I-Corps: A Platform to Automatically Measure Users Susceptibility to Social Engineering Attacks

这个I-Corps项目更广泛的影响/商业潜力是为容易受到社会工程攻击的公司员工开发安全意识技术;即，网络钓鱼攻击为了识别那些容易受到网络钓鱼攻击的人，组织通常会自我钓鱼，也就是对自己的员工进行网络钓鱼，看看谁会响应。 关注网络安全的组织可能会自行雇用服务或开展网络钓鱼活动。 自我网络钓鱼可能只识别那些由于在此类活动中通常使用的相对通用的网络钓鱼电子邮件而极易受到影响的人。使用自我网络钓鱼来识别易受影响的员工的组织可能会有一种虚假的安全感。 一直需要一种方法来识别易受更复杂的网络钓鱼活动影响的员工。拟议的技术测量用户的敏感性，从公开的信息，这些用户的网络钓鱼攻击。这个I-Corps项目是基于一个技术平台的发展，以衡量个人在一个组织，容易受到网络钓鱼攻击。 所提出的技术使用公开可用的信息来量化用户的个性特征、人口统计、教育和经验，这些都是已知的预测网络钓鱼易感性的信息。 然后使用该数据星座来计算每个用户对网络钓鱼攻击的敏感程度的估计。 拟议的平台可加强一个组织的努力，以确定最能从安全意识培训中受益的个人。 此外，所提出的技术可能对增强针对操作关键基础设施的人员的渗透测试产生广泛影响，即，安全系统中最薄弱的环节该项目还可能对有效的网络安全教育的发展产生重大影响。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact/commercial potential of this I-Corps project is the development of security awareness technology for corporate employees who are susceptible to social engineering attacks; i.e., phishing attacks. To identify those who are susceptible to phishing attacks, organizations typically self-phish, which is phishing one’s own employees and seeing who responds. Organizations concerned with cybersecurity may hire services or conduct phishing campaigns themselves. Self-phishing may only identify those who are extremely susceptible due to the relatively generic phishing emails that are typically used during such campaigns. Organizations that use self-phishing to identify susceptible workers may have a false sense of security. There is a continuing need for a ways to identify workers susceptible to more complex phishing campaigns. The proposed technology measures users’ susceptibility to phishing attacks from publicly available information about those users.This I-Corps project is based on the development of a technology platform to measure individuals in an organization that are susceptible to phishing attacks. The proposed technology uses publicly available information to quantify users’ personality traits, demographics, education, and experiences that are known to predict phishing susceptibility. That constellation of data is then used to compute an estimate how susceptible each user is to a phishing attack. The proposed platform may enhance an organization's efforts to identify individuals who would most benefit from security awareness training. In addition, the proposed technology may have a broad impact on enhancing penetration testing that targets people who are operating critical infrastructure, i.e., the weakest links in security systems. The project also may significantly impact the development of effective cybersecurity education.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.