Multitasking and Monetary Incentive in a Realistic Phishing Study

This paper introduces an empirical study focusing on task settings similar to those in the real-world that captures user behavioral information of fine granularity. In online experiments, participants recruited from the Mechanical Turk human subject pool sorted legitimate and phishing emails. Subgroups of these remote users performed a secondary question-answering task and/or were incentivized by a monetary reward based on email sorting accuracy. This web-based framework automates a complete process from the informed consent to a post-study questionnaire, which can be scaled up to a large number of human subjects. In the preliminary result analysis, the monetary incentive can positively affect users’ behavior and performance, but not in a straightforward manner. Multitasking, on the other hand, has a negative effect on users’ ability to correctly classify emails.

Content

Author and article information

Contributors

Haoruo Zhang

Shirish Singh

Xiangyang Li

Anton Dahbura

Meng Xie

Conference

Publication date: July 2018

Publication date (Print): July 2018

Pages: 1-5

Affiliations

[0001]Johns Hopkins University Information Security Institute

3400 North Charles Street, Baltimore, Maryland, 21218, USA

Article

DOI: 10.14236/ewic/HCI2018.115

SO-VID: cf17e59a-48e6-4537-a215-fcff9196f857

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: Proceedings of the 32nd International BCS Human Computer Interaction Conference

Conference acronym: HCI

Conference number: 32

Conference location: Belfast, UK

Conference date: 4 - 6 July 2018

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Human Computer Interaction Conference

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/HCI2018.115

Self URI (journal page): https://ewic.bcs.org/

References

R. Atterer M. Wnuk, & A. Schmidt (2006) Knowing the user's every move: User activity tracking for website usability evaluation and implicit interaction Proceedings of the 15th International Conference on World Wide Web 203–212 ACM, New York, NY, USA.
C. Bartneck A. Duenser E. Moltchanova, & K. Zawieska (2015) Comparing the similarity of responses received from studies in Amazon's Mechanical Turk to studies conducted online and with direct recruitment PLOS One 10(4).
J. A. Benítez J. E. Labra E. Quiroga V. Martín I. García P. Marqués-Sánchez, & C. Benavides (2017) A Web-Based tool for automatic data collection, curation, and visualization of complex healthcare survey studies including social network analysis Computational and Mathematical Methods in Medicine 1–8.
A. Bianchi J. Corbetta L. Invernizzi Y. Fratantonio C. Kruegel, & G. Vigna (2015) What the App is That? Deception and Countermeasures in the Android User Interface 2015 IEEE Symposium on Security and Privacy.
K. Gajos (n.d.) Multitasking Test http://multitasking.labinthewild.org/multitasking/ (Retrieved April 06 2018)
T. Kaczmarek A. Kobsa R. Sy, & G. Tsudik (2015). An unattended study of users performing security critical tasks under adversarial noise Proceedings of 2015 Workshop on Usable Security.
A. Kittur E. H. Chi, & B. Suh (2008) Crowdsourcing User Studies with Mechanical Turk,” in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 453–456 ACM, New York, NY, USA.
G. Lawton (2005) LAMP lights enterprise development efforts Computer 38(9), 18–20.
L. Layman, & G. Sigurdsson (2013) Using Amazons Mechanical Turk for user studies: Eight things you need to know 2013 ACM / IEEE International Symposium on Empirical Software Engineering and Measurement.
H. Ollesch E. Heineken, & F. P. Schulte (2006) Physical or virtual presence of the experimenter: Psychological online-experiments in different settings,” International Journal of Internet Science 1(1), 71–81.
M. Thomson, & R. V. Solms (1998) Information security awareness: Educating your users effectively Information Management & Computer Security 6(4), 167–173.
R. Willison, & M. Warkentin (2013) Beyond Deterrence: An Expanded View of Employee Computer Abuse MIS Quarterly 37(1), 1-20.

Comments

Comment on this article

[1] R. Atterer M. Wnuk, & A. Schmidt (2006) Knowing the user's every move: User activity tracking for website usability evaluation and implicit interaction Proceedings of the 15th International Conference on World Wide Web 203–212 ACM, New York, NY, USA.

[2] C. Bartneck A. Duenser E. Moltchanova, & K. Zawieska (2015) Comparing the similarity of responses received from studies in Amazon's Mechanical Turk to studies conducted online and with direct recruitment PLOS One 10(4).

[3] J. A. Benítez J. E. Labra E. Quiroga V. Martín I. García P. Marqués-Sánchez, & C. Benavides (2017) A Web-Based tool for automatic data collection, curation, and visualization of complex healthcare survey studies including social network analysis Computational and Mathematical Methods in Medicine 1–8.

[4] A. Bianchi J. Corbetta L. Invernizzi Y. Fratantonio C. Kruegel, & G. Vigna (2015) What the App is That? Deception and Countermeasures in the Android User Interface 2015 IEEE Symposium on Security and Privacy.

[5] K. Gajos (n.d.) Multitasking Test http://multitasking.labinthewild.org/multitasking/ (Retrieved April 06 2018)

[6] T. Kaczmarek A. Kobsa R. Sy, & G. Tsudik (2015). An unattended study of users performing security critical tasks under adversarial noise Proceedings of 2015 Workshop on Usable Security.

[7] A. Kittur E. H. Chi, & B. Suh (2008) Crowdsourcing User Studies with Mechanical Turk,” in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 453–456 ACM, New York, NY, USA.

[8] G. Lawton (2005) LAMP lights enterprise development efforts Computer 38(9), 18–20.

[9] L. Layman, & G. Sigurdsson (2013) Using Amazons Mechanical Turk for user studies: Eight things you need to know 2013 ACM / IEEE International Symposium on Empirical Software Engineering and Measurement.

[10] H. Ollesch E. Heineken, & F. P. Schulte (2006) Physical or virtual presence of the experimenter: Psychological online-experiments in different settings,” International Journal of Internet Science 1(1), 71–81.

[11] M. Thomson, & R. V. Solms (1998) Information security awareness: Educating your users effectively Information Management & Computer Security 6(4), 167–173.

[12] R. Willison, & M. Warkentin (2013) Beyond Deterrence: An Expanded View of Employee Computer Abuse MIS Quarterly 37(1), 1-20.

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65