Pavlo Burda

Purpose: This study aims to investigate the factors influencing employees’ decisions to report suspicious phishing e-mails in organizations, addressing the gap in understanding what motivates users to report and which types of e-mails are most likely to be reported. Design/methodology/approach: In this study, the authors sample and interview n = 49 employees from the pool of phishing reporters at a European university. Interviewees are selected based on the sophistication of the e-mails they report, considering both contextual and technical dimensions. The authors cluster reporters according to their (emerging) reporting behavior and conduct semistructured interviews until thematic saturation is reached. Through thematic analysis, the authors identify 21 main themes that drive reporting. Findings: The results indicate that the primary drivers for reporting suspicious e-mails are the desire to protect and help the organization and coworkers. Additional factors include a sense of responsibility, awareness of potential consequences and feelings of insecurity. Participants are more likely to report phishing e-mails that appear well-impersonated and with a believable pretexts, signaling user prowess in estimating the potential impact of phishing attacks. Originality/value: This research offers a novel perspective on the complex interplay between motivations to report with a discussion in the broader theoretical context, as well as on the practical implications of the findings.

Algorithms are increasingly used to make or support decisions, such as recruitment and selection, loan approval, fraud detection, classification and prediction. This has raised important questions on how to assure the use of algorithms respects important values such as fairness, absence of bias and discrimination, and also explainability and redress. Despite decades of research, there is no single metric that can be used to measure fairness, absence of bias or discrimination. For every implementation one needs to evaluate multiple different metrics and also additional decisions about the subgroups and thresholds to use for the fairness metrics. In this paper we present an overview of the most important fairness metrics, provide, updated more thorough definitions, and a new dataset of hiring candidates (n=225) to show the impact of the different definitions in practice. The dataset presented is suitable for educational and demonstration purposes since it is freely usable, has no privacy constraints, no data quality issues and is sufficiently complex to explain the challenges of fairness evaluations. We use the dataset to show that the different fairness definitions are indeed conflicting and that it is necessary to consider many sub-groups using multiple sensitive features. We also discuss the importance of the socio-technical context and domain knowledge in fairness.

This paper introduces a real-world dataset for analysing and predicting house prices. The dataset consists of actual data on the Dutch housing market collected in 2024 for a total of 153 houses in one city (Utrecht in The Netherlands). The dataset incorporates diverse variables on individual houses, includ- ing property characteristics (e.g., house type, build year, geolocation, area, energy label) and market metrics (e.g., asking price, final price). The data was collected from two public sources. The dataset has been created to help researchers and educators to demonstrate machine learning principles on several problem types. It can be used for classification (energy label and energy efficiency) and regression/ price estimation. There are ten original input features and one derived feature. The dataset can be freely used without restrictions under a Creative Commons license and is available via open data platform Kaggle.

The interdisciplinarity of the Social Engineering (SE) domain creates crucial challenges for the development and advancement of empirical SE research, making it particularly difficult to identify the space of open research questions that can be addressed empirically. This space encompasses questions on attack conditions, employed experimental methods, and interactions with underlying cognitive aspects. As a consequence, much potential in the breadth of existing empirical SE research and in its mapping to the actual cognitive processes it aims to measure is left untapped. In this work, we carry out a systematic review of 169 articles investigating overall 735 hypotheses in the field of empirical SE research, focusing on experimental characteristics and core cognitive features from both attacker and target perspectives. Our study reveals that experiments only partially reproduce real attacks and that the exploitable SE attack surface appears much larger than the coverage provided by the current body of research. Factors such as targets’ context and cognitive processes are often ignored or not explicitly considered in experimental designs. Similarly, the effects of different pretexts and varied targetization levels are overall marginally investigated. Our findings on current SE research dynamics provide insights into methodological shortcomings and help identify supplementary techniques that can open promising future research directions.

Phishing attacks are a main threat to organizations and individuals. Current widespread defenses based on spam filters and domain blacklisting are unfortunately insufficient. Prior work identifies phishing reporting as a key, largely untapped resource to mitigate phishing threats. Yet, its practice suffers from very low reporting rates and generally too low an uptake from users. Whereas it is known that phishing reporting behavior is affected by a number of ‘human factors’, a comprehensive view of the different theories and their effects on (intent to) report is not yet developed. To address this gap, we evaluate theories and factors analyzed in the extant literature, build a cohesive theoretical view of their effects and constructs, and develop, model, and empirically evaluate (by means of an online questionnaire, n=284) the resulting hypothesis structure. We discuss both theoretical implications of our findings and research directions for practice at a research and organizational level.

Phishing attacks arrive in high numbers and often spread quickly, meaning that after-the-fact countermeasures such as domain blacklisting are limited in efficacy. Visual similarity-based approaches have the potential of detecting previously unseen phishing webpages. These approaches, however, require identifying the legitimate webpage(s) they reproduce. Existing approaches rely on textual feature analysis for target identification, with misclassification rates of approximately 1%; however, as most websites a user might visit are legitimate, additional research is needed to further reduce classification errors. In this work, we propose a novel method for target identification that relies on both visual features (extracted from a screenshot of the web page) and textual features (extracted from the DOM of the web page) to identify which website a phishing web page is replicating, and assess its effectiveness in detecting phishing websites using data from phishing aggregators such as OpenPhish, PhishTank and PhishStats. Compared to state-of-the-art text-based classifiers, our method reduces the phishing misclassification rate by 67% (from 1.02% to 0.34%), for an accuracy of 99.66%. This work provides a further step forwards toward semi-automated decision support systems for phishing detection.