Defending the Weakest Link: Intrusion via Social Engineering

自古以来，欺诈就一直伴随着我们。随着网络空间的兴起，欺诈的机会比比皆是。近年来，所谓的“网络钓鱼”攻击急剧增加。最明显的方式是通过电子邮件。你可能会收到一封声称来自你熟悉的机构（例如你的银行）的电子邮件，指出他们持有的你的一些信息是不准确的。您被要求点击一个链接，该链接将带您进入一个网页，该网页要求您输入机密信息，例如您的帐号和网上银行密码详细信息（以及其他机密信息）。如果您不这样做，该消息还可能威胁要暂停您的帐户。从表面上看，这是一个合理的设想。这些信息和网站看起来是真实的，但事实并非如此。如果您按要求回复了，那么您的机密信息现在就掌握在骗子手中了。你所期望的结果并不是你行动的实际结果——尽管在你意识到这一点之前可能要过一段时间（太晚了）。你的世界观与现实不符。但是，通过仔细审查电子邮件，我们是否可以推断出这可能是一次网络钓鱼攻击？该项目将调查网络钓鱼攻击，试图提取企图攻击的特征。我们将利用我们的安全专业知识和经验，并由一位经验丰富的心理学研究者进行系统的实证调查。如果我们可以将这些特性形式化，那么我们就可以尝试自动检测网络钓鱼攻击。这样做的好处显而易见。网络钓鱼攻击可能是短暂的；他们只需要说服几个不幸的天真的人上当受骗就能成功。我们需要尽早识别网络钓鱼攻击。我们的目标是开发原型工具支持，以确定我们能够自动检测网络钓鱼攻击的程度，并在校园环境（用户复杂程度差异很大）中进行初步测试。

Fraud has been with us since time immemorial. With the rise of cyberspace opportunities for fraud abound. Recent years has seen a dramatic increase in what have become known as 'phishing' attacks. The most obvious means is via email. You might receive an email purporting to be from a familiar organisation, e.g. your bank, indicating that some information they maintain on you is inaccurate. You are requested to click on a link that takes you to a web page where you are requested to enter confidential information, such as your account number and on-line banking password details (and other confidential information). The message might also threaten to suspend you account if you do not do so.On the face of it this is a plausible scenario. The messages and web site look authentic, but they are not. If you have responded as requested then your confidential details are now in the hands of a frauster. What you expected to be the result of your actions is not the actual result - though it may be a while (too late) before you realise this. Your model of the world is at odds with reality. But by scrutinising the email carefully can we deduce that it is likely to be a phishing attack?This project will investigate phishing attacks, attempting to extract features of attempted cons. We shall do this using our security expertise and experience informed by methodical empirical surveys carried out by an experienced psychology researcher.If we can formalise these features then we can attempt to automatically detect phishing attacks. The benefits of doing so are obvious. Phishing attacks may be short lived; they need only to persuade a few unfortunate naive people to fall for the con to have succeeded. We need to identify phishing attacks at the earliest opportunity. We aim to develop prototype tool support to determine the degree to which we can actually detect phishing attacks automatically and test it out initially in a campus environment (where user sophistication varies hugely).