School of phish

Citations Over TimeTop 1% of 2009 papers

Abstract

PhishGuru is an embedded training system that teaches users to avoid falling for phishing attacks by delivering a training message when the user clicks on the URL in a simulated phishing email. In previous lab and real-world experiments, we validated the effectiveness of this approach. Here, we extend our previous work with a 515-participant, real-world study in which we focus on long-term retention and the effect of two training messages. We also investigate demographic factors that influence training and general phishing susceptibility. Results of this study show that (1) users trained with PhishGuru retain knowledge even after 28 days; (2) adding a second training message to reinforce the original training decreases the likelihood of people giving information to phishing websites; and (3) training does not decrease users' willingness to click on links in legitimate messages. We found no significant difference between males and females in the tendency to fall for phishing emails both before and after the training. We found that participants in the 18--25 age group were consistently more vulnerable to phishing attacks on all days of the study than older participants. Finally, our exit survey results indicate that most participants enjoyed receiving training during their normal use of email.

Related Papers

• → Inside a phisher's mind: Understanding the anti-phishing ecosystem through phishing kit analysis(2018)110 cited
• → A novel Phishing classification based on URL features(2011)35 cited
• → Analysis of phishing attacks against students(2016)14 cited
• → Unveiling the Anatomy of Phishing Attacks: Strategies, Targets, and Cybersecurity Solutions(2023)1 cited
• → Investigation of Phishing Attacks and Means to Utilize Anti Phishing Techniques(2019)2 cited