How far has Machine learning reached in the domain of CAPTCHA solving?

Machine learning has become more than a buzzword now. With a massive range of problems lying under the hood which are being solved by ML, CAPTCHA breaking is just another branch of problem. Working on a few problems related to the convolutional neural network, we have figured that there is a lot of scope of improvement in this domain. The accuracy levels are not yet accepted by the users. Let’s understand in detail what all services do we have to tackle this problem and which turns out to be the best.

What is CAPTCHA?

CAPTCHA is no longer an alien term to web users. It’s the annoying human validation check added on many websites. An acronym for Completely Automated Public Turing test to tell Computers and Humans Apart. CAPTCHA can be defined as a computer program developed to distinguish between the human and machine to prevent any type of illicit activity on websites. The assumption that underlies the concept of CAPTCHA is that only a human would pass this test and bot or automated scripts would fail.

Why do we need to break CAPTCHA?

Now, people use automated CAPTCHA solving for different use cases, some of these are illegal while others are legitimate purposes. Spammers use CAPTCHA solving to extract email addresses of users to be able to generate as many spams as possible. The legit examples are scenarios where a new client or business partner has joined you and needs access to your Application Programming Interface(API) which is not ready or can’t be shared with due to some security issue or abuse it may give rise to. Thus, we are only left with CAPTCHA bypassing using automated scripts.

There are different types of CAPTCHA, text-based CAPTCHA, image-based CAPTCHA, reCAPTCHA, and mathematical CAPTCHA. Solving one can get challenging sometimes as the technology used in CAPTCHA and reCAPTCHA is getting smarter as we speak with updates coming at regular intervals.

Popular methods to break CAPTCHA

Here are the popular CAPTCHA solving methods available for the users to solve the CAPTCHA and reCAPTCHA:

1. OCR (Optical Character Recognition) enabled bots — This particular approach solves CAPTCHAs automatically using Optical Character Recognition (OCR) technique. Tools like Ocrad, tesseract solve CAPTCHAs but with very low accuracy.
2. Machine learning — Using computer vision, convolutional neural network, and python frameworks and libraries like Keras, tensorflow. We can train deep convolutional neural net models to find the letters and digits in the CAPTCHA image.
3. Online CAPTCHA-solving services — The service has human workers who are available online constantly to solve CAPTCHAs. When you send your CAPTCHA solving request, the service forwards it to the solvers who break it and return the solutions.

Performance analysis of OCR-based solution

Here are a few statistics and metrics on the performance of each:

OCR though a cost-effective solution when it comes to solving a large number of trivial CAPTCHAs, it fails to provide the required accuracy. OCR based solutions have become rare after the release of ReCaptcha V3 by Google. OCR enabled bots are thus not built to break CAPTCHA used by titans like Google, Facebook or Twitter. That would require a better-equipped CAPTCHA solving solutions.

OCR based solutions break 1 out 3 trivial CAPTCHAs correctly.

Performance analysis of ML-based method

Let’s look at how Machine learning-based solutions work:

An ML-based solution employs OpenCV to find contours in an image which detects the continuous regions. The images are preprocessed using the thresholding technique. All the images are converted to black and white. We break the CAPTCHA image into different letters using OpenCV findContour() function. The processed images are now just individual letters and digits. This is then fed to the CNN model to train it. And your trained CNN model is ready to solve real captchas.

CNN architecture to predict CAPTCHAs from https://www.researchgate.net/publication/301620459_CAPTCHA_Recognition_with_Active_Deep_Learning

The accuracy of such a solution is way better than OCR solution for all text-based CAPTCHAs. There are a lot of drawbacks of this solution as well, solves only a particular kind, Google keeps updating their reCAPTCHA generation algorithm. The last update seemed like the best-ever ReCaptcha update that affected our service: regular users never felt a thing while automated solutions either stopped working altogether or started working very slowly.

The model was trained with 1⁰⁴ iterations with correct and random samples and 1⁰⁵ test images and here is how it performed with a mean accuracy of ~60%

https://www.researchgate.net/publication/301620459_CAPTCHA_Recognition_with_Active_Deep_Learning

So, if your use case is to solve one kind of CAPTCHA with fairly basic complexity, you can make good use of such a trained ML model. A better captcha-solving solution than OCR but still needs to cover a lot of ground to get to an assuring stage of its accuracy.

Online captcha-solving service

Online CAPTCHA-solving services are so far the best possible solution to this problem. Keeping up with all the updates of reCAPTCHA by google, they provide an impeccable accuracy of 99%.

Why are online anti-captcha services better performers over other methods?

There are a lot of drawbacks to the OCR-based and ML solutions as per the research and development carried out so far. They can solve only trivial CAPTCHAs with no significant accuracy. Here are a few points to consider in this regard:

• A higher percentage of correct solutions (OCR gives an extremely high level of incorrect answers to really complicated CAPTCHAs; not to mention that some kinds of CAPTCHA can’t be solved with OCR at all, at least for now)
• Continuous flawless work without any interruptions with quick adaptation to the newly added complexities.
• Cost-effective with limited resource constraint and low maintenance cost as there are no software or hardware issues; all you need is the internet connection to send simple requests via API of anti-captcha service.

Big players in the online solving services

Now that we know the better technique to solve your CAPTCHAs, we want to choose the best one among of all anti-captcha services. Some services provide high accuracy of solutions, API support for automation, and quick responses to our requests. We have organizations like 2captcha, Imagetyperz, CaptchaSniper, etc.

2CAPTCHA is one of the best services I came across. With super quick response time and accuracy, they provide seamless services. It is the one we are going to use to bypass CAPTCHA.

Here is why 2captcha has an upper hand among its contemporaries:

• High-speed solution with 17 seconds for graphical and textual captchas and ~23 seconds for ReCaptcha
• Provides support for all popular programming languages with comprehensive documentation of their ready libraries.
• High accuracy (up to 99% based on the type of CAPTCHA)
• The money will be refunded for any incorrect answers
• Ability to solve a vast volume of captchas (more than 10,000 every minute).

Conclusion

Convolutional neural networks (CNN) have learned how to bypass the simplest types of captcha which lead captchas to active development. ANN will, of course, try to fit these changes, and captchas will become more complex — and this race will never end. That is why online anti-captcha services that involve real workers will be ahead of these solutions for the time being.

This article was originally published by Harshit tyagi on medium.