McAlaney John, Hills Peter J
Faculty of Science & Technology, Department of Psychology, Bournemouth University, Poole, United Kingdom.
Front Psychol. 2020 Jul 28;11:1756. doi: 10.3389/fpsyg.2020.01756. eCollection 2020.
Social engineering attacks in the form of phishing emails represent one of the biggest risks to cybersecurity. There is a lack of research on how the common elements of phishing emails, such as the presence of misspellings and the use of urgency and threatening language, influences how the email is processed and judged by individuals. Eye tracking technology may provide insight into this. In this exploratory study a sample of 22 participants viewed a series of emails with or without indicators associated with phishing emails, whilst their eye movements were recorded using a SMI RED 500 eye-tracker. Participants were also asked to give a numerical rating of how trustworthy they deemed each email to be. Overall, it was found that participants looked more frequently at the indicators associated with phishing than would be expected by chance but spent less overall time viewing these elements than would be expected by chance. The emails that included indicators associated with phishing were rated as less trustworthy on average, with the presence of misspellings or threatening language being associated with the lowest trustworthiness ratings. In addition, it was noted that phishing indicators relating to threatening language or urgency were viewed before misspellings. However, there was no significant interaction between the trustworthiness ratings of the emails and the amount of scanning time for phishing indicators within the emails. These results suggest that there is a complex relationship between the presence of indicators associated with phishing within an email and how trustworthy that email is judged to be. This study also demonstrates that eye tracking technology is a feasible method with which to identify and record how phishing emails are processed visually by individuals, which may contribute toward the design of future mitigation approaches.
网络钓鱼电子邮件形式的社会工程攻击是网络安全面临的最大风险之一。关于网络钓鱼电子邮件的常见元素，如拼写错误的存在、紧迫性语言和威胁性语言的使用，如何影响个人对电子邮件的处理和判断，目前缺乏相关研究。眼动追踪技术可能会为这一问题提供见解。在这项探索性研究中，22名参与者观看了一系列带有或不带有与网络钓鱼电子邮件相关指标的电子邮件，同时使用SMI RED 500眼动追踪仪记录他们的眼动情况。参与者还被要求对每封电子邮件的可信度给出一个数字评分。总体而言，研究发现参与者看与网络钓鱼相关指标的频率高于偶然预期，但总体上看这些元素的时间少于偶然预期。包含与网络钓鱼相关指标的电子邮件平均被评为可信度较低，拼写错误或威胁性语言的存在与最低的可信度评分相关。此外，还注意到与威胁性语言或紧迫性相关的网络钓鱼指标比拼写错误先被查看。然而，电子邮件的可信度评分与电子邮件中网络钓鱼指标的扫描时间之间没有显著的交互作用。这些结果表明，电子邮件中与网络钓鱼相关指标的存在与该电子邮件被判断为的可信度之间存在复杂的关系。这项研究还表明，眼动追踪技术是一种可行的方法，可用于识别和记录个人如何视觉处理网络钓鱼电子邮件，这可能有助于未来缓解措施的设计。
