EAGER: Behavior-Based Incentive Mechanism Design for Crowd Defense against Phishing Attacks

本研究旨在防止网络钓鱼攻击的危害。在过去几年中，网络钓鱼攻击呈上升趋势，仅在2013年就发生了近45万次攻击，估计损失超过59亿美元。这些攻击试图通过欺诈性电子邮件获取用户名和密码等个人信息。网络钓鱼邮件正变得越来越有针对性，利用目标受害者的个人信息，试图看起来像真实的电子邮件，提高对攻击的响应速度。如果收到钓鱼邮件的大量参与者可以使用虚假或欺骗性信息有策略地对其进行回复，攻击者将被大量回复所淹没和误导，从而使查找受害者的成本更高。通过这种方式，容易成为网络钓鱼骗局受害者的脆弱用户将被隐藏在许多虚假回复中。防御者的合作大群体行为可以显著提高攻击成本，从而降低攻击者发送网络钓鱼邮件的经济动机。这种防御机制被称为群体防御。本项目将全面探讨人群防御机制设计的心理、经济、行为和技术等方面。群体防御是将非对称优势从攻击方逆转到防御方的关键防御机制。该研究旨在了解人群防御者行为中的心理和经济因素，创建基本的行为博弈论设计框架，并开发一个概念验证自动化软件系统，使用户能够自动协调和响应网络钓鱼。针对反网络钓鱼人群防御而开发的分析和设计方法，可以广泛应用于分布式拒绝服务攻击（DDoS）、高级持续性威胁（APT）和协同侦察等其他安全问题。在这个项目中创建的工具将作为开源发布，以建立一个更加协作和可信的网络空间。项目主管部门致力于通过外联活动开展公共教育，进一步增加妇女和少数民族研究生和本科生对项目的参与。

This research is aimed at preventing harm from phishing attacks. Phishing attacks have been on the rise in the last few years with nearly 450,000 attacks and record estimated losses of over USD $5.9 billion just in the year 2013 alone. These attacks attempt to acquire personal information, such as username and passwords, through fraudulent emails. Phishing emails are becoming more targeted, using personal information about their intended victims, in an attempt to seem like authentic emails and improve the response rate to the attacks. If a large number of participants who receive a phishing email can respond to it strategically using fake or deceptive information, the attacker will be overwhelmed and misled by the number of responses, and thus making it more costly to locate the victim. In this way, vulnerable users who tend to fall victim to phishing scams will be hidden in a number of fake responses. The cooperative large-population behavior of the defenders can increase significantly the cost of attack, and hence reduce the economic incentives for the attacker to send phishing email. This type of defense mechanism is called crowd defense. This project will holistically explore the psychological, economic, behavioral, and technical aspects of crowd defense mechanism design.Crowd defense is a critical defense mechanism to reverse the asymmetric advantage from the attacker to the defender. The research aims to understand the psychological and economic factors in the behavior of crowd defenders, create essential behavioral game-theoretic design frameworks, and develop a proof-of-concept automated software system that enables users to coordinate and respond automatically to phishing. The analytical and design methodologies developed for anti-phishing crowd defense can be broadly applied to other security problems, such as distributed denial of service attacks (DDoS), advanced persistent threats (APT), and coordinated reconnaissance. The tools created in this project will be released as open-source for building a more collaborative and trustworthy cyberspace. The PIs are committed to public education through outreach activities that will further increase the participation of women and minorities as graduate and undergraduate students in the project.