Cognitive Engineering Modeling of Phishing

Abstract

Using signal detection theory (SDT) and fuzzy SDT, the influence of familiarity with phishing and having a background in cybersecurity on phishing behavior was examined. The results from SDT analysis indicated that familiarity with phishing only accounted for 11% of the variance in sensitivity and 5% in bias. When examining the same using Fuzzy SDT, familiarity with phishing accounted for 6% of the variance in bias. Background in cybersecurity had a statistically significant effect on sensitivity and bias in classical SDT but only on bias in fuzzy SDT. A confusion matrix revealed that the percentage of successfully transmitted information from the stimuli to the judgements made by participants was only 26%. Participants most frequently identified requests for personal information in stimulus emails as phishing cues. Future research should continue to explore application of the different cognitive engineering models to phishing identification.

Get full access to this article

View all access options for this article.

References

Abdelhamid

(2020). The role of health concerns in phishing susceptibility: Survey design study. J Med Internet Res, 22(5), e18394. doi: 10.2196/18394

Aldawood

Skinner

(2019). Contemporary cyber security social engineering solutions, measures, policies, tools and applications: A critical appraisal. InternationalJournalof Security (IJS), 10(1), 1.

Dhamija

Tygar

Hearst

(2006). Why phishing works. In (p. 581590). ACM.

Griffin

S. E.

Rackley

C. C.

(2008). Vishing. In Proceedings of the 5th annual conference on information security curriculum development (pp. 33–35).

Guo

K. H.

(2013). Security-related behavior in using information systems in the workplace: A review and synthesis. Computers security, 32, 242-251.

Halevi

Memon

Nov

(2015). Spear-phishing in the wild: A real-world study of personality, phishing self-efficacy and vulnerability to spear-phishing attacks. Phishing Self-Efficacy andVulnerability to Spear-Phishing Attacks (January 2, 2015).

Hill

(2019). 90% of uk data breaches due to human error in 2019. Retrieved from https://www.infosecurity-magazine.com/news/90-data-breaches-human-error/

Lawson

Pearson

C. J.

Crowson

Mayhorn

C. B.

(2020). Email phishing and signal detection: How persuasion principles and personality influence response patterns and accuracy. Applied Ergonomics, 86, 103084.

Martin

Dubé

Coovert

M. D.

(2018). Signal detection theory (sdt) is effective for modeling user behavior toward phishing and spear-phishing attacks. HumanFactors: TheJournalof HumanFactors andErgonomics Society, 60(8), 1179-1191.

10.

Milkovich

(2020). 15 alarming cyber security facts and stats. Retrieved from https://www.cybintsolutions.com/cyber-security-facts-stats/

11.

Molinaro

K. A.

Bolton

M. L.

(2018). Evaluating the applicability of the double system lens model to the analysis of phishing email judgments. Computers security, 77, 128-137.

12.

Molinaro

K. A.

Bolton

M. L.

(2019). Using the lens model and cognitive continuum theory to understand the effects of cognition on phishing victimization. Proceedings of the HumanFactors and Ergonomics Society Annual Meeting, 63(1), 173-177.

13.

Neigel

A. R.

Claypoole

V. L.

Waldfogle

G. E.

Acharya

& Hancock

G. M

. (2020). Holistic cyber hygiene education: Accounting for the human factors. Computers security, 92, 101731.

14.

Oliveira

Rocha

Yang

Ellis

Dommaraju

Muradoglu

…Ebner

(2017). Dissecting spear phishing emails for older vs young adults: On the interplay of weapons of influence and life domains in predicting susceptibility to phishing. In Proceedings of the 2017 chi conference on human factors in computing systems (pp. 6412–6424).

15.

Parasuraman

Masalonis

A. J.

Hancock

P. A.

(2000). Fuzzy signal detection theory: Basic postulates and formulas for analyzing human and machine performance. HumanFactors: TheJournal of the HumanFactors and Ergonomics Society, 42(4), 636-659.

16.

Prince

(2018). Cybersecurity: The security and protection challenges of our digital world. Computer, 51(4), 16-19. doi: 10.1109/MC.2018.2141025

17.

Retruster. (2019). 2019 phishing statistics and email fraud statistics: All the phishing email stats for 2019. Retrieved from https://retruster.com/blog/2019-phishing-and-email-fraud-statistics.html

18.

Shalal

Selyukh

(2015). Obama seeks $14 billion to boost u.s. cybersecurity defenses.

19.

Sobers

(2020). 107 must-know data breach statistics for 2020. Retrieved from https://www.varonis.com/blog/data-breach-statistics/

20.

Spadafora

(2019, May 8). 90 percent of data breaches are caused by human error. Retrieved from https://www.techradar.com/news/90-percent-of-data-breaches-are-caused-by-human-error

21.

Tversky

Kahneman

(1974). Judgment under uncertainty: Heuristics and biases. Science (American Association for the Advancement of Science), 185(4157), 1124-1131.

22.

Wang

Herath

Chen

Vishwanath

Rao

H. R.

(2012). Research article phishing susceptibility: An investigation into the processing of a targeted spear phishing email. IEEE transactions on professional communication, 55(4), 345-362.

23.

Wickens

C. D.

Hollands

J. G.

Banbury

Parasuraman

(2013). Engineering psychology and human performance (4th ed.). Pearson.