Avoiding the hook : influential factors of phishing awareness training on click-rates and a data-driven approach to predict email difficulty perception

Sutter, Thomas; Bozkir, Ahmet Selman; Gehring, Benjamin; Berlich, Peter

doi:10.1109/ACCESS.2022.3207272

Please use this identifier to cite or link to this item: https://doi.org/10.21256/zhaw-26525

Publication type:	Article in scientific journal
Type of review:	Peer review (publication)
Title:	Avoiding the hook : influential factors of phishing awareness training on click-rates and a data-driven approach to predict email difficulty perception
Authors:	Sutter, Thomas Bozkir, Ahmet Selman Gehring, Benjamin Berlich, Peter
et. al:	No
DOI:	10.1109/ACCESS.2022.3207272 10.21256/zhaw-26525
Published in:	IEEE Access
Volume(Issue):	10
Page(s):	100540
Pages to:	100565
Issue Date:	16-Sep-2022
Publisher / Ed. Institution:	IEEE
ISSN:	2169-3536
Language:	English
Subjects:	Machine learning; Phishing; Phishing awareness; Human factor; Predictive model; Information security; Human computer interaction; Difficulty estimation
Subject (DDC):	005: Computer programming, programs and data 150: Psychology
Abstract:	Phishing attacks are still seen as a significant threat to cyber security, and large parts of the industry rely on anti-phishing simulations to minimize the risk imposed by such attacks. This study conducted a large-scale anti-phishing training with more than 31000 participants and 144 different simulated phishing attacks to develop a data-driven model to classify how users would perceive a phishing simulation. Furthermore, we analyze the results of our large-scale anti-phishing training and give novel insights into users’ click behavior. Analyzing our anti-phishing training data, we find out that 66% of users do not fall victim to credential-based phishing attacks even after being exposed to twelve weeks of phishing simulations. To further enhance the phishing awareness-training effectiveness, we developed a novel manifold learning-powered machine learning model that can predict how many people would fall for a phishing simulation using the several structural and state-of-the-art NLP features extracted from the emails. In this way, we present a systematic approach for the training implementers to estimate the average “convincing power” of the emails prior to rolling out. Moreover, we revealed the top-most vital factors in the classification. In addition, our model presents significant benefits over traditional rule-based approaches in classifying the difficulty of phishing simulations. Our results clearly show that anti-phishing training should focus on the training of individual users rather than on large user groups. Additionally, we present a promising generic machine learning model for predicting phishing susceptibility.
URI:	https://digitalcollection.zhaw.ch/handle/11475/26525
Fulltext version:	Published version
License (according to publishing contract):	CC BY-NC-ND 4.0: Attribution - Non commercial - No derivatives 4.0 International
Departement:	School of Engineering
Organisational Unit:	Institute of Computer Science (InIT)
Published as part of the ZHAW project:	OptiPhish – Effective and Measurable Phishing Awareness Training
Appears in collections:	Publikationen School of Engineering

Files in This Item:

File	Description	Size	Format
2022_Sutter-etal_Influential-factors-of-Phishing-awareness-training.pdf		4.28 MB	Adobe PDF	View/Open

Show full item record

Sutter, T., Bozkir, A. S., Gehring, B., & Berlich, P. (2022). Avoiding the hook : influential factors of phishing awareness training on click-rates and a data-driven approach to predict email difficulty perception. IEEE Access, 10, 100540–100565. https://doi.org/10.1109/ACCESS.2022.3207272

Sutter, T. et al. (2022) ‘Avoiding the hook : influential factors of phishing awareness training on click-rates and a data-driven approach to predict email difficulty perception’, IEEE Access, 10, pp. 100540–100565. Available at: https://doi.org/10.1109/ACCESS.2022.3207272.

T. Sutter, A. S. Bozkir, B. Gehring, and P. Berlich, “Avoiding the hook : influential factors of phishing awareness training on click-rates and a data-driven approach to predict email difficulty perception,” IEEE Access, vol. 10, pp. 100540–100565, Sep. 2022, doi: 10.1109/ACCESS.2022.3207272.

SUTTER, Thomas, Ahmet Selman BOZKIR, Benjamin GEHRING und Peter BERLICH, 2022. Avoiding the hook : influential factors of phishing awareness training on click-rates and a data-driven approach to predict email difficulty perception. IEEE Access. 16 September 2022. Bd. 10, S. 100540–100565. DOI 10.1109/ACCESS.2022.3207272

Sutter, Thomas, Ahmet Selman Bozkir, Benjamin Gehring, and Peter Berlich. 2022. “Avoiding the Hook : Influential Factors of Phishing Awareness Training on Click-Rates and a Data-Driven Approach to Predict Email Difficulty Perception.” IEEE Access 10 (September): 100540–65. https://doi.org/10.1109/ACCESS.2022.3207272.

Sutter, Thomas, et al. “Avoiding the Hook : Influential Factors of Phishing Awareness Training on Click-Rates and a Data-Driven Approach to Predict Email Difficulty Perception.” IEEE Access, vol. 10, Sept. 2022, pp. 100540–65, https://doi.org/10.1109/ACCESS.2022.3207272.