Yukiko Sawaya’s research while affiliated with KDDI Research and other places

To improve the rate of taking security action, it is important to promote personalized approaches for each user. Related works indicate phrases and UIs of dialog messages and incentives that influence a user’s action. In our previous work, we focused on smartphone users updating software, and proposed appropriate phrases of dialog messages according to the user’s understanding of the updating procedure, as well as the type of software. We also analyzed appropriate incentives. However, in the terms of level of literacy, the effectiveness of the UI of dialog messages and the volume of incentives remain unclear. In this paper, we conducted a user survey to analyze appropriate UIs according to the user’s understanding of the updating procedure and the appropriate volume of incentives. As a result, we confirmed different UIs are effective according to the user’s understanding of the updating procedure. In addition, we found an appropriate volume of points, mobile data, and coupons in order to promote the updating of software.

It is important to provide personalized interventions that focus on the different security awareness of each user. We focus on updating operating system (OS) and seven major types of applications (Communication, Finance, Lifestyle, Games, Utility, Health, Entertainment) for smartphone users and aim to provide approaches that lead to updating of OS and seven types of applications (hereinafter, this is called “software”). We consider that user awareness of updating software may differ, and this relates to user understanding of the updating procedure. In this paper, we propose intervention methods according to users’ knowledge about update procedures. We conduct an online survey to evaluate effective approaches such as dialog message and type of incentive that increases the intention of smartphone users to update. We found that effective phrases of dialog messages differ according to the users’ understanding of the update procedures and that reward points are the best incentive for many users.

Some users (“Help recipients”) delegate necessary security actions to their family, friends, or others close to them. It is important to be able to take appropriate defensive actions against security threats by themselves when help is not available from neighbors (“Helpers”). In this paper, we interviewed 9 users who used to be Help recipients, but who have now started to take security actions by themselves. We investigated the reason why Help recipients delegated their security actions to Helpers and the human factors that have an impact when one takes security actions by oneself. As a result, Help recipients take their own security actions when they try new hobbies or feel a sense of ownership. Based on these findings, we classify Help recipients into four groups and propose an optimized system that shows security action lists according to user situation. These findings are useful when providing appropriate intervention for Help recipients.

To protect computers from various types of cyberattack, users are required to learn appropriate security behaviors. Different persuasion techniques to encourage users to take security behaviors are required according to user attitude toward security. In this paper, we first propose a Security Behavior Stage Model (SeBeST) which classifies users into five stages in terms of attitude toward security measurements; having security awareness and taking security behaviors. In addition, we focus on OS updating behaviors as an example of security behaviors and evaluated effective OS update messages for users in each stage. We create message dialogs which can promote user OS updating behaviors. We conduct two online surveys; we analyze the validity of SeBeST in Survey1 and then evaluate effective messages for each stage in Survey2. We find that SeBeST has high validity and appropriate messages for the users in each stage differ from one another.

Homograph attack is a way that attackers deceive victims about which website domain name they are communicating with by exploiting the fact that many characters look alike. The attack becomes serious and is raising broad attention when recently many brand domains have been attacked such as Apple Inc., Adobe Inc., Lloyds Bank, etc. We first design a survey of human demographics, brand familiarity, and security backgrounds and apply it to 2,067 participants. We build a regression model to study which factors affect participants’ ability in recognizing homograph domains. We find that for different levels of visual similarity, the participants exhibit different abilities. 13.95% of participants can recognize non-homographs while 16.60% of participants can recognize homographs whose the visual similarity with the target brand domains is under 99.9%; but when the similarity increases to 99.9%, the number of participants who can recognize homographs significantly drops down to only 0.19%; and for the homographs with 100% of visual similarity, there is no way for the participants to recognize. We also find that female participants tend to recognize homographs better the male but male participants tend to able to recognize non-homographs better than females. Security knowledge is a significant factor affecting both homographs and non-homographs; surprisingly, people who have strong security knowledge tend to be able to recognize homographs but not non-homographs. Furthermore, people who work or are educated in computer science or computer engineering do not appear as a factor affecting the ability in recognizing homographs; however, interestingly, right after they are explained about the homograph attack, people who work or are educated in computer science or computer engineering are the ones who can capture the situation the most quickly.

Homograph attack is a way that attackers deceive victims about which website domain name they are communicating with by exploiting the fact that many characters look alike. The attack becomes serious and is raising broad attention when recently many brand domains have been attacked such as Apple Inc., Adobe Inc., Lloyds Bank, etc. We first design a survey of human demographics, brand familiarity, and security backgrounds and apply it to 2,067 participants. We build a regression model to study which factors affect participants' ability in recognizing homograph domains. We find that for different levels of visual similarity, the participants exhibit different abilities. 13.95% of participants can recognize non-homographs while 16.60% of participants can recognize homographs whose the visual similarity with the target brand domains is under 99.9%; but when the similarity increases to 99.9%, the number of participants who can recognize homographs significantly drops down to only 0.19%; and for the homographs with 100% of visual similarity, there is no way for the participants to recognize. We also find that female participants tend to recognize homographs better the male but male participants tend to able to recognize non-homographs better than females. Security knowledge is a significant factor affecting both homographs and non-homographs; surprisingly, people who have strong security knowledge tend to be able to recognize homographs but not non-homographs. Furthermore, people who work or are educated in computer science or computer engineering do not appear as a factor affecting the ability in recognizing homographs; however, interestingly, right after they are explained about the homograph attack, people who work or are educated in computer science or computer engineering are the ones who can capture the situation the most quickly.