EAGER: Exploring Spear-Phishing: A Socio-Technical Experimental Framework

一个安全和富有成效的社会越来越依赖于一个安全和值得信赖的网络空间。然而，广泛的研究一再表明，人的因素往往是网络空间中最薄弱的部分，信息系统的用户在回复看似可疑的电子邮件时往往面临巨大的风险。因此，鱼叉式网络钓鱼攻击--试图通过有针对性的欺骗性电子邮件从用户那里获取个人或机密信息--是一种特别严重的安全威胁。 为了解决这一威胁，在这个项目中，我们使用调查和实验相结合的方法来研究心理，教育和文化因素，这些因素有助于用户对鱼叉式网络钓鱼攻击的脆弱性和反应，以及他们检测欺骗的能力。该项目的一个重要方面是一个体内，多站点设置：研究是在大学和商业企业设置，以及在不同的文化进行-在所有情况下使用现实的鱼叉式网络钓鱼电子邮件攻击。使用三维实验设计，在这个跨学科的研究项目中，我们（i）确定不同鱼叉式网络钓鱼攻击策略成功的潜在因素;（ii）开发针对用户特质特征的新型网络防御;（iii）在比较，多组织，现实世界的环境中验证个性目标防御的有用性;以及（iv）为社会科学家和计算机科学家的跨学科研究开发新的协作途径。

A safe and productive society increasingly depends on a safe and trustworthy cyberspace. However, extensive research has repeatedly shown that the human factor is often the weakest part in cyberspace, and that users of information systems are often exposed to great risks when they respond to credible-looking emails. Thus, spear phishing attacks - which attempt to get personal or confidential information from users through well-targeted deceptive emails - represent a particularly severe security threat. Addressing this threat, in this project we use a combination of surveys and experiments to examine the psychological, educational and cultural factors that contribute to the users' vulnerability and response to spear phishing attacks, and their ability to detect deception. An important aspect of the project is an in vivo, multi-site setting: studies are conducted in university and commercial enterprise setting, as well as across different cultures - in all cases using realistic spear phishing email attacks. Using a three-dimensional experimental design, in this cross-disciplinary research project we (i) identify the underlying factors for the success of different spear phishing attack strategies; (ii) develop novel types of cyber-defenses that are tailored to users' idiosyncratic characteristics; (iii) validate the usefulness of personality-targeted defense in a comparative, multi-organizational, real-world settings; and (iv) develop a new, collaborative avenue for cross-disciplinary research of social scientists and computer scientists.