Академический Документы
Профессиональный Документы
Культура Документы
ABSTRACT
In this paper we describe the design and evaluation of AntiPhishing Phil, an online game that teaches users good habits to
help them avoid phishing attacks. We used learning science
principles to design and iteratively refine the game. We evaluated
the game through a user study: participants were tested on their
ability to identify fraudulent web sites before and after spending
15 minutes engaged in one of three anti-phishing training
activities (playing the game, reading an anti-phishing tutorial we
created based on the game, or reading existing online training
materials). We found that the participants who played the game
were better able to identify fraudulent web sites compared to the
participants in other conditions. We attribute these effects to both
the content of the training messages presented in the game as well
as the presentation of these materials in an interactive game
format. Our results confirm that games can be an effective way of
educating people about phishing and other security attacks.
General Terms
Design, experimentation, security, human factors
Keywords
Phishing, usable privacy and security, interactive learning,
learning science, security user education, and game design,
development and testing
1. INTRODUCTION
Phishing is a kind of attack in which criminals use spoofed emails
and fraudulent web sites to trick people into giving up personal
information. Victims perceive these emails as associated with a
trusted brand, while in reality they are the work of con artists
interested in identity theft [18]. These increasingly sophisticated
attacks not only spoof email and web sites, but they can also spoof
parts of a users web browser [17].
Symposium On Usable Privacy and Security (SOUPS) 2007, July 1820, 2007, Pittsburgh, PA, USA.
88
89
the end of the study, users are given materials that inform them
about phishing attacks. This approach has been used in studies
involving Indiana University students [16], West Point cadets
[12], and New York State employees [30]. In the New York State
study, employees who were sent the simulated phishing emails
and follow-up notification were better able to avoid subsequent
phishing attacks than those who were given a pamphlet containing
information on how to combat phishing.
brand name in a search engine and see whether the link that
appears in the top search results is the same as a potentially
suspicious link received in an email. By far, the top search engine
results are legitimate web sites [40].
To achieve the above-mentioned objectives, we applied several
learning science principles to the game design. Learning sciences
theory suggests that training will be effective if the training
methodology is goal-oriented, challenging, contextual, and
interactive [31]. In goal-oriented training, learners have a specific
goal to achieve and in the process of achieving the goal they are
challenged and trained. Training is most effective if the materials
are presented in a context users can relate to, and if the materials
are presented in an interactive form. There also exists a large body
of literature on the effectiveness of games for interactively
teaching conceptual and procedural knowledge [13]. Conceptual
knowledge is knowledge about concepts or relationships that can
be expressed as propositions (e.g., URLs have a protocol part and
a domain name part). In contrast, procedural knowledge (also
referred as declarative knowledge) is the step-by-step knowledge
that one uses to solve a given problem (e.g., check the URL in the
address bar, and if it contains an IP addresses, you are likely
visiting a phishing site) [2]. The Anti-Phishing Phil game conveys
both conceptual and procedural knowledge. Research in learning
science has established that interactive environments, in particular
games, are one of the most effective training methods and are
highly motivational for users, especially when they adhere to
design principles for educational games [13], [31], [32]. We
applied three learning science principles to the design of the AntiPhishing Phil game: reflection, story-based agent, and
conceptualprocedural.
In this section, we present the objectives for the game and the
learning science principles that we applied in implementing these
objectives.
90
Phil Eats
Phil Rejects
Good worm
Phishing worm
There are four rounds in the game, each one harder than the
previous and focusing on a different type of deceptive URL. Table
1 shows the focus of each round. Our implementation selects eight
URLs from a pool of twenty for each round, including 12 URLs
consistent with the rounds focus. The eight URLs illustrate
concepts from other rounds to maintain continuity between
rounds.
3.2.1 Story
The main character of the game is Phil, a young fish living in the
Interweb Bay. Phil wants to eat worms so he can grow up to be a
big fish, but has to be careful of phishers that try to trick him with
fake worms (representing phishing attacks). Each worm is
associated with a URL, and Phils job is to eat all the real worms
(which have URLs of legitimate web sites) and reject all the bait
(which have phishing URLs) before running out of time. The
other character is Phils father, who is an experienced fish in the
sea. He occasionally helps Phil out by giving Phil some tips on
how to identify bad worms (and hence, phishing web sites).
3.2.2 Mechanics
The game is split into four rounds, each of which is two minutes
long. In each round, Phil is presented with eight worms, each of
which carries a URL that is shown when Phil moves near it (see
Figure 1). The player uses a mouse to move Phil around the
screen. The player uses designated keys to eat the real worms
3.2.3 Technology
and reject the bait. Phil is rewarded with 100 points if he
The game is implemented in Flash 8. The content for the game,
correctly eats a good worm or correctly rejects a bad one. He is
including URLs and training messages, are loaded from a separate
slightly penalized for rejecting a good worm (false positive) by
Table 1: Focus of each round of the game with examples
Bumper Sticker Message
Round# Focus
Examples
1
IP address
URLS
Sub domain
URLs
Similar and
deceptive
domains
All previous
methods
together
91
data file at the start of the game. This provides us with a great deal
of flexibility and makes it easy to quickly update the content. In
each round of the game, four good worms and four phishing
worms are randomly selected from the twenty URLs in the data
file for that round. We also use sound and graphics to engage the
user better. This includes sound effects to provide feedback on
actions, background music, and underwater background scenes.
92
Figure 3: Flow of the game: from left to right: the general lessons, the game, and the score. In the game section users played the
game and learned about the URL. In the score sheet, they got reflect on what they learned, finally the messages teach further tips.
seemed to understand that URLs that have all numbers in the front
are usually a sign of scam. However, many users could not
properly parse a long URL and did not seem to understand that
the most important part of the URL is the right hand side of the
domain
name.
This
led
them
to
mis-identify
wellsfargo.com.wfcnet.net as a legitimate site and scgi.ebay.com
and onlineast1.bankofamerica.com as phishing sites.
Table 3: List of training messages in between rounds; these information helped users to perform better and connect these
information with the information presented when they were playing the game
# of
printed
pages
1
Concepts
- Highlight and point to the address bar in the
browser.
- Highlight the different parts of the URL (Prefix,
address and file name).
93
How to do it?
4. EVALUATION METHODOLOGY
In this section, we describe the methodology we used to test the
game for its effectiveness in training users.
High School
College Undergrad
College graduate
Post. Graduate school
Years on the Internet
3- 5 years
6-10 years
> 11 years
94
Tutorial
Group
Game
Group
29%
71%
36%
64%
50%
50%
93%
7%
100%
0%
100%
0%
14%
50%
14%
21%
7%
78%
7%
7%
7%
50%
21%
21%
23%
69%
8%
23%
70%
7%
14%
78%
7%
pre test
0.5
0.4
0.43
post test
0.38
0.34
0.3
0.19
0.2
0.17
0.12
0.1
0
Existing training
materials
Tutorial
Game
5. RESULTS
In this section, we present the results from the user study. We
found that participants in the game condition performed better
than the other two conditions in correctly identifying the web
sites. We also found that there was no significant difference in
false negatives among the three groups. However, the participants
in the game group performed better overall than the other two
groups.
pre test
0.5
post test
0.41
0.4
0.30
0.30
0.27
0.3
0.21
0.2
0.14
0.1
0
Existing training
material
Tutorial
Game
Total Correctness
1
pre test
0.9
0.8
0.7
0.87
post test
0.80
0.74
0.66
0.65
0.69
0.6
0.5
Existing training
material
Tutorial
Game
materials condition, the false negative rate fell from 0.38 to 0.12
(paired t-test: 1=0.38, 2=0.12, p = 0.01); for the tutorial
condition, it changed from 0.43 to 0.19 (paired t-test: 1=0.43,
2=0.19, p < 0.03); for the game condition, it changed from 0.34
to 0.17 (paired t-test: 1=0.34, 2=0.17, p <0.02). There is no
statistical difference between the three groups in either the pre test
(oneway ANOVA, F(2,41)=0.52, p=0.60), or post test (oneway
95
significant way.
The average user confidence rating in the game condition
increased from 3.72 (variance = 0.09) to 4.42 (variance = 0.10).
This change is statistical significant (paired t test, p < 0.001). In
contrast, user confidence in the existing training material
condition did not improve in a statistically significant way: the
average confidence rating was 4.18 pre test (variance = 0.18) and
4.32 post test (variance = 0.15).
Description
Pre Game
% Correct
(average
confidence)
Post Game
%correct
(average
confidence)
Real
83
(4.6)
100
(4.7)
Bank of
America
Real
66
(3.5)
100
(4.3)
Wellsfargo
bank
Spoof
83
(3.6)
87
(4.5)
Citibank
Barclays
AOL
Etrade
Real
Spoof
Spoof
Real
83
83
100
100
(3.6)
(4.2)
(3.3)
(4.0)
75
100
75
100
(4.5)
(4.7)
(3.4)
(4.3)
PNC Bank
Spoof
Bank account update; pop-up window over the real PNC Bank web site;
security lock; requesting credit card number
66
(4.0)
50
(5.0)
eBay
Halifax Bank
Real
Spoof
66
83
(4.2)
(2.8)
62
100
(4.0)
(4.5)
Card Financials
Online
Real
50
(3.5)
66
(4.5)
Citicards
Spoof
50
(4.0)
100
(4.6)
Chase online
Desjardins
Royal Bank of
Canada
Real
Real
100 (4.2)
50 (3.0)
100
83
(4.1)
(3.8)
37
(4.0)
100
(4.1)
Chase Student
Real
37
(3.0)
66
(3.7)
HSBC
US Bank
eBay
Spoof
Real
Spoof
50
75
75
(4.0)
(3.5)
(3.8)
100
100
100
(5.0)
(4.6)
(5.0)
PayPal
Spoof
50
(3.2)
(4.0)
Website
Real /
Spoof
Paypal
Spoof
96
Criterion (C)
Pre
test
Post
test
Delta
Pre
test
Post
test
Delta
Existing
training
materials
0.81
1.43
0.62
0.03
-0.51
-0.54
Antiphishing
Phil
0.93
*
2.02
1.09
**
0.06
**
* p <0.05, ** p < 0.025
97
0.06
8. ACKNOWLEDGMENTS
This work was supported in part by National Science Foundation
under grant CCF-0524189, and by the Army Research Office
grant number DAAD19-02-1-0389. The authors would like to
thank all members of the Supporting Trust Decisions project for
their feedback. The authors would also like to thank Chiapi Chao,
and Kursat Ozenc for their feedback throughout the game
development process, and Bing Wu for first suggesting the idea of
signal detection analysis.
9. REFERENCES
98
99