Understanding Phishing Email Processing and Perceived Trustworthiness Through Eye Tracking

Abstract

Social engineering attacks in the form of phishing emails represent one of the biggest risks to cybersecurity. There is a lack of research on how the common elements of phishing emails, such as the presence of misspellings and the use of urgency and threatening language, influences how the email is processed and judged by individuals. Eye tracking technology may provide insight into this. In this exploratory study a sample of 22 participants viewed a series of emails with or without indicators associated with phishing emails, whilst their eye movements were recorded using a SMI RED 500 eyetracker. Participants were also asked to give a numerical rating of how trustworthy they deemed each email to be. Overall, it was found that participants looked more frequently at the indicators associated with phishing than would be expected by chance but spent less overall time viewing these elements than would be expected by chance. The emails that included indicators associated with phishing were rated as less trustworthy on average, with the presence of misspellings or threatening language being associated with the lowest trustworthiness ratings. In addition, it was noted that phishing indicators relating to threatening language or urgency were viewed before misspellings. However, there was no significant interaction between the trustworthiness ratings of the emails and the amount of scanning time for phishing indicators within the emails. These results suggest that there is a complex relationship between the presence of indicators associated with phishing within an email and how trustworthy that email is judged to be. This study also demonstrates that eye tracking technology is a feasible method with which to identify and record how phishing emails are processed visually by individuals, which may contribute toward the design of future mitigation approaches.

Influence of Human Factors on Cyber Security within Healthcare Organisations: A Systematic Review

“…In RQ1, we identified the nature of cybersecurity attacks being experienced by healthcare organisations, and the articles selected in the review received higher rankings than the papers with a lower ranking. This is due to the fact that several articles reported studies on the impact of ransomware (e.g., WannaCry) [ 20 , 32 , 42 , 43 ] and phishing attacks [ 9 , 10 , 13 , 14 , 15 , 41 , 44 , 45 , 46 , 47 ], to name a few being launched against healthcare organisations.…”

ADVERT: An Adaptive and Data-Driven Attention Enhancement Mechanism for Phishing Prevention

“…In particular, researches have investigated the users' gaze behaviors and attention when reading Uniform Resource Locators (URLs) [3], phishing webs [15], and phishing email [16]- [18]. These works illustrate the users' visual processing of phishing contents [3], [15], [17], [19] and the effects of visual aids [18]. The authors in [15] further establish correlations between eye movements and phishing identification to estimate the likelihood that users may fall victim to phishing attacks.…”

“…Therefore, we need to compress the sensory outcomes and remove the information that hardly contributes to attention evaluation and phishing recognition. Previous works [3], [15], [17] have identified the role of Areas of Interest (AoIs) in helping human users recognize phishing. Thus, we aggregate the potential gaze locations (i.e., pixels of the email area) into a finite number of I AoIs that include the email address, the subject line, the addressee, attachments, hyperlinks, and the phishing indicators such as misspellings and grammar mistakes.…”

“…Previous works, e.g., [17], [19], have defined attention metrics based on the AoIs, e.g., the proportion of time spent on each AOI, gaze duration means, fixation count, and average duration. Compared to these low-level metrics extracted directly from eye-gaze data, we propose systemlevel attention metrics based on the sufficient statistics, e.g., v k (t), of the eye-gaze data [s t ] t∈[0,T ] , which preserve the user privacy.…”

A Deep Learning-Based Approach to Video-Based Eye Tracking for Human Psychophysics

“…Tracking the point of gaze as a window to the internal state of the human mind is a key requirement in cognitive tasks, where it is important to control the attention of human subjects. This application has been the focus of classic studies ( Yarbus, 1967 ), and more recently, the approach has been used not only as a clinical tool to detect neurological and neuropsychiatric disorders by studying the patients’ gaze patterns ( Adhikari and Stark, 2017 ), but also has been shown to be useful in every-day applications, such as analyzing the trustworthiness of phishing emails ( McAlaney and Hills, 2020 ). While there are different existing technologies to eye tracking on the market, an affordable and practical technology is still missing, limiting the use of this technique to a broader audience.…”