The Effects of Email Illegitimacy and Phishing Behavior Training on Eye Movement Behavior in Spear Phishing Detection

Abstract

Email phishing, such as spear phishing attacks, has become increasingly sophisticated. Automatic phishing detection models and anti-phishing education and awareness programs remain insufficient in guarding against general phishing attacks, which are even more ineffective in dealing with spear phishing. Understanding human receivers’ interaction behavior with phishing emails can be instrumental in improving the effectiveness of anti-phishing training and human phishing detection. To this end, eye movement behavior can serve as a lens reflecting human cognitive processes and attention. This study focuses on examining the effects of email legitimacy and phishing behavior training on receivers’ eye movement behavior by analyzing their eye-tracking data. The findings have implications for developing spear phishing training programs and improving phishing detection models that can improve online safety of human users.