arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2310.03498cs.CR

欺骗的剖析:大规模钓鱼活动的技术视角与人文视角

The Anatomy of Deception: Technical and Human Perspectives on a Large-scale Phishing Campaign

Anargyros Chrysanthou, Yorgos Pantis, Constantinos Patsakis

AI总结:

本研究针对Meta用户的大规模钓鱼活动,结合超25000名全球受害者的真实活跃钓鱼数据,用NLP与ML技术从技术和人文双视角剖析攻击策略与受害者特征,揭示了密码习惯、反复受害及多维度关联等关键洞见。

摘要:

在数字交互主导的时代,钓鱼活动已演变为不仅利用技术漏洞,还利用人性弱点的攻击手段。本研究以前所未有的深度剖析了针对Meta用户的大规模钓鱼活动,从技术机制和人为因素双重视角展开分析。通过分析全球超过25000名受害者的数据,我们揭示了这类钓鱼活动的细微差异,涵盖攻击者采用的复杂技术,以及目标人群的情绪与行为特征。与此前在受控环境中开展的研究不同,本研究利用了直接从活跃钓鱼活动中提取的海量、多样且真实的数据,得以更全面地理解钓鱼活动的驱动因素、促成条件及人为因素。通过应用包括自然语言处理和机器学习在内的先进计算技术,本研究揭示了关于受害者心理及现代钓鱼者不断演变的攻击策略的关键洞见。我们的分析显示,受害者的密码选择习惯极差,同时很大一部分用户会反复遭遇钓鱼攻击。最后,我们还发现了受害者的人口统计学特征、响应时间、情绪、情感及语气之间的诸多关联。

英文摘要:

In an era dominated by digital interactions, phishing campaigns have evolved to exploit not just technological vulnerabilities but also human traits. This study takes an unprecedented deep dive into large-scale phishing campaigns aimed at Meta's users, offering a dual perspective on the technical mechanics and human elements involved. Analysing data from over 25,000 victims worldwide, we highlight the nuances of these campaigns, from the intricate techniques deployed by the attackers to the sentiments and behaviours of those who were targeted. Unlike prior research conducted in controlled environments, this investigation capitalises on the vast, diverse, and genuine data extracted directly from active phishing campaigns, allowing for a more holistic understanding of the drivers, facilitators, and human factors. Through the application of advanced computational techniques, including natural language processing and machine learning, this work unveils critical insights into the psyche of victims and the evolving tactics of modern phishers. Our analysis illustrates very poor password selection choices from the victims but also persistence in the revictimisation of a significant part of the users. Finally, we reveal many correlations regarding demographics, timing, sentiment, emotion, and tone of the victims' responses.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑