A CAPTCHA – BASED INTRUSION DETECTION MODEL

International Journal of Software Engineering & Applications (IJSEA), Vol.9, No.1, January 2018
DOI: 10.5121/ijsea.2018.9103 29
A CAPTCHA – BASED INTRUSION DETECTION
MODEL
Boukari Souley and Hauwa Abubakar
Department of Mathematical Sciences, Abubakar Tafawa Balewa University Bauchi, Nigeria
ABSTRACT
Intrusion Detection systems (IDS) are an essential element for Network Security Infrastructure and play an
important role in detecting large number of attacks. Intrusion Prevention System (IPS) is a tool that is used
to prevent spywares from getting intrusion into a system and one of the techniques used in IPS is
Completely Automated Public Turning test to tell Computers and Human Apart (CAPTCHA). In order to
detect illegal access of the web from the intruder, IDS, IPS can be implemented with the use of honeypot to
track the IP address, location and country or region of the attacker in order to block the attacker from
accessing the system. Different techniques have been adopted by different researchers using IDS, IPS and
honeypot to protect their system against illegal attacks. As discovered in the existing systems CAPTCHA
was not employed in IDS to detect spywares capable of breaking and having access to the system. To
increase and maintain the security in a Network the combination of IDS with CAPTCHA, IPS and a dummy
Honeypot can be employed. This work proposes a CAPTCHA –based Intrusion Detection Model with a
redirector in order to identify the intelligent spywares that are capable of breaking CAPTCHA in IPS. Also
using a dummy honeypot with circular hyperlinks so as to lewd the software that infiltrated the system in
order to capture its IP address and other important information about the spywares such as the country or
region it’s coming from, web browser used and date and time of intrusion so as to block and prevent illegal
access by intruders. This paper focuses on capturing the intelligent spywares capable to break through the
new CAPTCHA trap IDS so as to gather information about it and necessary action can be taken against it.
A security model was designed having having CAPTCHA IDS with a redirector, IPS and a honeypot cable
of detecting intrusion by intelligent spyware With this model the network will be more secured against
intrusion by spywares.
KEYWORDS
Intrusion detection system (IDS), CAPTCHA, Intrusion Prevention system (IPS), Honeypot.
1. INTRODUCTION
With the continuous growth of cyber-attacks, information safety has become an important issue
all over the world. Different techniques have been used to support the security of organizations
and institutions against threats or attacks. On the other side, attackers are discovering new
techniques and ways to break these security policies. Intrusion is a process where software
accesses web content that is protected with username and password. At a wider sense, intrusion
may include both human and machine access to account having web content that is secured with
username and password. Sometimes humans and software combined forces to achieve intrusion.
To overcome this problem Network Security involves many techniques and one of the
most important is Intrusion Detection System (IDS).
An IDS is viewed as the process of intelligently monitoring the events occurring in a computer
system or network, analyzing them for signs of violations of the security policy. IDSs become a
major component for network security infrastructure [1, 2]. To identify intrusion by spywares the
use of CAPTCHA, a tool in IPS was employed. CAPTCHA is a type of challenge-response test
used in computing to determine whether or not the user is human. CAPTCHA defined by [3] as a

30
cryptographic protocol whose underlying hardness assumption is based on an Artificial
Intelligence problem. They are widely used by websites to distinguish abusive programs from real
human users. They are intended to be easy for humans to perform, and difficult for machines to
perform [4].
Apart from text-based CAPTCHA, other forms of are equally effective in IPS. List of these forms
include: Audio-based, video- based, 3 dimensional (3D) and puzzle-based etc.[5]. IPS is a
network security/threat prevention technology that audits network traffic flows to detect and
prevent vulnerability exploits. The actions occurring in a system or network are measured by IDS
[6].
[7] stated that, many attackers exploit the network to gain the information or damage the system.
There are many existing standalone systems to detect and prevent the network from attacks like
Firewall, (IDS) and IPS. To increase the security, the features of IDS, IPS and Honeypot can be
combined. In a case where an intrusion occurs in a network, the need for honeypot could be used
to divert the attacks or attacker to another area that looks exactly as the real system whilst it is not
a real .This is just to make the real server more secured by trapping the IP address of the attacker.
[8] Defines a honeypot in computer technology as a trap set to recognize, redirect or in some way
balance endeavours at unapproved utilization of data frameworks. It creates a log which refers to
an intrusive activity by detecting intruders. In [9] their work classified honeypot based on
Purpose (production and research honeypot) and also based on level of interaction (low, medium,
and high).
This work proposes to see the possibility of designing a CATPCHA- based Intrusion Detection
Model to curb the security failure identified when CATPCHA was used in IPS. The work intends
to incorporate CAPTCHA on IDS so that as soon as these spywares break into the system, the
new IDS with the CAPTCHA can detect it and redirect it to honeypot to capture its IP address
and block it. This work has a major significance in online transactions where network
infrastructure requires regular security treat prevention, monitoring, detection and recovery.
2. REVIEW OF RELATED WORK
Most important research works on network security using Intrusion detection, Intrusion
Prevention and CAPTCHA are being discussed in this section.
[10] worked out a systematic study of existing visual CAPTCHAs based on distorted characters
that are augmented with anti segmentation techniques. Applying a systematic evaluation
methodology to 15 current CAPTCHA schemes from popular web sites , they found that 13 are
vulnerable to automated attacks.They tested the efficiency of their tool Decaptcha against real
CAPTCHAs .To achieve such a high success rate they developed the first successful attacks on
CAPTCHAS that use collapsed characters (eBay and Baidu). Only Google and ReCAPTCHA
resisted to the attack attempts, and they reached some informative understanding of why they
couldn’t break them. Because of DeCAPTCHA genericity they were able to break 7 of these 15
schemes without writing a new algorithm. The result of the analysis shows that the state-of-the-
art anti-segmentation techniques, state-ofthe-art anti-recognition techniques, and CAPTCHAS
used by the most popular websites were evaluated. The limitations with this work is that because
some features that are ineffective against automated attacks but counterproductive for humans are
used. It makes it difficult to be able to break all the schemes. Moreso, some anti segmentation
techniques are not used.
[11] proposed a secured system for banking application using honeypots and IDS. The honeypot
used in this system is the low interaction and high interaction honeypot. The sytem is

31
implemented in such a way that the users or attacker will access the network either via Internet or
direct. Within a LAN,IDS with honeypot and a centralized server with database layers are being
connected. Once the user gets access to the network, all its interactions low or high will be
monitored by the IDS and make a log file for that user. IDS will decide to make a user as
blacklisted or not, also server’s data will be checked for integrity and identify the source of the
user. Database layers will also be checked for integrity by the system. The proposed banking
system divides the internal datbase into three layers as: a) public database (b) main Database and
(c) dummy database. Their work revealed that Honeypots have the ability to catch new hacker
toolkits and scripts, and are able to reduce the effectiveness of these tools in the wild by
allowing security practitioners the capability to analyze these new tools. The limitations to this
system is firstly , in their implementation, they did not included the latest rules for virus and
worm detection. More so, the protocols have not been emulated.
[12] proposed an intrusion detection system that depends on honey pot. They built the models of
normal behaviour for multitier web applications considering both front-end requests and backend
database queries. It provides a container based IDS with multiple input streams to produce the
alerts and can identify a large number of attacks with the minimal false positive rate. This
achieves better characterization of the system for anomaly detection and it is more effective for
both the static and dynamic web service. The result of the work shows their approach is feasible
and effective in reducing both false positives and false negatives. The only problem associated
with the work is that IDS works on assumption for an abnormal behaviour.The IDS did not
indicate the mechanism it will employ for detecting whether it is malicious activities or not .
[13] proposed Genetic Algorithm Intrusion Detection System (GAIDS) which consist of two
phases ; Preprocessing and learning phase. The model is an algorithm that was used for detecting
four major attackes i. e Deniel of Service DOS,User to root (U2R), Remote to local(R2L) and
probe data set. The result of the algorithm provides a high rate of the rule set for detecting
different types of attacks. Their system is more flexible for usage in different application
areas with proper attack taxonomy. The use of Genetic algorithm with IDS gives good result,
but one limitation is that it was not able to handle the sharp boundary problems. For increasing
accuracy for intrusion detection combination of fuzzy datamining with GA will be more
powerful.
[14] proposed a design and developed an Intrusion Detection System. They also designed port
scanner to determine potential threats and mitigation techniques to withstand these attacks.
Implement the system on a host and Run and test the designed IDS. In the project they set up to
develop a Honey Pot IDS System. It makes it easy to listen on a range of ports and emulate a
network protocol to track and identify any individuals trying to connect to your system.
This IDS will use the following design approaches: Event correlation, Log analysis, Alerting, and
policy enforcement. The result of their work attempted to identify unauthorized use, misuse, and
abuse of computer systems.The limitation to their work is that it cannot presently contact (raise
an alarm) an individual away from his/her PC and also there is a need for user sanitization.
[15] pproposed a new approach which uses the virtualization technique to overcome the existing
security problem, it overcomes the limitation of honeypots from single network detection to
network across the organization and improves the existing security design to waste the attackers’
time as much as possible to get the best useful information. The objective of the work is to
analyse the performance of different honeypots based intrusion detection systems and get the
best possible data about the attack and Relevant information. When honeypots was
implemented, log file was generated. By the help of the data gathered, it was found that most of
the attacks were on protocols which are based on TCP/IP. HTTP port was one of the most
vulnerable ports. Another vulnerable port found was FTP port. It was also found that the number

32
of vulnerabilities increased when this port was opened. The limitation identified is that real time
detection and prevention system to minimize the attack and sources was not achieved.
[16] proposed a system which combined specific features and services of IDS, IPS and Honeypot.
Because various exploits were being used to compromise the network, these exploits are capable
of breaking into any secured networks. In order to increase efficiency of network security, they
introduce Honeypot. Honeypot detect attacks with the help of IDS; trap and deflect those
packets sent by attackers. The result of their work indicates that the system handles multiple
clients using the concept of honeypot. Intrusion detection system (IDS) monitor whole
network and looks for intrusion. When any intrusion occurs honeypot will be activated. This
activated honeypot will divert the traffic to dummy/virtual servers & back track the source (IP
address) or origin of that attack. The drawback of the system is that since it supports multiple
clients including an attacker the system can easily be compromised.
[7] proposed combination of the features, functions and methodology of IDS, IPS and
Honey pot. This is to make IDS more effective, accurate and responsive. Honeypot, IDS and
IPS are eventually deployed on the gateway for analyzing incoming network traffic. The main
server will be connected to Internet Service Provider (ISP) through external router. All incoming
packets from external network will be first directed to the mirror server i.e. Honeypot to capture
the logs. The result of their work shows that the proposed system is more stable and precise on
operating system platform. The system has introduced a sophisticated and interactive user
friendly interface to configure and monitor the software and also to analyse and log the behaviour
of the intruder and intruding events. The only drawback of proposed system in it detection
module it did not include how the IDS should be capable of detecting intrusion by spywares
since it is evident that CAPTCHA on the IPS can be broken by spywares.
[9] proposed the implementation of middle interaction production honeypot. Their main goal is
to secure the server side using honeypot from the attackers. The result of the work indicates that
Clients can communicate to the servers through the honeypot only. The clients has the fake
IP address of the honeypot and not the server's. If the client is a genuine client then its
request goes to honeypot. Honeypot changes its IP address and forwards the request to the
original server. After that server gives response to honeypot. Again honeypot changes its IP
address and sends response to client. If the client is fake client, then attacker will be tracked ,
located, identified and saves information about attackers at the honeypot. Though it is an
attacker it gives response to make them fool. In all these scenarios, security is maintained. The
limitation here is that if no any attacker comes in, the honeypot system becomes useless. The
need for other established security tools such as IDS and IPS to be integrated with the honeypot
become iperative.
Considering the above related work, challenges were identified and presented. The security
solutions proposed by most of the researchers were based on intrusion detection using a single
detection tool or combination of intrusion detection tool and a preventive tool, with this security
can be maintained and achieved but not to the fullest. However, this research intends to design an
IDS system which will be online with intelligent redirector and CAPTCHA to detect and identify
spywares that may possibly break the system.
2.3 NETWORK INTRUSION CHALLENGES
IPS is a tool used to prevent spywares from intruding into a system. And one of the techniques
used in IPS is CAPTCHA. CAPTCHA are used in IPS, to prevent unauthorized login into
accounts, it’s also used to distinguish between human being and spywares, with these meaningful
results are recorded. Human being can read and get authorization successfully but spyware cannot

33
read CAPTCHA, For example cloud flare cyber security solutions employ the use of CAPTCHA
on subscribed sites to ward off unauthorized login by software. Google also used the same on its
search engine if it suspects robot (software) conducting search, but in [17] their experimental
results revealed vulnerabilities in Continuous CAPTCHAs because the solver cracks the visual
and audio Google’s CAPTCHA system with 31.7% and 58.75% accuracy respectively. Yahoo
mail uses CAPTCHA as well. Later on with new development in spyware new sophisticated
spywares are now designed in such a way that they can break CAPTCHA under IPS. , it was
reported in [18] that spammers had achieved a success rate of 30% to 35% using bot to respond to
CAPTCHA for Microsoft live mail service. A simple attack has achieved a segmentation success
rate of higher than 90% against the CAPTCHA developed and used by Microsoft websites
[19].
In recent years, many types of CAPTCHAs have been developed. Some are based on Optical
Character Recognition (OCR) such as text CAPTCHA, whereas others are based on Non-Optical
Character Recognition (Non-OCR) which uses multimedia, such as voice and video. Some of
these types of CAPTCHAs have been broken by new bot programs. For example, a text
CAPTCHA can be broken by using the mechanism of segmentation letters. However, CAPTCHA
can equally be used in intrusion detection system IDS and this has not been fully explored.
Considering the fact that some software are sophisticated that they can use image processing and
fuzzy logic to read text CAPTCHA and by-passes IPS. For instance, Robosoft can read text
CAPTCHA using image processing technique and pattern recognition on English alphabets and
numbers. Ability of the existing system by [7] to detect and respond to intrusions is too slow and
claims of CAPTCHA breaks in previous work of [17] revealed that CAPTCHAs can be broken
when used in IPS, thereby making the hybrid system proposed by [7] prone to attacks by
intelligent or unintelligent intruders (spywares), This problem and the ability of CAPTCHA to be
used in IDS is what this research intends to address.
2.3.1 Cyber Security
Security is described through the accomplishment of basic security properties, namely Data
confidentiality, Authentication, Access control, Data Integrity and Non-repudiation. [20].
The International Organization for Standardization defines cyber security or cyberspace security
as the preservation of confidentiality, integrity and availability of information in the Cyberspace.
In turn, “the Cyberspace” is defined as “the complex environment resulting from the interaction
of people, software and services on the Internet by means of technology devices and networks
connected to it, which does not exist in any physical form.”
2.3.2 Threats
Threats can be categorized into external or internal threats. Threats originating outside a company
or an institution are external and in contrast an internal threat is one originating inside the
organization. There are two types of internal threats: Intentional attacks and Unintentional
attacks. Some of the common cyber threats according to are:
(a)Denial-of-Service (DoS) attack (b) Eavesdropping attack (c) Spoofing attack (d) Intrusion
attacks/ User to root attack (e) Login abuse attack (f) Application-level attack [20].
2.3.2.1 Types of threats
Basically there are three most common types of attacks identified in [12] (a) Privilege escalation
attack (b) Hijack future session attack and (c) Injection attack. Privilege means what is allowed to

34
do. Common privileges include viewing, modifying and editing the files of the system. In the
other hand Hijack future session attack uses the http request to take over the web server. While
Injection Attack takes the advantage of the improper coding to execute attacker commands.
Using sql the web applications interact with back end data base to retrieve the user’s data.
2.3.2.2 Spy bots. Spy bots are software that break the security of computer system or network,
infiltrates it and secretly manipulates the system for malicious purposes. Most intrusion, today are
performed by spy bot.
2.3.3 Intrusion: An intrusion in the internet can compromise the data security through several
internet means.
2.3.3.1 Intrusion by spy bots
Because the first malware to gain public attention was the computer virus, the term “virus” has
come to be used interchangeably with “malware” although a virus is a specific category of
malware; other categories include worms, Trojan horses (also referred to as Trojans), bots (also
bonnets and zombies), logic bombs and time bombs, spyware, and root kits, with further
subdivisions possible within all of these categories. Spyware is software that aims to gather
information about a person or organization without their knowledge that may send such
information to another entity without the consumer's consent, or that asserts control over a device
without the consumer's knowledge [21].
2.3.3.2 Intrusion by human (Hacker or intruder)
The most common usage of "hacker" is to breakdown computer security without authorization or
indeed, usually through a computer network or the internet for terrorism, vandalism, credit card
fraud, identity theft, intellectual property theft, and many other forms of crime. This can mean
taking control of a remote computer through a network, or software cracking [22]. An intruder is
one who breaks into or otherwise violates the system integrity of remote machines with malicious
intent. Having gained unauthorized access, crackers destroy vital data; deny legitimate users
service, or cause problems for their targets. Crackers can easily be identified because their actions
are malicious. Several common tools used by computer criminals to penetrate network have been
highlighted such as Trojan horse, Virus, Worm, Vulnerability scanner, Sniffer, Exploit, Social
engineering, Root kit
2.4 NETWORK SECURITY TECHNIQUES
2.4.1. Intrusion detection system
[20] explained intrusion detection system in the following term, Suppose a strange man is
standing in front of your house. He looks around, studying the surroundings, and then walks to
the front door and tries to open it. The door is locked. Efforts in vain, he moves to a nearby
window and gently tries to open it. It, too, is locked. It seems your house is secure. So why to
install an alarm? This is a common question for intrusion detection advocates. Why bother
detecting intrusions if you’ve installed firewalls, spam filters, and activated passwords for
authenticity? The answer is simple: because intrusions still do occur!! Just as people sometimes
forget to lock a window, for example, they sometimes forget to correctly update a firewall’s rule
set. Computer systems are still not 100 percent safe even with the most advanced protection. In
fact, most computer security experts agree that, given user-desired features such as network
connectivity, we’ll never achieve the goal of a completely secure system. As a result, we must
develop and deploy intrusion detection techniques and tools to discover and react against
computer attacks.

35
IDSs can be categorized into three types: namely; a network-based intrusion detection system
(NIDS), a host-based intrusion detection system (HIDS), and a hybrid-based intrusion detection
system (hybrid IDS). An HIDS detects malicious activities on a single computer while an NIDS
identifies intrusions by monitoring multiple hosts and examining network traffic. In an NIDS,
sensors are located at choke points of the network to perform monitoring, often in the
Demilitarized Zone (DMZ) or on network borders and capture all the network traffic. Hybrid-
based IDSs detect intrusions by analysing application logs, system calls, file-system
modifications (password files, binaries, access control lists, and capability databases, etc.) and
other host states and activities. [23].
2.4.2 Intrusion prevention system
An Intrusion Prevention System (IPS) is a network security/threat prevention technology that
audits network traffic flows to detect and prevent vulnerability exploits. There are two types of
prevention system they are Network (NIPS) and Host (HIPS). These systems watch the network
traffic and automatically take actions to protect networks and systems. IPS issue is false positives
and negatives. False positive is defined to be an event, which produces an alarm in IDS where
there is no attack. False negative is defined to be an event, which does not, produces an alarm
when there is an attacks takes place. Inline operation can create bottlenecks such as single point
of failure, signature updates and encrypted traffic. The actions occurring in a system or network is
measured by IDS. [6].
IDP systems have become a necessary addition to the security infrastructure of most
organizations, precisely because they can stop attackers while they are gathering information
about your network [24].
2.4.3 Captcha
[25] Has identified two implementation issues with poorly designed CAPTCHA systems: Some
CAPTCHA protection systems can be bypassed without using OCR simply by reusing the session
ID of a known CAPTCHA image. While, CAPTCHAs residing on shared servers also present a
problem; a security issue on another virtual host may leave the CAPTCHA issuer's site
vulnerable.
2.4.4 Honeypot
A honeypot is a security resource whose value lies in being probed, attacked, or compromised.
This means that whatever is designated as a honeypot, it is the expectation and goal to have the
system probed, attacked, and potentially exploited. [26].
2.5 METODOLOGY
The system is an attempt to use CAPTCHA, which is a tool in IPS, in IDS as a trap to detect
intrusion by software that use machine learning-based attack and unwitting human labour attack
to read CAPTCHA. CAPTCHA is normally used in IPS as in [7], and therefore it used in IDS
trap to fake software intruders to assume it is IPS trying to block them from access to the system.
Finally, the proposed system work also includes honeypot of dummy web pages with circular
hyperlinks. Once software intruder is detected, it is automatically redirected to the honeypot
where it commences infinite surfing of dummy pages until its IP address is captured by the
system, then it is sent to block list and instantly block from accessing the system. Figure 1 below
best explains the architecture of the proposed model.

36
Figure1. Architecture of the Proposed model.
2.5.1 Software Architecture of the Proposed System
Studied carried out in the work of [7] indicates that CAPTCHA under IPS can be bypassed by the
intelligent spywares. The need to have a CAPTCHA IDS with redirector capable of detecting
intelligent spywares and block them. The software architecture of the proposed system consists of
three layers. User’s layer, logical layer and web service layer respectively, Figure 2 below
illustrates the software architecture of the hybrid system.
Figure 2. Software Architecture of the Proposed Model
Honeypot
Attacker

37
The Users layer is where humans and machines are likely to attempt login in order to access the
system. It is layer which consist of CAPTCHA-trap IDS, fake IPS and honeypot. The logical
layer is the most important layer and is where the major work of this research is done. It is in this
layer hybridization of three cyber security measures are incorporated to produce the proposed
system. In the layer, an IDS is designed using CAPTCHA as trap to intelligent software intruders
that can read CAPTCHA using either machine learning-based attack or unwitting human labour
attack. IPS system is also employed to prevent intrusion by software intruders that attempts to
read the displayed CAPTCHA, but failed. Finally, honeypot system is designed to capture IP
address of the software intruder that intrudes into the system. Lastly the web service layer which
has the MySQL database is where IP address and other details of the captured intruder will be
recorded. Therefore, the proposed model will interact with the various layers as such that
activities in the users layer is mostly done by the attackers, which is being filtered and redirected
by the redirector model (proposed model) and the redirector defines all the activities on the
logical layers, and these activities are passed down to MySQL database which is found on the
web service layer.
2.5.2 Working principle of the proposed Model
CAPTCHA is a tool commonly used in IPS, to prevent machine intruders (bots) from intruding
into a system, however, in this research work, CAPTCHA will also be used as IDS. The
technique to be used is cognizance of the fact that there are software intruders that can read
CAPTCHA and attempt to infiltrate it and intrude into system. CAPTCHAs with weak design
pattern and fixed length with varying colours on text will be employed for use in web-based
system acting like IPS while in real sense it is an IDS that will attempt to lewd software intruders
using machine learning-based attack to successfully read the text-based CAPTCHA and infiltrates
the system. Likewise software intruders using unwitting human labour can easily read the
CAPTCHAs and infiltrates the system as well. The CAPTCHA character is not only to be read
and re-type back to the system, it is to be read, understand and abide by. For instance one of such
CAPTCHA may be displayed as “DO NOT TYPE ANYTHING IN THE TEXTBOX
BELOW” a wise human will understand that the textbox should be left empty, while a software
intruder that successfully read the words will just rush and type “DO NOT TYPE ANYTHING
IN THE TEXTBOX BELOW” in the textbox or something similar to that sentence. As soon as
anything is typed in the provided textbox, the system quickly detects that an intrusion has taken
place and the intruder is quickly redirected to the honeypot model for post intrusion activities.
Figure 3 illustrates the IDS using CAPTCHA as trap.
Figure 3. IDS using CAPTCHA as trap.
The presence of CAPTCHA in this system naturally deters software intruders, since CAPTCHAs
are generally seen as IPS and therefore, its presence in the system will naturally interpreted as an
IPS system. However, this system faking software intruders to believe it is IPS may not be very
efficient as some software intruders may attempt login ignoring the CAPTCHA and the textbox
provided for it, this will re-direct the intruder to the login authentication and somehow this may
have been an intrusion bypassing the fake IPS and the CAPTCHA-trap IDS. This is an instance
where the system may theoretically be bypassed and subsequent researches on similar are
recommended studying this gap.

38
2.6 EXPECTED RESULTS
The expected result from the proposed model will include:
1. Improved IDS with redirector and text –based CAPTCHA: the result expected is an
improvement on the hybrid system proposed by Yesugade et al (2016), the improvement
is based on the fact that as observe CAPTCHA as a tool in IPS has fail, so therefore the
need to incorporate Text-based CAPTCHA on IDS with a redirector.
2. System capable of detecting intrusion by spyware: the new system is expected to be
capable of detecting intrusion by spyware which the existing system was unable to
address.
3. System capable of blocking intrusion by spyware: the new System will have honeypot
system embedded in it so that as soon as IDS detects intrusion by intelligent spyware the
honeypot system will be triggered to identify the IP address of the source machine and
instantly blocks it.
2.7 CONCLUSION AND FUTURE WORK
Considering the challenges encountered with the existing systems which attempted to use IPS
and IDS without CAPTCHA to detect and prevent attackers from accessing user’s network and
causing damage to user data, in this work we proposed a model that incorporates CAPTCHA in
IDS with a redirector in order to detect and block spywares capable of breaking CAPTCHA under
IDS. Our proposed model has a great significance. It can serve as an improved hybrid system
capable of providing means of identifying intelligent spywares targeted of breaking CAPTCHA.
In future we intend to implement the CAPTCHA- trap IDs with a redirector and host it online on
a web site having a dummy honeypot that will enable the system to track and capture the IP
address, information about the spyware and block the spyware from accessing the system. The
performance of the proposed model will be evaluated and compared against existing standards
algorithms and frameworks. The complete model can be recommended for web site users and
web masters in order to have security against spywares intrusion in their websites.
REFERENCES
[1] Igbe, O., Darwish, I., & Saadawi, T. (2016). Distributed Network Intrusion Detection System: An.
IEEE First Conference on Connected Health: Applications, Systems and Engineering Technologies
(pp. 101-106). New York: IEEE Computer Society
[2] Manu, B. (2016). A Survey on Secure Network: Intrusion Detection & Prevention Approaches.
American Journal of Information Systems, Vol. 4, No. 3,Science & Education Publishing, pp 69-88.
[3] Jung, E.J. (2015). Captcha. Matsumato: Yakohoma national university press. 1-34.
[4] Bursztein, E., Bethard, S., Fabry, C., Mitchell, J. C., & Jurafsky, D. (2010). How Good are Humans at
Solving CAPTCHAs? A Large Scale Evaluation. Security and Privacy (SP), IEEE Symposium (pp.
399-413). IEEE.
[5] Singh, V. P., & Pal, P. (2014). Survey of Different Types of CAPTCHA. International Journal of
Computer Science and Information Technologies (IJCSIT), Vol. 5 (2) , 2242-2245.
[6] Vijayarani, D. S., & Sylviaa, M. M. (2015). INTRUSION DETECTION SYSTEM– A. International
Journal of Security, Privacy and Trust Management (IJSPTM) Vol 4, No 1, 31-44.

39
[7] Yesugade, K. D., Avinash, M. S., Satish, N. S., Sandeep, S. C., & Malav, S. (2016). Infrastructure
Security Using IDS, IPS and Honeypot. International Engineering Research Journal (IERJ) Volume 2
Issue 3, 851-855.
[8] Kevat, S. M. (2017). Review on Honeypot Security. International Research Journal of Engineering
and Technology (IRJET), Volume: 04 Issue: 06, 1200-1203.
[9] Ashwini, M. K., Pratiksha, G., Anuja, K., Varsharani, S., & Gayatri, S. (2017). Secure Network
System using Honeypot. International Journal of Advanced Research in Computer and
Communication Engineering Vol. 6, Issue 2, 230-232.
[10] Bursztein, E., Martin, M., & Mitchell, o. C. (2011). Text-based CAPTCHA Strengths and
Weaknesses. Proceedings of the 18th ACM confernce on Computer and Communication security.
(pp. 125-138). Chicago: ACM.
[11] Chaware, S. (2011). Banking Security using Honeypot. International Journal of Security and Its
Applications Vol. 5 No. 1, 31-38.
[12] Linora, J. A., & Barathy, M. N. (2014). INTRUSION DETECTION AND PREVENTION BY
USING LIGHT WEIGHT VIRTUALIZATION IN WEB APPLICATIONS. International Journal of
Computer Science and Mobile Computing, IJCSMC, Vol. 3, Issue. 3, IEEE, 392-396.
[13] Dhopte, S., & Chaudhari, P. M. (2014). Genetic Algorithm for Intrusion Detection System.
International Journal of Research in Information Technology (IJRIT), Volume 2, Issue 3, 503-509.
[14] Ogweno, K. L., Oteyo, O. E., & Henry, D. O. (2014). Honey Pot Intrusion Detection System.
International Journal of Engineering Inventions Volume 4, Issue 5, 28-41.
[15] Kondra, J. R., Mishra, S. K., Bharti, S. K., & Babu, K. S. (2016). Honeypot-Based Intrusion
Detection System: A Performance Analysis. International Conference on “Computing for Sustainable
Global Development”,INDIA Com (pp. 3947-3951). New Delhi: IEEE.
[16] Malav, S., Avinash, M. S., Satish, N. S., & Sandeep, S. C (2016). Network Security Using IDS, IPS
& Honeypot. International Journal of Recent Research in Mathematics Computer Science and
Information Technology Vol. 2, Issue 2, pp: (27-30)
[17] Sano, S., Otsuka, T., Iyoyama, K., & Okuno, H. G. (2015). HMM-based Attacks on Google's
ReCAPTCHA with Continuous Visual and Audio symbols. Journal of Information and Processing,
Vol. 23, No. 6, pp 814-826.
[18] Gregg, K. (2008). Spammers' bot cracks Microsoft's CAPTCHA: Bot beats Windows Live Mail's
registration test 30% to 35% of the time says Websense. Computerworld.
[19] Ms, P., Kaur, M., & Kumar, M. K. (2013). Reviewing Effectiveness of CAPTCHA. International
Journal of Computer Trends and Technology (IJCTT) - volume4 Issue5, pp 1306-1311.
[20] Karthikeyan, K. R., & Indra, A. (2010). Intrusion Detection Tools and Techniques – A Survey.
International Journal of Computer Theory and Engineering, Vol.2, No.6, 901-906.
[21] Jabez, J., & Muthukumar, D. B. (2015). Intrusion Detection System (IDS): Anomaly Detection using
OutlierDetection Approach. International Conference on Intelligent Computing, Communication &
Convergence( ICCC-2014) (pp. 338-346). Odisha: ELSEVIER.
[22] Ashoor, A. S., & Gore, S. (2011). Difference between Intrusion Detection System (IDS) and Intrusion
Prevention System (IPS). International Journal of Scientific and Engineering Research Issue 2,
Volume 7, 497-501.
[23] Wang, L., & Jones, R. (2017). Big Data Analytics for Network Intrusion Detection: A Survey.
International Journal of Networks and Communications 7(1), 24-31.

40
[24] Latha, K. M. (2016). Learn About Intrusion Detection and Prevention. United States: Juniper
Networks.
[25] Howard Y. (2005). "Breaking CAPTCHAs Without Using OCR". (pureMango.co.uk). Retrieved
2006-08-22
[26] Chandra, N. S., & Madhuri, T. (2012). Cloud Security using Honeypot Systems. International Journal
of Scientific & Engineering Research Volume 3, Issue 3, 1-6.

A CAPTCHA – BASED INTRUSION DETECTION MODEL

More Related Content

What's hot (20)

Similar to A CAPTCHA – BASED INTRUSION DETECTION MODEL (20)

Recently uploaded (20)

A CAPTCHA – BASED INTRUSION DETECTION MODEL