EAGER: Exploring Spear-Phishing: A Socio-Technical Experimental Framework

EAGER：探索鱼叉式网络钓鱼：社会技术实验框架

基本信息

批准号：
1359601
负责人：
Oded Nov
金额：
$ 20.36万
依托单位：
New York University
依托单位国家：
美国
项目类别：
Standard Grant
财政年份：
2014
资助国家：
美国
起止时间：
2014-03-01 至 2017-02-28
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=1359601&HistoricalAwards=false
关键词：
EAGER Exploring Spear Phishing Socio

项目摘要

A safe and productive society increasingly depends on a safe and trustworthy cyberspace. However, extensive research has repeatedly shown that the human factor is often the weakest part in cyberspace, and that users of information systems are often exposed to great risks when they respond to credible-looking emails. Thus, spear phishing attacks - which attempt to get personal or confidential information from users through well-targeted deceptive emails - represent a particularly severe security threat. Addressing this threat, in this project we use a combination of surveys and experiments to examine the psychological, educational and cultural factors that contribute to the users' vulnerability and response to spear phishing attacks, and their ability to detect deception. An important aspect of the project is an in vivo, multi-site setting: studies are conducted in university and commercial enterprise setting, as well as across different cultures - in all cases using realistic spear phishing email attacks. Using a three-dimensional experimental design, in this cross-disciplinary research project we (i) identify the underlying factors for the success of different spear phishing attack strategies; (ii) develop novel types of cyber-defenses that are tailored to users' idiosyncratic characteristics; (iii) validate the usefulness of personality-targeted defense in a comparative, multi-organizational, real-world settings; and (iv) develop a new, collaborative avenue for cross-disciplinary research of social scientists and computer scientists.

一个安全且生产力的社会越来越依赖一个安全且值得信赖的网络空间。但是，广泛的研究反复表明，人为因素通常是网络空间中最弱的部分，并且当信息系统的用户响应可靠的电子邮件时，信息系统的用户通常会面临很大的风险。因此，长矛网络钓鱼攻击（试图通过针对性的欺骗性电子邮件从用户那里获取个人或机密信息）代表了特别严重的安全威胁。解决这个威胁，在这个项目中，我们使用调查和实验的结合来检查心理，教育和文化因素，这些因素有助于用户对长矛网络钓鱼攻击的脆弱性和反应以及检测欺骗的能力。该项目的一个重要方面是体内多站点环境：在大学和商业企业环境以及各种文化中进行研究 - 在所有情况下都使用逼真的矛式网络钓鱼电子邮件攻击。使用三维实验设计，在这个跨学科研究项目中，我们（i）确定了成功的不同长矛网络钓鱼攻击策略的潜在因素；（ii）开发出针对用户特质特征的新型网络防御类型；（iii）在比较，多组织的现实环境中验证以人格为目标的防御的实用性；（iv）开发了一种新的协作途径，用于社会科学家和计算机科学家的跨学科研究。