Understanding Security Behavior of Real Users: Analysis of a Phishing Study

Kang, Mingqing
Shonman, Matthew
Subramanya, Anshul
Zhang, Haoruo
Li, Xiangyang
Dahbura, Anton
Journal Title
Journal ISSN
Volume Title
This paper presents a set of statistical analyses on an empirical study of phishing email sorting by real online users. Participants were assigned to multitasking and/or incentive conditions in unattended web-based tasks that are the most realistic in any comparable study to date. Our three stages of analyses included logistic regression models to identify individual phishing “cues” contributing to successful classifications, statistical significance tests assessing the links between participants’ training experience and self-assessments of success to their actual performance, significance tests searching for significant demographic factors influencing task completion performance, and lastly k-means clustering based on a range of performance measures and utilizing participants’ demographic attributes. In particular, the results indicate that multitasking and incentives create complex dynamics while demographic traits and cybersecurity training can be informative predictors of user security behavior. These findings strongly support the benefits of security training and education and advocate for customized and differentiated interventions to increase users’ success of correctly identifying phishing emails.
Security and Privacy Aspects of Human-Computer-Interactions, demographic analysis, empirical study, phishing, security, user behavior
Access Rights
Email libraryada-l@lists.hawaii.edu if you need this content in ADA-compliant format.