad Hanif Durad, Farrukh Aslam Khan, and Abdelouahid Derhab.  Toward an optimal solution against denial of service attacks in software defined networks.  Future Generation Computer Systems, 92:444–453, 2019.
  * [8] Zhiyou Ouyang, Xu Zhai, Jinran Wu, Jian Yang, Dong Yue, Chunxia Dou, and Tengfei Zhang.  A cloud endpoint coordinating captcha based on multi-view stacking ensemble.  Computers & Security, 103:102178, 2021.
  * [9] Gil Gonen, Ronen Haber, and Arie Haenel.  Secure captcha test, March 1 2018.  US Patent App. 15/249,493.
  * [10] Ping Wang, Haichang Gao, Xiaoyan Guo, Chenxuan Xiao, Fuqi Qi, and Zheng Yan.  An experimental investigation of text-based captcha attacks and their robustness.  ACM Computing Surveys, 55(9):1–38, 2023.
  * [11] Jie Zhang, Min-Yen Tsai, Kotcharat Kitchat, Min-Te Sun, Kazuya Sakai, Wei-Shinn Ku, Thattapon Surasak, and Tipajin Thaipisutikul.  A secure annuli captcha system.  Computers & Security, 125:103025, 2023.
  * [12] Ping Wang, Haichang Gao, Chenxuan Xiao, Xiaoyan Guo, Yipeng Gao, and Yang Zi.  Extended research on the security of visual reasoning captcha.  IEEE Transactions on Dependable and Secure Computing, 2023.
  * [13] Noshina Tariq, Muhammad Asim, and Farrukh Aslam Khan.  Securing scada-based critical infrastructures: Challenges and open issues.  Procedia Computer Science, 155:612–617, 2019.
  * [14] Mohinder Kumar and Manish Kumar Jindal.  Benchmarks for designing a secure devanagari captcha.  SN Computer Science, 2(1):1–16, 2021.
  * [15] Noshina Tariq and Farrukh Aslam Khan.  Match-the-sound captcha.  In Information Technology-New Generations, pages 803–808. Springer, 2018.
  * [16] L. Von Ahn, M. Blum, N. Hopper, and J. Langford.  Captcha: Using hard ai problems for security.  Advances in Cryptology, EUROCRYPT 2003, pages 646–646, 2003.
  * [17] Jonathan Lazar, Jinjuan Feng, Tim Brooks, Genna Melamed, Brian Wentz, Jon Holman, Abiodun Olalere, and Nnanna Ekedebe.  The soundsright captcha: an improved approach to audio human interaction proofs for blind users.  In Proceedings of the SIGCHI conference on human factors in computing systems, pages 2267–2276. ACM, 2012.
  * [18] MT Banday and NA Shah.  Image flip captcha.  ISC International Journal of Information Security (ISeCure), 1(2):105–123, 2009.
  * [19] Suliman A Alsuhibany.  A survey on adversarial perturbations and attacks on captchas.  Applied Sciences, 13(7):4602, 2023.
  * [20] Mohinder Kumar, MK Jindal, and Munish Kumar.  A systematic survey on captcha recognition: types, creation and breaking techniques.  Archives of Computational Methods in Engineering, 29(2):1107–1136, 2022.
  * [21] Menna Magdy, Medhat A Tawfeek, and Hamdy M Mousa.  A comprehensive study for different types of captcha methods and various attacks.  2021\.
  * [22] Mohinder Kumar, MK Jindal, and Munish Kumar.  A systematic survey on captcha recognition: Types, creation and breaking techniques.  Archives of Computational Methods in Engineering, pages 1–30, 2021\.
  * [23] Mohit Srivastava, Shreya Sakshi, Sanghamitra Dutta, and Chitrapriya Ningthoujam.  Survey on captcha recognition using deep learning.  In Soft Computing Techniques and Applications, pages 273–282. Springer, 2021.
  * [24] Gannavarapu Ananth Kumar and Garg Rishav.  Captcha techniques of secure web authentication: A survey.  In Communication Software and Networks, pages 97–117. Springer, 2021.
  * [25] Yang Zhang, Haichang Gao, Ge Pei, Sainan Luo, Guoqin Chang, and Nuo Cheng.  A survey of research on captcha designing and breaking techniques.  In 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), pages 75–84. IEEE, 2019.
  * [26] Xin Xu, Lei Liu, and Bo Li.  A survey of captcha technologies to distinguish between human and computer.  Neurocomputing, 408:292–307, 2020.
  * [27] Antreas Dionysiou and Elias Athanasopoulos.  Sok: Machine vs. machine–a systematic classification of automated machine learning-based captcha solvers.  Computers & Security, page 101947, 2020.
  * [28] N Divyashree and ST Kumar.  A survey on captcha categories.  Int. J. Eng. Comput. Sci, 5(5):16458–16462, 2016.
  * [29] Meriem Guerar, Alessio Merlo, and Mauro Migliardi.  Completely automated public physical test to tell computers and humans apart: A usability study on mobile devices.  Future Generation Computer Systems, 82:617–630, 2018.
  * [30] Mecheal Greene.  Large scale captcha survey.  PhD thesis, University of Delaware, 2018.
  * [31] Narges Roshanbin and James Miller.  A survey and analysis of current captcha approaches.  J. Web Eng., 12(1&2):1–40, 2013.
  * [32] Mohammad Moradi and MohammadReza Keyvanpour.  Captcha and its alternatives: A review.  Security and Communication Networks, 8(12):2135–2156, 2015.
  * [33] Elie Bursztein, Steven Bethard, Celine Fabry, John C Mitchell, and Dan Jurafsky.  How good are humans at solving captchas? a large scale evaluation.  In 2010 IEEE symposium on security and privacy, pages 399–413. IEEE, 2010.
  * [34] M Tariq Banday and Nisar A Shah.  A study of captchas for securing web services.  arXiv preprint arXiv:1112.5605, 2011.
  * [35] L. Von Ahn and L. Dabbish.  Labeling images with a computer game.  In Proceedings of the SIGCHI conference on Human factors in computing systems, pages 319–326. ACM, 2004.
  * [36] Clark Pope and Khushpreet Kaur.  Is it human or computer? defending e-commerce with captchas.  IT professional, 7(2):43–49, 2005.
  * [37] Nafisah Kheshaifaty and Adnan Gutub.  Preventing multiple accessing attacks via efficient integration of captcha crypto hash functions.  Int. J. Comput. Sci. Netw. Secur.(IJCSNS), 20(9):16–28, 2020.
  * [38] Zhen Li and Qi Liao.  Captcha: Machine or human solvers? a game-theoretical analysis.  In 2018 5th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2018 4th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom), pages 18–23. IEEE, 2018.
  * [39] Philippe Golle and Nicolas Ducheneaut.  Preventing bots from playing online games.  Computers in Entertainment (CIE), 3(3):3–3, 2005.
  * [40] Saikat Chakrabarti and Mukesh Singhal.  Password-based authentication: Preventing dictionary attacks.  Computer, 40(6):68–74, 2007.
  * [41] Masoud Alajmi, Ibrahim Elashry, Hala S El-Sayed, and Osama S Faragallah.  A password-based authentication system based on the captcha ai problem.  IEEE Access, 2020.
  * [42] Altaf Khan and Alexander G Chefranov.  A captcha-based graphical password with strong password space and usability study.  In 2020 International Conference on Electrical, Communication, and Computer Engineering (ICECCE), pages 1–6. IEEE, 2020.
  * [43] Manish Saxena, AK Usman, and S Hemant.  Handling captcha free web-form spam with spamizer 1.1.  In Proc. of the International Conference on Computing for Sustainable Global Development, 2017.
  * [44] S Vaithyasubramanian, D Lalitha, and CK Kirubhashankar.  Enhancing website security against bots, spam and web attacks using l captcha.  International Journal of Computers and Applications, pages 1–7, 2019.
  * [45] L. Von Ahn, M. Blum, and J. Langford.  Telling humans and computers apart automatically.  Communications of the ACM, 47(2):56–60, 2004.
  * [46] Donghoon Kim and Luke Sample.  Search prevention with captcha against web indexing: A proof of concept.  In 2019 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC), pages 219–224. IEEE, 2019.
  * [47] Pooja Kute, Tejaswini Lokhande, Manasi Kanadi, Sayali Kashid, and Ruchira Deshmukh.  Video captcha as a graphical password.  International Research Journal of Engineering and Technology (IRJET), 5(03), 2018.
  * [48] M.T. Banday and NA Shah.  A study of captchas for securing web services.
  * [49] Tejaswi Kumar, Navansh Goel, Siddhant Roy, and C Oswald.  Usability evaluation of novel text captcha schemes based on colors and shapes.  In International Conference on Innovative Computing and Communications, pages 355–363. Springer, 2022.
  * [50] J. Yan and A.S. El Ahmad.  Breaking visual captchas with naive pattern recognition algorithms.  In acsac, pages 279–291. IEEE Computer Society, 2007.
  * [51] G. Moy, N. Jones, C. Harkless, and R. Potter.  Distortion estimation techniques in solving visual captchas.  2004\.
  * [52] G. Mori and J. Malik.  Recognizing objects in adversarial clutter: Breaking a visual captcha.  2003\.
  * [53] Jeff Yan.  A simple generic attack on text captchas.  2016\.
  * [54] Guixin Ye, Zhanyong Tang, Dingyi Fang, Zhanxing Zhu, Yansong Feng, Pengfei Xu, Xiaojiang Chen, and Zheng Wang.  Yet another text captcha solver: A generative adversarial network based approach.  In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 332–348. ACM, 2018.
  * [55] Erkam Uzun, Simon Pak Ho Chung, Irfan Essa, and Wenke Lee.  rtcaptcha: A real-time captcha based liveness detection system.  In Proceedings 2018 Network and Distributed System Security Symposium. doi, volume 10, 2018.
  * [56] Dileep George, Wolfgang Lehrach, Ken Kansky, Miguel Lázaro-Gredilla, Christopher Laan, Bhaskara Marthi, Xinghua Lou, Zhaoshi Meng, Yi Liu, Huayan Wang, et al.  A generative vision model that trains with high data efficiency and breaks text-based captchas.  Science, 358(6368):eaag2612, 2017.
  * [57] Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, and Cho-Jui Hsieh.  Robust text captchas using adversarial examples.  arXiv preprint arXiv:2101.02483, 2021.
  * [58] Simon S Woo.  Design and evaluation of 3d captchas.  Computers & Security, 82:49–67, 2019.
  * [59] Xinyu Zhou, Cong Yao, He Wen, Yuzhi Wang, Shuchang Zhou, Weiran He, and Jiajun Liang.  East: an efficient and accurate scene text detector.  In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 5551–5560, 2017.
  * [60] Suzi Kim and Sunghee Choi.  Dotcha: A 3d text-based scatter-type captcha.  In International Conference on Web Engineering, pages 238–252. Springer, 2019.
  * [61] Z. Lin and L. Wan.  Style-preserving english handwriting synthesis.  Pattern recognition, 40(7):2097–2109, 2007.
  * [62] M. Mori, A. Suzuki, A. Shio, and S. Ohtsuka.  Generating new samples from handwritten numerals based on point correspondence.  In Proc. 7th Int. Workshop on Frontiers in Handwriting Recognition, pages 281–290, 2000.
  * [63] Mohammad Tanvir Parvez and Suliman A Alsuhibany.  Segmentation-validation based handwritten arabic captcha generation.  Computers & Security, page 101829, 2020.
  * [64] N. Arica and F.T. Yarman-Vural.  An overview of character recognition focused on off-line handwriting.  Systems, Man, and Cybernetics, Part C: Applications and Reviews, IEEE Transactions on, 31(2):216–233, 2001.
  * [65] A.O. Thomas, A. Rusu, and V. Govindaraju.  Synthetic handwritten captchas.  Pattern Recognition, 42(12):3365–3373, 2009.
  * [66] Haichang Gao, Wei Wang, Jiao Qi, Xuqin Wang, Xiyang Liu, and Jeff Yan.  The robustness of hollow captchas.  In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pages 1075–1086. ACM, 2013.
  * [67] Jun Chen, Xiangyang Luo, Yanqing Guo, Yi Zhang, and Daofu Gong.  A survey on breaking technique of text-based captcha.  Security and Communication Networks, 2017, 2017.
  * [68] M. Egele, L. Bilge, E. Kirda, and C. Kruegel.  Captcha smuggling: hijacking web browsing sessions to create captcha farms.  In Proceedings of the 2010 ACM Symposium on Applied Computing, pages 1865–1870. ACM, 2010.
  * [69] C Rama Krishna et al.  Spiral captcha with adversarial perturbation and its security analysis with convolutional neural network.  In Proceedings of Second Doctoral Symposium on Computational Intelligence, pages 67–83. Springer, 2022.
  * [70] M. Chew and J.D. Tygar.  Image recognition captchas.  Information Security, pages 268–279, 2004.
  * [71] O. Warner.  Kittenauth, 2006.
  * [72] J. Elson, J.R. Douceur, J. Howell, and J. Saul.  Asirra: a captcha that exploits interest-aligned manual image categorization.  CCS, 7:366–374.
  * [73] Prays Nikolay Aleksandrovich, Nikiforov Igor Alekseevich, Vladykin Maksim Vladimirovich, Nikiforov Aleksey Igorevich, Prays Varvara Borisovna, and Nikiforova Olga Igorevna.  Image-based captcha system, December 20 2012.  US Patent App. 13/528,373.
  * [74] Bin Zhu, Jia Liu, Qiujie Li, Shipeng Li, and Ning Xu.  Image-based captcha exploiting context in object recognition, July 9 2013\.  US Patent 8,483,518.
  * [75] Gaurav Goswami, Brian M Powell, Mayank Vatsa, Richa Singh, and Afzel Noore.  Facedcaptcha: Face detection based color image captcha.  Future Generation Computer Systems, 31:59–68, 2014.
  * [76] Anh Truong, Jeremy Goodsitt, Galen Rafferty, Vincent Pham, and Austin Walters.  Generating captcha images using variations of the same object, April 7 2020.  US Patent 10,614,207.
  * [77] Hyun Kwon, Hyunsoo Yoon, and Ki-Woong Park.  Captcha image generation using style transfer learning in deep neural network.  In International Workshop on Information Security Applications, pages 234–246. Springer, 2019.
  * [78] Hyun Kwon, Hyunsoo Yoon, and Ki-Woong Park.  Robust captcha image generation enhanced with adversarial example methods.  IEICE TRANSACTIONS on Information and Systems, 103(4):879–882, 2020\.
  * [79] M Poornananda Bhat and Rashmi Naveen Raj.  Two-way image based captcha.  In Advances in Communication, Signal Processing, VLSI, and Embedded Systems, pages 471–483. Springer, 2020.
  * [80] M. Xiaojuan, F. Christiane, and C. Perry.  Semantic labeling of nonspeech audio clips.  EURASIP Journal on Audio, Speech, and Music Processing, 2010, 2010\.
  * [81] E. Bursztein and S. Bethard.  Decaptcha: breaking 75% of ebay audio captchas.  In Proceedings of the 3rd USENIX conference on Offensive technologies, pages 8–8. USENIX Association, 2009.
  * [82] Jusop Choi, Taekkyung Oh, William Aiken, Simon S Woo, and Hyoungshick Kim.  Poster: I can’t hear this because i am human: A novel design of audio captcha system.  In Proceedings of the 2018 on Asia Conference on Computer and Communications Security, pages 833–835, 2018.
  * [83] PL Chithra and K Sathya.  Scanning-to-speech challenge-response authentication test for visually impaired.  Computers & Electrical Engineering, 92:107133, 2021.
  * [84] Chih-Hsiang Huang, Po-Hao Wu, Yi-Wen Liu, and Shan-Hung Wu.  Attacking and defending behind a psychoacoustics-based captcha.  In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 895–899. IEEE, 2021.
  * [85] M. Shirali-Shahreza and S. Shirali-Shahreza.  Captcha for blind people.  In Signal Processing and Information Technology, 2007 IEEE International Symposium on, pages 995–998. IEEE, 2007.
  * [86] G. Haichang, H. Liu, D. Yao, X. Liu, and U. Aickelin.  An audio captcha to distinguish humans from computers.  2010\.
  * [87] Valerie Fanelle, Sepideh Karimi, Aditi Shah, Bharath Subramanian, and Sauvik Das.  Blind and human: Exploring more usable audio $\\{$CAPTCHA$\\}$ designs.  In Sixteenth Symposium on Usable Privacy and Security ($\\{$SOUPS$\\}$ 2020), pages 111–125, 2020.
  * [88] Heemany Shekhar, Melody Moh, and Teng-Sheng Moh.  Exploring adversaries to defend audio captcha.  In 2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA), pages 1155–1161. IEEE, 2019.
  * [89] R. Soni and D. Tiwari.  Improved captcha method.  International Journal of Computer Applications IJCA, 1(25):107–109, 2010.
  * [90] Divya Shankar, Prashant Gupta, and Aditya Jaiswal.  Hybrid collage captcha.  International journal of scientific & engineering research, 4(1), 2013.
  * [91] Tam V Nguyen, Zhe Huang, Saiteja Bethini, Venkata Sai Prasanth Ippagunta, and Phu H Phung.  Secure captchas via object segment collages.  IEEE Access, 8:84230–84238, 2020.
  * [92] A. Desai and P. Patadia.  Drag and drop: A better approach to captcha.  In India Conference (INDICON), 2009 Annual IEEE, pages 1–4. IEEE.
  * [93] T. Giang and F. Liu.  Mouse intervention captcha.
  * [94] H.S. Baird, M.A. Moll, and S.Y. Wang.  A highly legible captcha that resists segmentation attacks.  Human Interactive Proofs, pages 27–41, 2005.
  * [95] Farah Ruzanna Ridzuan, Hairulnizam Mahdin, Shahreen Kasim, Mohd Sanusi Azmi, et al.  An image-based captcha system using click.  Acta Electronica Malaysia (AEM), 3(1):23–25, 2019.
  * [96] E. Athanasopoulos and S. Antonatos.  Enhanced captchas: Using animation to tell humans and computers apart.  In Communications and Multimedia Security, pages 97–108. Springer, 2006.
  * [97] Zi Chu, Steven Gianvecchio, and Haining Wang.  Bot or human? a behavior-based online bot detection system.  In From Database to Cyber Security, pages 432–449. Springer, 2018\.
  * [98] Abdul Rouf Shah, M Tariq Banday, and Shafiya Afzal Sheikh.  Design of a drag and touch multilingual universal captcha challenge.  In Advances in Computational Intelligence and Communication Technology, pages 381–393. Springer, 2021.
  * [99] Sanjay Sharma and Devendra Kumar.  Highly secured intellectual graphical captcha.  International Journal of Modern Engineering & Management Research, 6(1), 2018.
  * [100] Bryan Cotta and Warren Benedetto.  Game controller-based captcha, March 19 2019.  US Patent 10,235,514.
  * [101] Philip Kirkbride, M Ali Akber Dewan, and Fuhua Lin.  Game-like captchas for intrusion detection.
  * [102] Monther Aldwairi, Suaad Mohammed, and Megana Lakshmi Padmanabhan.  Efficient and secure flash-based gaming captcha.  Journal of Parallel and Distributed Computing, 2020.
  * [103] Ramanpreet Kaur et al.  A non ocr approach for math captcha design based on boolean algebra using digital gates to enhance web security.  In 2016 international conference on wireless communications, signal processing and networking (WiSPNET), pages 862–866. IEEE, 2016.
  * [104] M. Shirali-Shahreza and S. Shirali-Shahreza.  Question-based captcha.  In iccima, pages 54–58. IEEE Computer Society, 2007.
  * [105] Vincent Levesque.  Haptic captcha, June 5 2018.  US Patent 9,990,040.
  * [106] M. Blum, LA Von Ahn, J. Langford, and N. Hopper.  The captcha project, completely automatic public turing test to tell computers and humans apart.  School of Computer Science, Carnegie-Mellon University, http://www. captcha. net.
  * [107] A.L. Coates, H.S. Baird, and RJ Faternan.  Pessimal print: a reverse turing test.  In Document Analysis and Recognition, 2001. Proceedings. Sixth International Conference on, pages 1154–1158. IEEE, 2001.
  * [108] Mohammad Hassan Shirali-Shahreza and Mohammad Shirali-Shahreza.  Persian/arabic baffletext captcha.  J. UCS, 12(12):1783–1796, 2006.
  * [109] T.Y. Chan.  Using a text-to-speech synthesizer to generate a reverse turing test.  2003\.
  * [110] K.A. Kluever and R. Zanibbi.  Balancing usability and security in a video captcha.  In Proceedings of the 5th Symposium on Usable Privacy and Security, page 14. ACM, 2009.
  * [111] Hui Hu, Hao Fang, and LIU Qingyan.  Captcha method and system, October 29 2013.  US Patent 8,572,756.
  * [112] S.A. Ross, J.A. Halderman, and A. Finkelstein.  Sketcha: a captcha based on line drawings of 3d models.  In Proceedings of the 19th international conference on World wide web, pages 821–830. ACM, 2010.
  * [113] B. Gooch, E. Reinhard, and A. Gooch.  Human facial illustrations: Creation and psychophysical evaluation.  ACM Transactions on Graphics (TOG), 23(1):27–44, 2004.
  * [114] R. Gossweiler, M. Kamvar, and S. Baluja.  What’s up captcha?: a captcha based on image orientation.  In Proceedings of the 18th international conference on World wide web, pages 841–850. ACM, 2009.
  * [115] C.J. Ho, C.C. Wu, K.T. Chen, and C.L. Lei.  Deviltyper: a game for captcha usability evaluation.  Computers in Entertainment (CIE), 9(1):3, 2011.
  * [116] Manar Mohamed, Song Gao, Nitesh Saxena, and Chengcui Zhang.  Dynamic cognitive game captcha usability and detection of streaming-based farming.  In the Workshop on Usable Security (USEC), co-located with NDSS, 2014.
  * [117] Arun Pratap Singh, Sanjay Sharma, and Vaishali Singh.  Hybrid text illusion captcha dealing with partial vision certainty.  In Social Networking and Computational Intelligence, pages 687–696. Springer, 2020.
  * [118] Xiang Li, Yuzheng Chen, Rakesh Patibanda, and Florian’Floyd’ Mueller.  vrcaptcha: Exploring captcha designs in virtual reality.  In Extended Abstracts of the 2021 CHI Conference on Human Factors in Computing Systems, pages 1–4, 2021.
  * [119] Chenghui Shi, Xiaogang Xu, Shouling Ji, Kai Bu, Jianhai Chen, Raheem Beyah, and Ting Wang.  Adversarial captchas.  IEEE Transactions on Cybernetics, 2021.
  * [120] S. Saklikar and S. Saha.  Public key-embedded graphic captchas.  In Consumer Communications and Networking Conference, 2008. CCNC 2008\. 5th IEEE, pages 262–266. IEEE.
  * [121] M Hassan Shirali-Shahreza and Mohammad Shirali-Shahreza.  Localized captcha for illiterate people.  In 2007 International Conference on Intelligent and Advanced Systems, pages 675–679. IEEE, 2007.
  * [122] Jonathan Holman, Jonathan Lazar, Jinjuan Heidi Feng, and John D’Arcy.  Developing usable captchas for blind users.  In Proceedings of the 9th international ACM SIGACCESS conference on Computers and accessibility, pages 245–246. ACM, 2007.
  * [123] Amalia I Rusu, Rebecca Docimo, and Adrian Rusu.  Leveraging cognitive factors in securing www with captcha.  In WebApps, 2010.
  * [124] Narges Roshanbin and James Miller.  Enhancing captcha security using interactivity, dynamism, and mouse movement patterns.  International Journal of Systems and Service-Oriented Engineering (IJSSOE), 6(1):17–36, 2016.
  * [125] Avinash Kalgi, Matthew Ward-Steinman, and Qian Wang.  Mobile human challenge-response test, April 21 2015.  US Patent 9,015,804.
  * [126] Mohammad Shirali-Shahreza.  Highlighting captcha.  In 2008 Conference on Human System Interactions, pages 247–250. IEEE, 2008.
  * [127] Sajad Shirali-Shahreza and Mohammad Shirali-Shahreza.  Multilingual highlighting captcha.  In 2011 Eighth International Conference on Information Technology: New Generations, pages 447–452. IEEE, 2011.
  * [128] Rosa Lin, Shih-Yu Huang, Graeme B Bell, and Yeuan-Kuen Lee.  A new captcha interface design for mobile devices.  In Proceedings of the Twelfth Australasian User Interface Conference-Volume 117, pages 3–8. Australian Computer Society, Inc., 2011.
  * [129] Sajad Shirali-Shahreza, Gerald Penn, Ravin Balakrishnan, and Yashar Ganjali.  Seesay and hearsay captcha for mobile interaction.  In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pages 2147–2156. ACM, 2013.
  * [130] Ahmed Iqbal Pritom, Mehrab Zaman Chowdhury, Joy Protim, Shanto Roy, Md Rashedur Rahman, and Sadia Mehnaz Promi.  Combining movement model with finger-stroke level model towards designing a security enhancing mobile friendly captcha.  In Proceedings of the 2020 9th International Conference on Software and Computer Applications, pages 351–356, 2020.
  * [131] Alejandro Acien, Aythami Morales, Julian Fierrez, Ruben Vera-Rodriguez, and Oscar Delgado-Mohatar.  Becaptcha: Bot detection in smartphone interaction using touchscreen biometrics and mobile sensors.  arXiv preprint arXiv:2005.13655, 2020.
  * [132] Kentaro Aburada, Shotaro Usuzaki, Hisaaki Yamaba, Tetsuro Katayama, Masayuki Mukunoki, Mirang Park, and Naonobu Okazaki.  Implementation of captcha suitable for mobile devices.  IEICE Communications Express, 2019.
  * [133] Shakila Lehan Perera.  oCAPTCHA-Enhanced CAPTCHA Method using Image Orientation.  PhD thesis, 2019.
  * [134] Alejandro Acien, Aythami Morales, Julian Fierrez, Ruben Vera-Rodriguez, and Ivan Bartolome.  Be-captcha: Detecting human behavior in smartphone interaction using multiple inbuilt sensors.  arXiv preprint arXiv:2002.00918, 2020.
  * [135] Alejandro Acien, Aythami Morales, Julian Fierrez, Ruben Vera-Rodriguez, and Oscar Delgado-Mohatar.  Becaptcha: Behavioral bot detection using touchscreen and mobile sensors benchmarked on humidb.  Engineering Applications of Artificial Intelligence, 98:104058, 2021\.
  * [136] Sajad Shirali-Shahreza and Mohammad Shirali-Shahreza.  A new human interactive proofs system for deaf persons.  In Fifth International Conference on Information Technology: New Generations (itng 2008), pages 807–810. IEEE, 2008.
  * [137] Sajad Shirali-Shahreza and Mohammad Shirali-Shahreza.  Captcha for children.  In 2008 IEEE International Conference on System of Systems Engineering, pages 1–6. IEEE, 2008.
  * [138] Sheena Mohammed, D Madhuri Dachepally, and A Angel Mary.  3c-click, count, captcha graphical password technique.  Research Journal of Engineering and Technology, 9(2):189–194, 2018\.
  * [139] Altaf Khan and Alexander G Chefranov.  A new secure and usable captcha-based graphical password scheme.  In International Symposium on Computer and Information Sciences, pages 150–157. Springer, 2018.
  * [140] Shikhar Singh Patel, Akarsh Jaiswal, Yash Arora, and Bharti Sharma.  Survey on graphical password authentication system.  Data Intelligence and Cognitive Informatics, pages 699–708, 2021\.