EAGER: DCL: SaTC: Enabling Interdisciplinary Collaboration: Inoculation vs. education: the role of real time alerts and end-user overconfidence

网络钓鱼在当今社会越来越成问题。网络钓鱼漏洞不仅限于没有经验的人。即使是那些受过技术培训的人也会成为网络钓鱼攻击的受害者。在这个项目中要解决的研究问题是，缺乏经验的人和专家是否因不同的原因而成为网络钓鱼的受害者，如果是这样，如何解决这些不同来源的漏洞。不确定性和过度自信，分别可以表征网络钓鱼的脆弱性的人较少与更多的计算机素养。该项目团队正在研究网络钓鱼漏洞，测试它们是否表征具有不同专业知识和信心的人，并部署旨在解决不同原因的网络钓鱼漏洞的干预措施。要评估的主要干预措施包括心理接种，使人们暴露于重复的，减弱的和无害的网络钓鱼体验，以及反网络钓鱼指导形式的教育技术。 该项目的第一阶段是通过受控实验测试不同计算机素养和不同信心的人是否在避免网络钓鱼的方法上有所不同。下一阶段是研究不同干预措施的影响，包括心理接种和反网络钓鱼指令的变化，并测试这些干预措施如何与专业知识和信心不同的人相关联。第三步是开发和评估可能由潜在网络钓鱼攻击触发的警报。识别可以从接种培训或专门指导中受益的高危人群，有可能减少网络钓鱼和许多其他类型的攻击。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的智力价值和更广泛的影响审查标准进行评估来支持。

Phishing is increasingly problematic in today’s society. Phishing vulnerability is not limited to inexperienced persons. Even those with technological training fall victim to phishing attacks. The research question to be addressed in this project is whether inexperienced people and experts fall victim to phishing for different reasons, and if so, how those different sources of vulnerability might be addressed. Uncertainty and overconfidence, respectively, may characterize the phishing vulnerabilities of persons with less versus more computer literacy. The project team is studying phishing vulnerabilities, testing whether they characterize people with different expertise and confidence, and deploying interventions designed to address differently-caused phishing vulnerabilities. The main interventions to be evaluated include psychological inoculation, whereby people are exposed to repeated, weakened, and harmless phishing experiences, and educational techniques in the form of anti-phishing instructions. The first stage in the project is testing, through controlled experiments, whether people with varying computer literacy, and varying confidence, differ in their approach to phishing avoidance. The next stage is to study the impact of different interventions, including variations on psychological inoculation and anti-phishing instructions, and test how those interventions are associated with persons who vary in their expertise and confidence. A third step will be to develop and evaluate alerts that could be triggered by potential phishing attacks. The identification of at-risk people who could benefit from inoculation training or specialized instruction has the potential for mitigating phishing and many other kinds of attacks on people. A diverse set of students will be involved in the research.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.