CT-T: Supporting Trust Decisions

支持信任决策互联网用户经常遇到的情况下，他们被要求作出隐式或显式的信任决策。此类决策的示例包括关于是否打开电子邮件附件或提供信息的决策，以及响应于特定的信任或安全相关提示而做出的决策。错误决定的后果包括用恶意软件或间谍软件感染自己的计算机，无意中传播恶意软件，以及向骗子和身份窃贼泄露信息。攻击者能够利用大多数用户糟糕的信任决策技能，通过一类被称为“语义攻击”的攻击。“虽然已经做出了一些努力来寻找开发信息系统的方法，这些方法不会强迫用户做出他们不准备做出的安全或信任相关的决定，但系统并不总是能够代表用户做出准确的信任决定，特别是当这些决定需要上下文信息的知识时。因此，仍然有许多信任决定必须由用户自己做出，通常只有有限的或没有计算机的帮助或保护。这项研究的目标是开发方法来支持用户在做出这些信任决策时，使他们更好地了解情况，并做出最好的决策。这项研究将开始与心理模型研究，旨在了解和建模人们如何在网上作出信任的决定，并最终导致新的软件和设计模式的开发和评估。

ABSTRACT0524189Lorrie CranorCarnegie-Mellon UniversitySupporting Trust DecisionsInternet users frequently encounter situations in which they are asked to make implicit or explicit trust decisions. Examples of such decisions include decisions about whether or not to open an email attachment or provide information and decisions made in response to specific trust- or security-related prompts. The consequences of a wrong decision include infecting their own computers with malware or spyware, unwittingly propagating malware, and revealing information to con artists and identity thieves. Attackers are able to take advantage of most users' poor trust decision-making skills through a class of attacks known as "semantic attacks." While some efforts have been made to find ways of developing information systems that do not force users to make security- or trust-related decisions that they are not prepared to make, it is not always possible for systems to make accurate trust decisions on a user's behalf, especially when thosedecisions require knowledge of contextual information. There remain many trust decisions that users must therefore make on their own, usually with limited or no assistance or protections from theircomputer. The goal of this research is to develop approaches to supporting users when they make these trust decisions so that they are better informed and make the best decisions possible. The research will begin with a mental models study aimed at understanding and modeling how people make trust decisions in the online context and ultimately result in the development and evaluation of new software and design patterns.