Age and gender as independent risk factors for malware victimisation

This paper presents the results of an empirical study we designed to investigate the independent effect of age and gender as potential risk factors for malware victimisation. Using data collected from Microsoft’s Windows Defender on a sample of three million devices running Windows 10, we found that both age and gender are contributing factors for malware victimisation. Men, and young men in particular, were more likely to encounter malware than women, and younger users were more at risk of encountering malware than their older counterparts. However, our findings suggest that the effect of age and gender is not constant across different types of malware. We also discuss potential causes and implications of these age and gender differences in malware victimisation.

Content

Author and article information

Contributors

Fanny Lalonde Lévesque: URI : www.polymtl.ca

José M. Fernandez: URI : www.polymtl.ca

Dennis Batchelder: URI : www.appesteem.com

Conference

Publication date: July 2017

Publication date (Print): July 2017

Pages: 1-14

Affiliations

[0001]École Polytechnique de Montréal

[0002]AppEsteem Corporation

Article

DOI: 10.14236/ewic/HCI2017.48

SO-VID: 015cc81e-3850-4d1e-b892-7d214ae4a638

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: Electronic Visualisation and the Arts (EVA 2017)

Conference acronym: EVA

Conference number:

Conference location: London, UK

Conference date: 11 – 13 July 2017

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Electronic Visualisation and the Arts

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/HCI2017.48

Self URI (journal page): https://ewic.bcs.org/

references

C. AntheP. Chrzan 2015 Microsoft Security Intelligence Report January-June 2015
A. Bieberstein 2013 An Investigation of Women’s and Men ’s Perceptions and Meanings Associated with Food Risks. Springer Science & Business Media
A. M. BosslerT. J. Holt 2009 On-line activities, guardianship, and malware infection: An examination of routine activities theory International Journal of Cyber Criminology 3 1 400
J. P. ByrnesD. C. MillerW. D. Schafer 1999 Gender differences in risk taking: A meta-analysis Psychological bulletin 125 3 367
D. CanaliL. BilgeD. Balzarotti 2014 On the effectiveness of risk prediction based on users browsing behavior Proceedings of the 9th ACM symposium on Information, computer and communications security 171 182 ACM
Y. CarlinetL. MéH. DébarY. Gourhant 2008 Analysis of computer infection risk factors based on customer network usage Second International Conference on Emerging Security Information, Systems and Technologies (SECURWARE’08) 317 325
T. DohmenA. FalkD. HuffmanU. SundeJ. SchuppG. G. Wagner 2011 Individual risk attitudes: Measurement, determinants, and behavioral consequences Journal of the European Economic Association 9 3 522 550
T. J. DohmenA. FalkD. HuffmanU. SundeJ. SchuppG. G. Wagner 2005 Individual risk attitudes: New evidence from a large, representative, experimentally-validated survey Social Science Research Network
S. EgelmanE. Peer 2015 The myth of the average user: Improving privacy and security systems through individualization Proceedings of the 2015 New Security Paradigms Workshop 16 28 ACM
C. EmondW. TangS. Handy 2009 Explaining gender difference in bicycling behavior Transportation Research Record: Journal of the Transportation Research Board 2125 16 25
B. FignerR. J. MackinlayF. WilkeningE. U. Weber 2009 Affective and deliberative processes in risky choice: age differences in risk taking in the columbia card task Journal of Experimental Psychology: Learning, Memory, and Cognition 35 3 709
S. GoelJ. M. HofmanM. I. Sirer 2012 Who does what on the web: A large-scale study of browsing behavior ICWSM.
G. A. GrimesM. G. HoughM. L. Signorella 2007 Email end users and spam: relations of gender and age group to attitudes and actions Computers in Human Behavior 23 1 318 332
C. R. HarrisM. JenkinsD. Glaser 2006 Gender differences in risk assessment: why do women take fewer risks than men? Judgment and Decision Making 1 1 48.
R. M. HogarthM. PortellA. Cuxart 2007 What risks do people perceive in everyday life? A perspective gained from the experience sampling method (esm) Risk Analysis 27 6 1427 1439
J. HuH.-J. ZengH. LiC. NiuZ. Chen 2007 Demographic prediction based on user's browsing behavior Proceedings of the 16th international conference on World Wide Web 151 160 ACM
T. N. JagaticN. A. JohnsonM. JakobssonF. Menczer 2007 Social phishing Communications of the ACM 50 10 94 100
J. JohnsonA. WilkeE. U. Weber 2004 Beyond a trait view of risk taking: A domain-specific scale measuring risk perceptions, expected benefits, and perceived-risk attitudes in german-speaking populations Polish Psychological Bulletin 35 153 172
R. JoinerJ. GavinM. BrosnanJ. CrombyH. GregoryJ. GuillerP. MarasA. Moon 2012 Gender, internet experience, internet identification, and internet anxiety: a ten-year followup Cyberpsychology, Behavior, and Social Networking 15 7 370 372
P. KumaraguruJ. CranshawA. AcquistiL. CranorJ. HongM. A. BlairT. Pham 2009 School of phish: a real-world evaluation of anti-phishing training Proceedings of the 5th Symposium on Usable Privacy and Security, 3 ACM
Lalonde LévesqueJ. M. FernandezA. Somayaji 2014 Risk prediction of malware victimization based on user behavior Malicious and Unwanted Software: The Americas (MALWARE), 2014 9th International Conference on, 128 134 IEEE
Lalonde LévesqueJ. NsiempbaJ. M. FernandezS. ChiassonA. Somayaji 2013 A clinical study of risk factors related to malware infections Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security 97 108 ACM
Lalonde LévesqueJ. M. FernandezD. BatchelderG. Young 2016 October Are they real? Real-life comparative tests of anti-virus products 26th Virus Bulletin International Conference 25 33
M. Mather 2006 A review of decision-making processes: Weighing the risks and benefits of aging When I’m 64 145 145 173
N. P. P. MavrommatisM. A. R. F. Monrose 2008 All your iframes point to us USENIX Security Symposium 1 16
Microsoft 2017 Microsoft Privacy Statement https://privacy.microsoft.com/en-gb/privacystatement
F. T. NgoR. Paternoster 2011 Cybercrime victimization: An examination of individual and situational level factors International Journal of Cyber Criminology 5 1 773 793
D. OliveiraH. RochaH. YangD. EllisS. DommarajuM. MuradogluD. WeirA. SolimanT. LinN. Ebner 2017 Dissecting spear phishing emails for older vs young adults: On the interplay of weapons of influence and life domains in predicting susceptibility to phishing Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems 6412 6424 ACM
N. ProvosD. McNameeP. MavrommatisK. WangN. Modadugu et al 2007 The ghost in the browser: Analysis of web-based malware HotBots 7 4 4
B. W. Reyns 2013 Online routines and identity theft victimization further expanding routine activity theory beyond direct-contact offenses Journal of Research in Crime and Delinquency 50 2 216 238
J. J. RolisonY. HanochS. WoodP.-J. Liu 2013 Risk-taking differences across the adult life span: a question of age and domain The Journals of Gerontology Series B: Psychological Sciences and Social Sciences, gbt081
S. ShengM. HolbrookP. KumaraguruL. F. CranorJ. Downs 2010 Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions ACM Conference on Human Factors in Computing Systems (CHI) 373 382
A. K. SoodR. J. Enbody 2011 Malvertising-exploiting web advertising Computer Fraud & Security 2011 4 11 16
T. S. Teo 2001 Demographic and motivation variables associated with internet usage activities Internet Research 11 2 125 137
M. WangC. KellerM. Siegrist 2011 The less you know, the more you are afraid of? A survey on risk perceptions of investment products Journal of Behavioral Finance 12 1 9 19
E. U. WeberA.-R. BlaisN. E. Betz 2002 A domain-specific risk-attitude scale: Measuring risk perceptions and risk behaviors Journal of behavioral decision making 15 4 263 290
X. XingW. MengB. LeeU. WeinsbergA. ShethR. PerdisciW. Lee 2015 Understanding malvertising through ad-injecting browser extensions Proceedings of the 24th International Conference on World Wide Web 1286 1295 International World Wide Web Conferences Steering Committee
T.-F. YenV. HeorhiadiA. OpreaM. K. ReiterA. Juels 2014 An epidemiological study of malware encounters in a large enterprise Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 1117 1130 ACM

Comments

Comment on this article

[1] C. AntheP. Chrzan 2015 Microsoft Security Intelligence Report January-June 2015

[2] A. Bieberstein 2013 An Investigation of Women’s and Men ’s Perceptions and Meanings Associated with Food Risks. Springer Science & Business Media

[3] A. M. BosslerT. J. Holt 2009 On-line activities, guardianship, and malware infection: An examination of routine activities theory International Journal of Cyber Criminology 3 1 400

[4] J. P. ByrnesD. C. MillerW. D. Schafer 1999 Gender differences in risk taking: A meta-analysis Psychological bulletin 125 3 367

[5] D. CanaliL. BilgeD. Balzarotti 2014 On the effectiveness of risk prediction based on users browsing behavior Proceedings of the 9th ACM symposium on Information, computer and communications security 171 182 ACM

[6] Y. CarlinetL. MéH. DébarY. Gourhant 2008 Analysis of computer infection risk factors based on customer network usage Second International Conference on Emerging Security Information, Systems and Technologies (SECURWARE’08) 317 325

[7] T. DohmenA. FalkD. HuffmanU. SundeJ. SchuppG. G. Wagner 2011 Individual risk attitudes: Measurement, determinants, and behavioral consequences Journal of the European Economic Association 9 3 522 550

[8] T. J. DohmenA. FalkD. HuffmanU. SundeJ. SchuppG. G. Wagner 2005 Individual risk attitudes: New evidence from a large, representative, experimentally-validated survey Social Science Research Network

[9] S. EgelmanE. Peer 2015 The myth of the average user: Improving privacy and security systems through individualization Proceedings of the 2015 New Security Paradigms Workshop 16 28 ACM

[10] C. EmondW. TangS. Handy 2009 Explaining gender difference in bicycling behavior Transportation Research Record: Journal of the Transportation Research Board 2125 16 25

[11] B. FignerR. J. MackinlayF. WilkeningE. U. Weber 2009 Affective and deliberative processes in risky choice: age differences in risk taking in the columbia card task Journal of Experimental Psychology: Learning, Memory, and Cognition 35 3 709

[12] S. GoelJ. M. HofmanM. I. Sirer 2012 Who does what on the web: A large-scale study of browsing behavior ICWSM.

[13] G. A. GrimesM. G. HoughM. L. Signorella 2007 Email end users and spam: relations of gender and age group to attitudes and actions Computers in Human Behavior 23 1 318 332

[14] C. R. HarrisM. JenkinsD. Glaser 2006 Gender differences in risk assessment: why do women take fewer risks than men? Judgment and Decision Making 1 1 48.

[15] R. M. HogarthM. PortellA. Cuxart 2007 What risks do people perceive in everyday life? A perspective gained from the experience sampling method (esm) Risk Analysis 27 6 1427 1439

[16] J. HuH.-J. ZengH. LiC. NiuZ. Chen 2007 Demographic prediction based on user's browsing behavior Proceedings of the 16th international conference on World Wide Web 151 160 ACM

[17] T. N. JagaticN. A. JohnsonM. JakobssonF. Menczer 2007 Social phishing Communications of the ACM 50 10 94 100

[18] J. JohnsonA. WilkeE. U. Weber 2004 Beyond a trait view of risk taking: A domain-specific scale measuring risk perceptions, expected benefits, and perceived-risk attitudes in german-speaking populations Polish Psychological Bulletin 35 153 172

[19] R. JoinerJ. GavinM. BrosnanJ. CrombyH. GregoryJ. GuillerP. MarasA. Moon 2012 Gender, internet experience, internet identification, and internet anxiety: a ten-year followup Cyberpsychology, Behavior, and Social Networking 15 7 370 372

[20] P. KumaraguruJ. CranshawA. AcquistiL. CranorJ. HongM. A. BlairT. Pham 2009 School of phish: a real-world evaluation of anti-phishing training Proceedings of the 5th Symposium on Usable Privacy and Security, 3 ACM

[21] Lalonde LévesqueJ. M. FernandezA. Somayaji 2014 Risk prediction of malware victimization based on user behavior Malicious and Unwanted Software: The Americas (MALWARE), 2014 9th International Conference on, 128 134 IEEE

[22] Lalonde LévesqueJ. NsiempbaJ. M. FernandezS. ChiassonA. Somayaji 2013 A clinical study of risk factors related to malware infections Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security 97 108 ACM

[23] Lalonde LévesqueJ. M. FernandezD. BatchelderG. Young 2016 October Are they real? Real-life comparative tests of anti-virus products 26th Virus Bulletin International Conference 25 33

[24] M. Mather 2006 A review of decision-making processes: Weighing the risks and benefits of aging When I’m 64 145 145 173

[25] N. P. P. MavrommatisM. A. R. F. Monrose 2008 All your iframes point to us USENIX Security Symposium 1 16

[26] Microsoft 2017 Microsoft Privacy Statement https://privacy.microsoft.com/en-gb/privacystatement

[27] F. T. NgoR. Paternoster 2011 Cybercrime victimization: An examination of individual and situational level factors International Journal of Cyber Criminology 5 1 773 793

[28] D. OliveiraH. RochaH. YangD. EllisS. DommarajuM. MuradogluD. WeirA. SolimanT. LinN. Ebner 2017 Dissecting spear phishing emails for older vs young adults: On the interplay of weapons of influence and life domains in predicting susceptibility to phishing Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems 6412 6424 ACM

[29] N. ProvosD. McNameeP. MavrommatisK. WangN. Modadugu et al 2007 The ghost in the browser: Analysis of web-based malware HotBots 7 4 4

[30] B. W. Reyns 2013 Online routines and identity theft victimization further expanding routine activity theory beyond direct-contact offenses Journal of Research in Crime and Delinquency 50 2 216 238

[31] J. J. RolisonY. HanochS. WoodP.-J. Liu 2013 Risk-taking differences across the adult life span: a question of age and domain The Journals of Gerontology Series B: Psychological Sciences and Social Sciences, gbt081

[32] S. ShengM. HolbrookP. KumaraguruL. F. CranorJ. Downs 2010 Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions ACM Conference on Human Factors in Computing Systems (CHI) 373 382

[33] A. K. SoodR. J. Enbody 2011 Malvertising-exploiting web advertising Computer Fraud & Security 2011 4 11 16

[34] T. S. Teo 2001 Demographic and motivation variables associated with internet usage activities Internet Research 11 2 125 137

[35] M. WangC. KellerM. Siegrist 2011 The less you know, the more you are afraid of? A survey on risk perceptions of investment products Journal of Behavioral Finance 12 1 9 19

[36] E. U. WeberA.-R. BlaisN. E. Betz 2002 A domain-specific risk-attitude scale: Measuring risk perceptions and risk behaviors Journal of behavioral decision making 15 4 263 290

[37] X. XingW. MengB. LeeU. WeinsbergA. ShethR. PerdisciW. Lee 2015 Understanding malvertising through ad-injecting browser extensions Proceedings of the 24th International Conference on World Wide Web 1286 1295 International World Wide Web Conferences Steering Committee

[38] T.-F. YenV. HeorhiadiA. OpreaM. K. ReiterA. Juels 2014 An epidemiological study of malware encounters in a large enterprise Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 1117 1130 ACM

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65