EyeBit: Eye-Tracking Approach for Enforcing Phishing Prevention Habits

Abstract

This paper proposes a cognitive method with the goal to get end users into the habit of checking the address bar of the web browser. Earlier surveys of end user behavior emphasized that users become victims to phishing due to the lack of knowledge about the structure of URLs, domain names, and security information. Therefore, there exist many approaches to improve the knowledge of end users. However, the knowledge gained will not be applied unless end users are aware of the importance and develop a habit to check the browser's address bar for the URL structure and relevant security information. We assume that the habit of checking the bar will improve educational effect, user awareness of secure information, and detection accuracy even in the case of sophisticated phishing attacks. To assess this assumption, this paper conducts a participant-based experiment where 23 participants' eye movement records are analyzed, and observes that novices do not tend to have the said habit. We then consider a way for them to acquire these habits, and develop a system which requires them to look at the address bar before entering some information into web input forms. Our prototype named EyeBit is developed as a browser extension, which interacts with an eye-tracking device to check if the user looks at the browser's address bar. The system deactivates all input forms of the websites, and reactivates them only if the user has looked at the bar. This paper shows the preliminary results of our participant-based experiments, and discusses the effectiveness of our proposal, while considering the potential inconvenience caused by EyeBit.

AJNA: Anti-phishing JS-based Visual Analysis, to Mitigate Users' Excessive Trust in SSL/TLS

“…Mobile users are even more oblivious of their presence when dealing with the reduced screens of their smartphones [25]. Indeed, there is no objection to the increased security brought by using SSL/TLS in HTTP communications, and research works specifically aiming to educate users into recognizing security icons [26] should be encouraged. But even security-savvy users may fall victims to phishing traps if they do not use their discernment when dealing with seemingly secure websites.…”

Understanding Phishing Email Processing and Perceived Trustworthiness Through Eye Tracking

“…This highlights the need to better understand the mechanisms behind a successful phishing attack. By using eye tracking it is possible to explore what factors predict whether someone will be tricked by a phishing website, by considering the interaction between the structure of the website and what the person looks at, or indeed fails to look at (Miyamoto et al, 2014). This has been used for example to understand how and if users pay attention to web browser security indicators, such as the Firefox Mozilla SSL certificate (Sobey et al, 2008).…”

“…Further uses of eye tracking in cybersecurity have become evident as the research field and technology have continued to develop. For instance it has been demonstrated that the technology can be used to change risky behaviors, such as for example by preventing a user from continuing with use of input forms in a website unless an eye tracker has determined that the individual has looked at the address bar (Miyamoto et al, 2014). Similarly, eye trackers can be used to detect anomalous user behavior.…”

Look before you Authorize: Using Eye-Tracking to Enforce User Attention towards Application Permissions

“…Therefore, researchers are now experimenting with active applications of eye-tracking. Miyamoto et al [17] have developed EyeBit-an eyetracking based system to inculcate the habit of looking at the URL address bar before entering sensitive information in the website's input fields, in order to prevent phishing. The system first deactivates the input fields in a website, and using the eye-tracking data determines if the user has looked at the website's URL.…”

“…The decision buttons are initially deactivated, and once the user reads and scrolls down on the policy, they are activated. Second is an eye-tracking based mechanism to put the user into the habit of looking at the URL address bar to determine the website's legitimacy before entering sensitive information [17]. The input fields are initially deactivated, and once the user looks at the URL address (determined using the eyegaze fixations on the URL address bar screen coordinates), they are activated.…”