心理因素与技术在不同类型社会工程中的影响分析
An Analysis of the Impact of Psychological Factors and Techniques Across Different Types of Social Engineering
浏览论文内容
中文总结 AI 辅助
该研究通过含12名参与者的实验室研究，分析不同社会工程攻击类型与心理因素的组合效果，发现鱼叉式钓鱼对权威、信任、贪婪最有效，贪婪与鱼叉式钓鱼的组合最成功，三类组合完全无效。
中文摘要 AI 辅助
钓鱼（Phishing）是一种广为人知的社会工程（Social Engineering，SE）类型，用于诱骗个人泄露个人信息或执行期望的操作，例如下载并安装恶意软件。其他社会工程类型，如语音钓鱼（vishing）和短信钓鱼（smishing）也已出现并被越来越多地使用。由于社会工程持续成功地说服受害者采取行动，出现了以下问题：对于特定的心理因素（Psychological Factors，PFs），哪种社会工程攻击类型最有效；反之，对于特定的攻击类型，哪种心理因素最有效。为回答这些问题，我们开展了一项实验室研究，共有n=12名参与者，每位参与者都观看了全部25个刺激项（5种心理因素和5种社会工程类型）。这项探索性研究的结果显示，针对权威、信任和贪婪这三种心理因素，最有效的社会工程攻击类型是鱼叉式钓鱼（spear-phishing）。最成功的心理因素与攻击类型组合是采用贪婪心理因素的鱼叉式钓鱼。最不成功的组合是采用权威心理因素的弹窗（pop-ups）、采用权威心理因素的短信钓鱼以及采用好奇心理因素的语音钓鱼，这三种组合均完全未取得成功。
英文摘要
Phishing is a well-known social engineering (SE) type used to trick individuals into revealing personal information or performing desired actions, like downloading and installing malware. Other SE types, like vishing and smishing, have emerged and are increasingly being used. As SE continues to successfully persuade victims into actions, the questions arise of which SE attack types are most effective for specific psychological factors (PFs) and, conversely, which PFs are most effective for particular attack types. To answer these questions, we conducted a laboratory study with n=12 participants, in which each participant was shown all 25 stimuli (five PFs and five SE types). The results of this exploratory study show that the most effective SE attack type for authority, trust, and greed was spear-phishing. The most successful combination of PF and attack type was spear-phishing using greed. The least successful combinations were pop-ups using authority, smishing using authority, and vishing using curiosity, each having had no success at all.
