EyeBit: Eye-Tracking Approach for Enforcing Phishing Prevention Habits
EyeBit: Eye-Tracking Approach for Enforcing Phishing Prevention Habits
复制标题
EyeBit：用于强化网络钓鱼预防习惯的眼球追踪方法
DOI：
10.1109/badgers.2014.14
复制
发表时间：
2014
期刊：
影响因子：
--
通讯作者：
Y. Kadobayashi
中科院分区：
文献类型：
--
作者：
Daisuke Miyamoto;Takuji Iimura;Grégory Blanc;Hajime Tazaki;Y. Kadobayashi
本文提出了一种认知方法，目的是让终端用户养成查看网页浏览器地址栏的习惯。早期对终端用户行为的调查强调，由于缺乏对URL结构、域名和安全信息的了解，用户成为网络钓鱼的受害者。因此，有许多方法可以提高终端用户的知识。然而，除非最终用户意识到其重要性并养成查看浏览器地址栏中的URL结构和相关安全信息的习惯，否则所获得的知识将不会被应用。我们假设，即使在复杂的网络钓鱼攻击的情况下，检查条形图的习惯也会提高教育效果、用户对安全信息的意识和检测准确性。为了验证这一假设，本文进行了一项以参与者为基础的实验，分析了23名参与者的眼动记录，并观察到新手并不倾向于具有上述习惯。然后，我们考虑一种让他们养成这些习惯的方法，并开发一个系统，要求他们在将一些信息输入到Web输入表单之前查看地址栏。我们的原型EyeBit是作为浏览器扩展开发的，它与眼睛跟踪设备交互，以检查用户是否查看浏览器的地址栏。系统停用网站的所有输入表单，并仅在用户查看了栏后才重新激活它们。本文给出了基于参与者的实验的初步结果，并讨论了我们的建议的有效性，同时考虑到EyeBit可能造成的不便。
This paper proposes a cognitive method with the goal to get end users into the habit of checking the address bar of the web browser. Earlier surveys of end user behavior emphasized that users become victims to phishing due to the lack of knowledge about the structure of URLs, domain names, and security information. Therefore, there exist many approaches to improve the knowledge of end users. However, the knowledge gained will not be applied unless end users are aware of the importance and develop a habit to check the browser's address bar for the URL structure and relevant security information. We assume that the habit of checking the bar will improve educational effect, user awareness of secure information, and detection accuracy even in the case of sophisticated phishing attacks. To assess this assumption, this paper conducts a participant-based experiment where 23 participants' eye movement records are analyzed, and observes that novices do not tend to have the said habit. We then consider a way for them to acquire these habits, and develop a system which requires them to look at the address bar before entering some information into web input forms. Our prototype named EyeBit is developed as a browser extension, which interacts with an eye-tracking device to check if the user looks at the browser's address bar. The system deactivates all input forms of the websites, and reactivates them only if the user has looked at the bar. This paper shows the preliminary results of our participant-based experiments, and discusses the effectiveness of our proposal, while considering the potential inconvenience caused by EyeBit.