Purdue University, Lafayette, Indiana, USA.
Hum Factors. 2019 Jun;61(4):577-595. doi: 10.1177/0018720818810942. Epub 2018 Dec 10.
Evaluate the effectiveness of training embedded within security warnings to identify phishing webpages.
More than 20 million malware and phishing warnings are shown to users of Google Safe Browsing every week. Substantial click-through rate is still evident, and a common issue reported is that users lack understanding of the warnings. Nevertheless, each warning provides an opportunity to train users about phishing and how to avoid phishing attacks.
To test use of phishing-warning instances as opportunities to train users' phishing webpage detection skills, we conducted an online experiment contrasting the effectiveness of the current Chrome phishing warning with two training-embedded warning interfaces. The experiment consisted of three phases. In Phase 1, participants made login decisions on 10 webpages with the aid of warning. After a distracting task, participants made legitimacy judgments for 10 different login webpages without warnings in Phase 2. To test the long-term effect of the training, participants were invited back a week later to participate in Phase 3, which was conducted similarly as Phase 2.
Participants differentiated legitimate and fraudulent webpages better than chance. Performance was similar for all interfaces in Phase 1 for which the warning aid was present. However, training-embedded interfaces provided better protection than the Chrome phishing warning on both subsequent phases.
Embedded training is a complementary strategy to compensate for lack of phishing webpage detection skill when phishing warning is absent.
Potential applications include development of training-embedded warnings to enable security training at scale.
评估嵌入式安全警告培训在识别网络钓鱼网页方面的有效性。
谷歌安全浏览每周向用户展示超过 2000 万次恶意软件和网络钓鱼警告。尽管点击量仍然很高，但用户普遍反映缺乏对警告的理解。然而，每个警告都为培训用户了解网络钓鱼和如何避免网络钓鱼攻击提供了机会。
为了测试利用网络钓鱼警告实例作为培训用户识别网络钓鱼网页技能的机会，我们进行了一项在线实验，对比了当前 Chrome 网络钓鱼警告与两种嵌入式培训警告界面的有效性。实验分为三个阶段。在第一阶段，参与者在警告的帮助下对 10 个网页做出登录决策。在分心任务之后，参与者在第二阶段不使用警告对 10 个不同的登录网页做出合法性判断。为了测试培训的长期效果，参与者在一周后被邀请回来参加第三阶段，该阶段的操作与第二阶段类似。
参与者在区分合法和欺诈性网页方面的表现优于随机水平。在第一阶段，对于有警告辅助的所有界面，性能都相似。然而，在随后的两个阶段，嵌入式培训界面提供的保护优于 Chrome 网络钓鱼警告。
嵌入式培训是一种补充策略，可以在没有网络钓鱼网页检测技能的情况下补偿这种不足。
潜在的应用包括开发嵌入式培训警告，以实现大规模的安全培训。
