EAGER: Age-Targeted Automated Cueing Against Cyber Social Engineering Attacks

网络社会工程攻击经常被用于网络犯罪活动。这些攻击成本低，攻击归因复杂。纯粹的技术防御解决方案无法对抗它们，它们依赖于人类的轻信。人类经常会做出草率的决策，这可能会导致错误。另一个期望是用户应该能够理解复杂的安全提示，这些提示不考虑用户的人口统计数据。在理解这些攻击和与之相关的用户行为时，用户年龄被忽略了。本项目通过涉及年轻人和老年人的用户研究，调查用户年龄对社会工程攻击类型和有效性的影响。在这项研究中，参与者首先在家中使用互联网并接收针对年龄的恶意电子邮件时受到监控。然后，在一个涉及良性和恶意互联网活动的实验中，实验组收到了针对年龄的攻击线索。通过眼动追踪技术监测参与者的视觉注意力。这些研究的结果允许开发浏览器扩展，以针对年龄的方式提示用户在线的危险情况。这个项目代表了一种范式的改变：以年龄为目标的安全信息在用户需要的时候到达，而不是相反。这项研究将为最终用户带来广泛的互联网安全效益，尤其是老年人，他们很可能成为下一代社会工程攻击的目标。

Online social engineering attacks have been often used for cybercrime activities. These attacks are low cost and complicate attack attribution. Pure technical defense solutions cannot counter them, which rely on human gullibility. Humans often engage in short-cut decision-making, which can lead to errors. Another expectation is that users should be able to understand complex security tips, which do not consider user demographics. User age has been overlooked in understanding these attacks and user behavior related to them. This project investigates the influence of user age on the type and the effectiveness of social engineering attacks through user studies involving young and older adults. In this research, participants are first monitored in their homes while using the Internet and receiving age-targeted malicious e-mails. Then, in a lab session involving benign and malicious Internet activities, the experimental group receives age-targeted cues about the attacks. Participants' visual attention is monitored with eye tracking technology. The results of these studies allow the development of a browser extension to cue users in an age-targeted fashion about risky situations online. This project represents a paradigm change: age-targeted security information reaches users at the time they need it, and not the other way around. This research will lead to widespread benefits on Internet safety for end-users, especially to the population of older adults, who will likely be a target of the next generation of social engineering attacks.