Warning of Phishing Attacks: Supporting Human Information Processing, Identifying Phishing Deception Indicators, and Reducing Vulnerability - April 2017

Public Audience
Purpose: To highlight project progress. Information is generally at a higher level which is accessible to the interested public. All information contained in the report (regions 1-3) is a Government Deliverable/CDRL.

PI(s):  Christopher Mayhorn, Emerson Murphy-Hill
Researchers: Allaire Welk, Olga Zielinska

HARD PROBLEM(S) ADDRESSED

• Human Behavior - Ongoing efforts have focused on understanding how mental models vary between novice users, experts (such as IT professionals), and hackers should be useful in accomplishing the ultimate goal of the work: to build secure systems that reduce user vulnerability to phishing. Moreover, mapping out the mental models that underlie security-related decision making should also inform behavioral models of users, security-experts (i.e., system administrators), and adversaries seeking to exploit system functionality. 

PUBLICATIONS

• .

ACCOMPLISHMENT HIGHLIGHTS

• Data analysis on the project that explored the interaction between phishing message characteristics (based on Cialdini's persuasion principles) and personality characteristics has been concluded. We supplemented this work by conducting exploratory analyses to assess a signal detection approach. Results indicated that hit rate (ability to detect a phishing attack) and false alarms (erroneously labeling a legitimate email as phishing) varied by message content in general. Further analyses to determine how persuasion principles and personality characteristics influence phishing susceptibility as measured by signal detection metrics is ongoing.