Defending the Weakest Link: Intrusion via Social Engineering

欺诈自古以来就伴随着我们。随着网络空间的兴起，欺诈的机会比比皆是。近年来，所谓的“网络钓鱼”攻击急剧增加。最明显的方式是通过电子邮件。您可能会收到一封声称来自熟悉机构（例如您的银行）的电子邮件，表明他们保存的有关您的某些信息不准确。您需要点击一个链接，该链接将带您进入一个网页，您需要在该网页上输入机密信息，例如您的账号和在线银行密码详细信息（以及其他机密信息）。如果你不这样做，这条信息也可能威胁要暂停你的帐户。从表面上看，这是一个似是而非的情况。这些信息和网站看起来是真实的，但事实并非如此。如果你已经按照要求做出了回应，那么你的机密信息现在就掌握在一个骗子手中。你所期望的结果并不是你行为的实际结果--尽管在你意识到这一点之前可能需要一段时间（太晚了）。你的世界观与现实不符。但是，通过仔细检查电子邮件，我们是否可以推断出它很可能是一个网络钓鱼攻击？这个项目将调查网络钓鱼攻击，试图提取的特征企图cons。我们将使用我们的安全专业知识和经验，通过有经验的心理学研究人员进行了有条不紊的实证调查告知这一点。如果我们可以正式这些功能，那么我们可以尝试自动检测网络钓鱼攻击。这样做的好处是显而易见的。网络钓鱼攻击可能是短暂的;他们只需要说服一些不幸的天真的人上当受骗就可以成功。我们需要尽早识别网络钓鱼攻击。我们的目标是开发原型工具支持，以确定我们实际上可以自动检测钓鱼攻击的程度，并在校园环境中进行初步测试（用户复杂程度差异很大）。

Fraud has been with us since time immemorial. With the rise of cyberspace opportunities for fraud abound. Recent years has seen a dramatic increase in what have become known as 'phishing' attacks. The most obvious means is via email. You might receive an email purporting to be from a familiar organisation, e.g. your bank, indicating that some information they maintain on you is inaccurate. You are requested to click on a link that takes you to a web page where you are requested to enter confidential information, such as your account number and on-line banking password details (and other confidential information). The message might also threaten to suspend you account if you do not do so.On the face of it this is a plausible scenario. The messages and web site look authentic, but they are not. If you have responded as requested then your confidential details are now in the hands of a frauster. What you expected to be the result of your actions is not the actual result - though it may be a while (too late) before you realise this. Your model of the world is at odds with reality. But by scrutinising the email carefully can we deduce that it is likely to be a phishing attack?This project will investigate phishing attacks, attempting to extract features of attempted cons. We shall do this using our security expertise and experience informed by methodical empirical surveys carried out by an experienced psychology researcher.If we can formalise these features then we can attempt to automatically detect phishing attacks. The benefits of doing so are obvious. Phishing attacks may be short lived; they need only to persuade a few unfortunate naive people to fall for the con to have succeeded. We need to identify phishing attacks at the earliest opportunity. We aim to develop prototype tool support to determine the degree to which we can actually detect phishing attacks automatically and test it out initially in a campus environment (where user sophistication varies hugely).