EAGER: Age-Targeted Automated Cueing Against Cyber Social Engineering Attacks

EAGER：针对网络社会工程攻击的针对年龄的自动提示

• 批准号: 1450624
• 负责人: Daniela Oliveira
• 金额: $ 24.55万
• 依托单位: University of Florida
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-09-15 至 2017-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1450624&HistoricalAwards=false
• 关键词: EAGER; Age; Targeted; Automated; Cueing

Online social engineering attacks have been often used for cybercrime activities. These attacks are low cost and complicate attack attribution. Pure technical defense solutions cannot counter them, which rely on human gullibility. Humans often engage in short-cut decision-making, which can lead to errors. Another expectation is that users should be able to understand complex security tips, which do not consider user demographics. User age has been overlooked in understanding these attacks and user behavior related to them. This project investigates the influence of user age on the type and the effectiveness of social engineering attacks through user studies involving young and older adults. In this research, participants are first monitored in their homes while using the Internet and receiving age-targeted malicious e-mails. Then, in a lab session involving benign and malicious Internet activities, the experimental group receives age-targeted cues about the attacks. Participants' visual attention is monitored with eye tracking technology. The results of these studies allow the development of a browser extension to cue users in an age-targeted fashion about risky situations online. This project represents a paradigm change: age-targeted security information reaches users at the time they need it, and not the other way around. This research will lead to widespread benefits on Internet safety for end-users, especially to the population of older adults, who will likely be a target of the next generation of social engineering attacks.

在线社会工程攻击经常被用于网络犯罪活动。这些攻击成本低，攻击归因复杂。纯粹的技术防御解决方案无法对抗它们，因为它们依赖于人类的轻信。人类经常参与捷径决策，这可能导致错误。另一个期望是用户应该能够理解复杂的安全提示，这些提示不考虑用户人口统计学。在理解这些攻击和与之相关的用户行为时，用户年龄被忽视了。该项目通过涉及年轻人和老年人的用户研究，调查用户年龄对社会工程攻击类型和有效性的影响。在这项研究中，参与者首先在家中使用互联网并接收针对年龄的恶意电子邮件。然后，在涉及良性和恶意互联网活动的实验室会话中，实验组接收有关攻击的针对年龄的线索。参与者的视觉注意力通过眼动追踪技术进行监测。这些研究的结果允许开发一种浏览器扩展，以针对年龄的方式提示用户在线风险情况。这个项目代表了一种范式的变化：针对年龄的安全信息在用户需要的时候到达，而不是相反。 这项研究将为最终用户带来广泛的互联网安全利益，特别是老年人，他们可能会成为下一代社会工程攻击的目标。