以腦波量測使用者對電子郵件社交工程訊息之感知與回應

A Study on Using EEG to Measure:How Users Perceive and Respond to E-mail Social Engineering Messages

許文瑞(Wen-Ruei Hsu)

指導教授 ： 吳錦波

淡江大學/商管學院/資訊管理學系碩士在職專班/碩士(2015年)

https://doi.org/10.6846/TKU.2015.00716

摘要

全球資訊安全投資金額日增，資訊安全事件仍層出不窮，僅2014年第3季全球即超過1億8仟3佰餘萬筆個人及財務資料外洩，其中高達95%的資料外洩事故，與人為錯誤有關。因此，使用者資訊安全行為實有探討之必要。目前已有許多使用者資訊安全行為研究，其中以認知神經科學探討資訊安全行為之研究較少。本研究旨在透過電子郵件社交工程訊息，探討使用者資訊安全腦波感知差異，採用實驗法以腦波儀量測使用者感知過程之腦波活動。研究結果受測者腦波受習慣、性別及理解程度因素影響，且左右腦感知程度呈現不對稱情形。研究發現受測者在習慣、性別、理解程度及左右腦感知程度存在差異，大腦各區域對外來訊息反應特徵，可即時觀測受測者心理行為變化，並供作未來資訊安全防護措施發展與應用參考。

關鍵字

電子郵件社交工程 ； 資訊安全 ； 腦波

並列摘要

The investments in information security have been increasing globally, however there are still many security leakage incidents.
In third quarter of 2014, more than one hundred eighty three million personal and financial information leakage and 95% of information leakage are related to human error. Therefore, further investigation of users’ information security behavior is necessary. Currently, there are many studies of users’ information security behavior, but still, few studies from the perspective of cognitive neuroscience. This study investigates the users’ information security behavior by measuring their brainwave activity while viewing email social engineer messages in an experimental setting. The result shows that a subject’s brainwave is affected by habits, gender, the level of understanding and the EEG power asymmetry of perception in two cerebral hemispheres. Observing the affects to a person’s brainwave from these external informational could be a reference for future information security studies.

並列關鍵字

EEG ； social engineering

參考文獻

[3]張家豪，2014，『以腦波量測探討表情符號與貼圖運用於即時通訊之差異』，淡江大學資訊管理學系碩士在職專班學位論文。

[16]Davidson, R. J. (1995). Cerebral asymmetry, emotion, and affective style. In R. J. Davidson & K. Hudgahl (Eds.), Brain asymmetry (pp. 361–387). Cambridge, MA: MIT Press.

[33]Kalsher, M. J., & Williams, K. J. (2006). Behavioral compliance: Theory, methodology, and results. Handbook of warnings, pp. 313-331.

[4]Alesina, A., & La Ferrara, E. (2002). Who trusts others? Journal of public economics, 85(2), pp. 207-234.

[5]Acquisti, A., & Grossklags, J. (2005). Privacy and rationality in individual decision making. IEEE Security & Privacy, (1), pp. 26-33.