Does domain highlighting help people identify phishing sites?
Does domain highlighting help people identify phishing sites?
复制标题
域名突出显示是否可以帮助人们识别网络钓鱼站点？
DOI：
--
复制
发表时间：
2011
期刊：
影响因子：
--
通讯作者：
John Aycock
中科院分区：
文献类型：
--
作者：
Eric Lin;S. Greenberg;Eileah Trotter;David Ma;John Aycock
网络钓鱼者是模仿合法网站窃取用户凭证信息并利用该信息进行身份盗窃和其他犯罪活动的欺诈者。各种反网络钓鱼技术试图减轻此类攻击。域突出显示是最近被几种流行的网络浏览器采用的一种此类方法。这个想法很简单：地址栏中突出显示地址的域名，以便用户可以检查它以确定网站的合法性。我们的研究提出了一个基本问题：领域突出显示的效果如何？为了回答这个问题，我们向 22 名参与者展示了 16 个典型的网络钓鱼攻击网页，参与者必须确定该页面的合法性。在第一轮中，他们通过自己选择的任何方式来判断页面的合法性。在第二轮中，他们被专门指示看地址栏。我们发现，参与者对于网页合法性的判断分为三类：虽然域突出显示对于一种用户类型有些有效，但对于其他类型的用户则效果较差。我们的结论是，域名突出显示虽然提供了一些好处，但不能作为防止网络钓鱼攻击的唯一方法。
Phishers are fraudsters that mimic legitimate websites to steal user's credenfitial information and exploit that information for identity theft and other criminal activities. Various anti-phishing techniques attempt to mitigate such attacks. Domain highlighting is one such approach recently incorporated by several popular web browsers. The idea is simple: the domain name of an address is highlighted in the address bar, so that users can inspect it to determine a web site's legitimacy. Our research asks a basic question: how well does domain highlighting work? To answer this, we showed 22 participants 16 web pages typical of those targeted for phishing attacks, where participants had to determine the page's legitimacy. In the first round, they judged the page's legitimacy by whatever means they chose. In the second round, they were directed specifically to look at the address bar. We found that participants fell into 3 types in terms of how they determined the legitimacy of a web page; while domain highlighting was somewhat effective for one user type, it was much less effective for others. We conclude that domain highlighting, while providing some benefit, cannot be relied upon as the sole method to prevent phishing attacks.