CAPTCHA farm detection and user authentication via mouse-trajectory similarity measurement
摘要
A well-known challenge Completely Automated Public Turing Test To Tell Computers and Humans Apart (CAPTCHA) faces is the CAPTCHA farm, where workers solve CAPTCHAs manually. In this work, we propose to tackle this challenge from a novel perspective. We convert CAPTCHA farm detection to identity inconsistency detection, which essentially becomes an authentication process. Specifically, we develop a novel embedding model, which measures the similarity between mouse trajectories collected during the session and when registering/solving CAPTCHA. Furthermore, we propose using diverse mouse movement data to implement enrollment sample selection and dynamic authentication, enhancing both security and flexibility during authentication. Experiment results validate the superiority of our method over the state-of-the-art time series classification methods and mouse-based authentication systems, achieving 96.9% and 99.1% of AUC in identity and authentication inconsistency detection, respectively. Moreover, unlike most existing works that employ a separate mouse movement classifier for each individual user, which brings in considerable costs when serving a large number of users, our model performs detection tasks using only one classifier for all users, significantly reducing the cost. These results indicate that our model, powered by a single classifier, performs exceptionally well and can detect inconsistencies in the identity of new users, making it a promising approach for detecting CAPTCHA farm attacks and authentication.