Feelings of phishied: detection of the effects of phishing emails on human emotions via face reader and eye tracker

Abstract

Phishing is a major type of cyberattack threatening individuals, corporations, and critical infrastructure. These attacks are designed to trick users for monetary incentives and become severe in the form of spear phishing outbreaks which target specific individuals with information known to be of interest to them. Spear-phishing is an attack that uses malicious emails in order to steal sensitive information such as login credentials and/or to infect the targets’ device with malware. Prior phishing research has informed effective practical interventions to address the users’ phishing susceptibilities and raised security awareness through surveys and interviews. The present study will add quantitative data to the literature by conducting experiments in which user behavior is tracked using face-reader and eye-tracker technologies in order to analyze human behavioral and emotional responses. In the experiments, ten different emails were provided to the participants, and two tracking devices recorded the participant’s actions objectively. A Difference-in-Difference approach was used to analyze participants’ responses before and after receiving phishing emails. This study also demonstrates that face-reading and eye-tracking technologies are feasible tools with which to identify and record how phishing emails are processed visually by individuals, which may contribute to the design of security awareness and training materials.