EAGER: Exploring Spear-Phishing: A Socio-Technical Experimental Framework

EAGER：探索鱼叉式网络钓鱼：社会技术实验框架

• 批准号: 1359601
• 负责人: Oded Nov
• 金额: $ 20.36万
• 依托单位: New York University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-03-01 至 2017-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1359601&HistoricalAwards=false
• 关键词: EAGER; Exploring; Spear; Phishing; Socio

A safe and productive society increasingly depends on a safe and trustworthy cyberspace. However, extensive research has repeatedly shown that the human factor is often the weakest part in cyberspace, and that users of information systems are often exposed to great risks when they respond to credible-looking emails. Thus, spear phishing attacks - which attempt to get personal or confidential information from users through well-targeted deceptive emails - represent a particularly severe security threat. Addressing this threat, in this project we use a combination of surveys and experiments to examine the psychological, educational and cultural factors that contribute to the users' vulnerability and response to spear phishing attacks, and their ability to detect deception. An important aspect of the project is an in vivo, multi-site setting: studies are conducted in university and commercial enterprise setting, as well as across different cultures - in all cases using realistic spear phishing email attacks. Using a three-dimensional experimental design, in this cross-disciplinary research project we (i) identify the underlying factors for the success of different spear phishing attack strategies; (ii) develop novel types of cyber-defenses that are tailored to users' idiosyncratic characteristics; (iii) validate the usefulness of personality-targeted defense in a comparative, multi-organizational, real-world settings; and (iv) develop a new, collaborative avenue for cross-disciplinary research of social scientists and computer scientists.

一个安全和富有成效的社会越来越依赖于一个安全和值得信赖的网络空间。然而，广泛的研究一再表明，人为因素往往是网络空间中最薄弱的部分，信息系统的用户在回复看似可信的电子邮件时往往面临巨大的风险。因此，鱼叉式网络钓鱼攻击（试图通过有针对性的欺骗性电子邮件从用户那里获取个人或机密信息）代表了特别严重的安全威胁。 为了应对这一威胁，在这个项目中，我们结合了调查和实验来检查导致用户脆弱性和对鱼叉式网络钓鱼攻击的响应以及他们检测欺骗的能力的心理、教育和文化因素。该项目的一个重要方面是体内多站点环境：研究是在大学和商业企业环境以及不同文化中进行的 - 在所有情况下都使用真实的鱼叉式网络钓鱼电子邮件攻击。在这个跨学科研究项目中，我们使用三维实验设计（i）确定不同鱼叉式网络钓鱼攻击策略成功的根本因素； (ii) 开发适合用户特殊特征的新型网络防御； (iii) 在比较、多组织、现实世界环境中验证针对个性的防御的有用性； (iv) 为社会科学家和计算机科学家的跨学科研究开发新的合作途径。