簡易檢索 / 詳目顯示

研究生: 范黎杏芳
Pham, Phuong Le Hanh
論文名稱: Phishing Attacks on Social Networking Sites: A Protection Motivation Theory Perspective.
Phishing Attacks on Social Networking Sites: A Protection Motivation Theory Perspective.
指導教授: 陳正忠
Chen, Victor
學位類別: 碩士
Master
系所名稱: 管理學院 - 國際經營管理研究所
Institute of International Management
論文出版年: 2018
畢業學年度: 106
語文別: 英文
論文頁數: 72
外文關鍵詞: Social Networking Sites, Phishing, Cyber-crime, Data Privacy, Coping Behaviors, Protection Motivation Theory, Social Hedonic Value, Social Utilitarian Value, Fear of Missing Out, Propensity to Share and Report.
相關次數: 點閱:78下載:22
分享至:
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報
  • The intensification in use of social networking channels like Facebook, Twitter or Youtube over the world have attracted criminals to perform their social engineering fraud like Phishing to trick and deceive users. Adopting Protection Motivation Theory as the theoretical background, this study investigate the coping responses of user when dealing with Phishing in the social networking environment. The results of an online survey with 410 valid response indicate that people choose to make effort and focus hard on detecting phishing when they aware that the lost for phishing are significant and acknowledge that phishing detection can work effectively to protect their networks. The findings also indicate important moderating effects of Fear of missing out on SNS and the Epistemic motivation of the users. The finding of this study contributes to the literature of privacy concern and data breach on social networking services.

    ABSTRACT I ACKNOWLEDGEMENTS II TABLE OF CONTENTS III LIST OF TABLES VI LIST OF FIGURES VIII CHAPTER ONE INTRODUCTION 1 1.1 Research Background. 1 1.2. Research Gap. 10 1.3 Research Objectives. 11 1.4. Research Structure. 12 CHAPTER TWO LITERATURE REVIEW 13 2.1 Theoretical Background. 13 2.1.1 The Theory of Protection Motivation. 13 2.1.2 Coping Responses. 16 2.2. Hypothesis Development. 18 2.2.1. The Relationship between Threat Perception and Coping Responses. 18 2.2.3 The relationship between Coping Reponses and Propensity to Share and Report. 22 2.2.4 The Moderating Role of Social Value to the relationship between Threat Perception and Coping Responses. 23 2.2.5 The Moderating Role of Response Cost to the relationship between Efficacy Perception and Coping Respones. 27 2.2.6 The Moderating Role of Epistemic Motivation to the Relationship between Coping Responses and PSR. 29 CHAPTER THREE RESEARCH DESIGN AND METHODOLOGY 31 3.1 Conceptual Model. 31 3.2 Data Collection. 32 3.3. Variables Measurements. 33 3.4 Summary of The Hypotheses. 36 CHAPTER FOUR RESEARCH RESULTS 38 4.1 Pilot test. 38 4.1.1 Descriptive Statistics for Pilot test. 38 4.1.2 Exploratory Factor Analysis for Propensity to Share and Report. 40 4.1.3 Confirmatory Factor Analysis and Reliability Test. 41 4.2 The Main Study. 43 4.2.1 Descriptive Statistics. 43 4.2.2 CFA and Construct Validity and Reliability Testing. 48 4.2.3 PLS Path Analysis Results. 51 CHAPTER FIVE RESEARCH CONCLUSION AND IMPLICATIONS 56 5.1 Research Findings and Conclusions. 56 5.2 Theoretical Contributions and Implications. 60 5.2.1 Theoretical Contributions. 60 5.2.2 Practical Implications. 60 5.3 Limitation and Suggestion for Future Research. 61 REFERENCES 63 APPENDIX 70 An example of a phishing procedure on Twitter. 70 Another example of a famous Phishing post on Facebook. 72

    Aaron, G., & Rasmussen, R. (2010). Global phishing survey: Trends and domain name use in 2H2009. Anti-Phishing Working Group (APWG), Lexington, Massachusets USA.
    Aburrous, M., Hossain, M. A., Dahal, K., & Thabtah, F. (2010). Experimental case studies for investigating e-banking phishing techniques and attack strategies. Cognitive Computation, 2(3), 242-253.
    Adida, B. (2007). Beamauth: Two-factor web authentication with a bookmark. Paper presented at the Proceedings of the 14th ACM conference on Computer and Communications Security, Alexandria, City of Virginia, USA
    Arachchilage, N. A. G., & Love, S. (2013). A game design framework for avoiding phishing attacks. Computers in Human Behavior, 29(3), 706-714.
    Arachchilage, N. A. G., Love, S., & Beznosov, K. (2016). Phishing threat avoidance behaviour: An empirical investigation. Computers in Human Behavior, 60(0), 185-197.
    Bakhshi, T., Papadaki, M., & Furnell, S. (2009). Social engineering: Assessing vulnerabilities in practice. Information Management & Computer Security, 17(1), 53-63.
    Baum, A., & Contrada, R. (2010). The handbook of stress science: Biology, psychology, and health. New York: Springer Publishing Company.
    Bergholz, A., De Beer, J., Glahn, S., Moens, M.-F., Paaß, G., & Strobel, S. (2010). New filtering approaches for phishing email. Journal of Computer Security, 18(1), 7-35.
    Bignell, K. B. (2006). Authentication in an internet banking environment; Towards developing a strategy for fraud detection. Paper presented at the Internaiontal Conference on Internet Surveillance and Protection, Cap Esterel, Côte d'Azur, France.
    Boss, S. R., Galletta, D. F., Lowry, P. B., Moody, G. D., & Polak, P. (2015). What do users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviors. MIS Quaterly, 39(4), 837-864.
    Calman, C. (2006). Bigger phish to fry: California's anti-phishing statute and its potential imposition of secondary liability on internet service providers. Rich. JL & Tech., 13(1), 1-25.
    Cao, Y., Han, W., & Le, Y. (2008). Anti-phishing based on automated individual white-list. Paper presented at the Proceedings of the 4th ACM workshop on Digital Identity Management, Alexandria, City of Virginia, USA.
    Chandrasekaran, M., Narayanan, K., & Upadhyaya, S. (2006). Phishing email detection based on structural properties. Paper presented at the NYS Cyber Security Conference, New York, USA.
    Chen, X., Bose, I., Leung, A. C. M., & Guo, C. (2011). Assessing the severity of phishing attacks: A hybrid data mining approach. Decision Support Systems, 50(4), 662-672.
    Chesney, T., Coyne, I., Logan, B., & Madden, N. (2009). Griefing in virtual worlds: Causes, casualties and coping strategies. Information Systems Journal, 19(6), 525-548.
    Cranor, L. F., Egelman, S., Hong, J. I., & Zhang, Y. (2007). Phinding phish: An evaluation of anti-phishing toolbars. Paper presented at the Network and Distributed Security Symposium, San Diego, USA.
    Dhamija, R., & Tygar, J. D. (2005). Phish and hips: Human interactive proofs to detect phishing attacks, Paper presented at International Workshop of Human Interactive Proofs, Pennsylvania, USA.
    Dhamija, R., Tygar, J. D., & Hearst, M. (2006). Why phishing works. Paper presented at the Proceedings of the SIGCHI conference on Human Factors in Computing Systems, Québec, Canada.
    Dodge Jr, R. C., Carver, C., & Ferguson, A. J. (2007). Phishing for user security awareness. Computers & Security, 26(1), 73-80.
    Downs, J. S., Holbrook, M., & Cranor, L. F. (2007). Behavioral response to phishing risk. Paper presented at the proceedings of the Anti-phishing Working Groups 2nd Annual ECrime Researchers Summit, Pennsylvania, USA.
    Downs, J. S., Holbrook, M. B., & Cranor, L. F. (2006). Decision strategies and susceptibility to phishing. Paper presented at the Proceedings of the second symposium on Usable Privacy and Security, Pittsburgh, Pennsylvania, USA.
    Endler, N. S., & Parker, J. D. (1990). Multidimensional assessment of coping: A critical evaluation. Journal of Personality and Social Psychology, 58(5), 844-854
    Floyd, D. L., Prentice‐Dunn, S., & Rogers, R. W. (2000). A meta‐analysis of research on protection motivation theory. Journal of Applied Social Psychology, 30(2), 407-429.
    Folkman, S., & Lazarus, R. S. (1988). Coping as a mediator of emotion. Journal of Personality and Social Psychology, 54(3), 466-475.
    Franceschi, K., Lee, R. M., Zanakis, S. H., & Hinds, D. (2009). Engaging group e-learning in virtual worlds. Journal of Management Information Systems, 26(1), 73-100.
    Gouda, M. G., Liu, A. X., Leung, L. M., & Alam, M. A. (2007). SPP: An anti-phishing single password protocol. Computer Networks, 51(13), 3715-3726.
    Gudkova, D., Kulikova, T., Kalimanova, K., & Bronnikova, D. (2013). Spam Evolution Kaspersky security bulletin.
    Guiltinan, J. P. (1989). A classification of switching costs with implications for relationship marketing. Paper presented at the AMA Winter Educators’ Conference: Marketing Theory and Practice, Chicago, USA.
    Hair, J. F., Ringle, C. M., & Sarstedt, M. (2013). Partial least squares structural equation modeling: Rigorous applications, better results and higher acceptance. Long Range Planning 46 (1-2), 1-12.
    He, M., Horng, S.-J., Fan, P., Khan, M. K., Run, R.-S., Lai, J.-L., Sutanto, A. (2011). An efficient phishing webpage detector. Expert Systems with Applications, 38(10), 12018-12027.
    Hinde, S. (2004). All you need to be a phisherman is patience and a worm. Computer Fraud & Security, 2004(3), 4-6.
    Hong, J. (2012). The state of phishing attacks. Communications of The ACM, 55(1), 74-81.
    Hsieh, J. P.-A., Rai, A., & Keil, M. (2008). Understanding digital inequality: Comparing continued use behavioral models of the socio-economically advantaged and disadvantaged. MIS Quarterly, 32(1), 97-126.
    Jagatic, T. N., Johnson, N. A., Jakobsson, M., & Menczer, F. (2007). Social phishing. Communications of The ACM, 50(10), 94-100.
    James, T. L., Lowry, P. B., Wallace, L., & Warkentin, M. (2017). The effect of belongingness on obsessive-compulsive disorder in the use of online social networks. Journal of Management Information Systems, 34(2), 560-596.
    Jarvenpaa, S. L., & Staples, D. S. (2001). Exploring Perceptions of Organizational Ownership of Information and Expertise. Journal of Management Information Systems, 18(1), 151-183.
    Jendricke, U., & tom Markotten, D. G. (2000). Usability meets security-the identity-manager as your personal security assistant for the Internet. Paper presented at the Computer Security Applications, ACSAC'00. 16th Annual Conference. New Orleans, Lousiana, USA.
    Jensen, M. L., Dinger, M., Wright, R. T., & Thatcher, J. B. (2017). Training to mitigate phishing attacks using mindfulness techniques. Journal of Management Information Systems, 34(2), 597-626.
    Johnston, A. C., & Warkentin, M. (2010). Fear appeals and information security behaviors: an empirical study. MIS Quarterly, 34(3), 549-566.
    Jones, H. S., & Towse, J. (2018). Examinations of email fraud susceptibility: Perspectives from academic research and industry practice. McAlaney, J., Frumkin, L.A. and Benson, V, Psychological and Behavioral Examinations in Cyber Security. Hershey, Pennsylvania, USA: IGI Global.
    Juslin, P. N., & Sloboda, J. (2011). Handbook of music and emotion: Theory, research, applications. Oxford, UK: Oxford University Press.
    Khonji, M., Iraqi, Y., & Jones, A. (2013). Phishing detection: A literature survey. Communications Surveys & Tutorials, 15(4), 2091-2121.
    Kim, S. S., Malhotra, N. K., & Narasimhan, S. (2005). Research note—two competing perspectives on automatic use: A theoretical and empirical comparison. Information Systems Research, 16(4), 418-432.
    Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L. F., & Hong, J. (2010). Teaching Johnny not to fall for phish. ACM Transactions on Internet Technology, 10(2), 7-31.
    Lam, S. P. (2006). Predicting intention to save water: Theory of planned behavior, response efficacy, vulnerability, and perceived efficiency of alternative solutions. Journal of Applied Social Psychology, 36(11), 2803-2824.
    Liang, H., & Xue, Y. (2009). Avoidance of information technology threats: A theoretical perspective. MIS Quarterly, 33(1), 71-90.
    Mannan, M., & Van Oorschot, P. C. (2007). Using a personal device to strengthen password authentication from an untrusted computer. Paper presented at the International Conference on Financial Cryptography and Data Security, Scarborough, Trinidad and Tobago.
    Matthews, G., & Campbell, S. E. (1998). Task-induced stress and individual differences in coping. Paper presented at the Proceedings of the Human Factors and Ergonomics Society Annual Meeting, Chicago, USA.
    Matthews, G., Campbell, S. E., Falconer, S., Joyner, L. A., Huggins, J., Gilliland, K., Warm, J. S. (2002). Fundamental dimensions of subjective state in performance settings: Task engagement, distress, and worry. Emotion, 2(4), 315-340.
    Matthews, G., Emo, A. K., Funke, G., Zeidner, M., Roberts, R. D., Costa Jr, P. T., & Schulze, R. (2006). Emotional intelligence, personality, and task-induced stress. Journal of Experimental Psychology: Applied, 12(2), 96-107.
    McNealy, J. E. (2008). Angling for phishers: Legislative responses to deceptive e-mail. Comm. L. & Pol'y, 13(2), 275-300.
    Messinger, P. R., Stroulia, E., Lyons, K., Bone, M., Niu, R. H., Smirnov, K., & Perelgut, S. (2009). Virtual worlds—past, present, and future: New directions in social computing. Decision Support Systems, 47(3), 204-228.
    Milne, S., Orbell, S., & Sheeran, P. (2002). Combining motivational and volitional interventions to promote exercise participation: Protection motivation theory and implementation intentions. British Journal of Health Psychology, 7(2), 163-184.
    Milne, S., Sheeran, P., & Orbell, S. (2000). Prediction and intervention in health‐related behavior: A meta‐analytic review of protection motivation theory. Journal of Applied Social Psychology, 30(1), 106-143.
    Mohamed, N., & Ahmad, I. H. (2012). Information privacy concerns, antecedents and privacy measure use in social networking sites: Evidence from Malaysia. Computers in Human Behavior, 28(6), 2366-2375.
    Moody, G. D., Galletta, D. F., & Dunn, B. K. (2017). Which phish get caught? An exploratory study of individuals′ susceptibility to phishing. European Journal of Information Systems, 26(6), 564-584.
    Moore, T., & Clayton, R. (2007). Examining the impact of website take-down on phishing. Paper presented at the Proceedings of the Anti-phishing Working Groups 2nd annual eCrime Researchers Summit, Pennsylvania, USA.
    Obied, A., & Alhajj, R. (2009). Fraudulent and malicious sites on the web. Applied Intelligence, 30(2), 112-120.
    Ohaya, C. (2006). Managing phishing threats in an organization. Paper presented at the Proceedings of the 3rd annual conference on Information Security Curriculum Development. Kennesaw, Georgia, USA.
    Oppliger, R., & Hauser, R. (2008). Protecting TLS‐SA implementations for the challenge‐response feature of EMV‐CAP against challenge collision attacks. Security and Communication Networks, 1(2), 125-134.
    Pettey, C., & Stevens, H. (2009). Gartner says number of phishing attacks on us consumers increased 40 percent in 2008. Gartner Group Press Release.
    Plössl, K., Federrath, H., & Nowey, T. (2005). Protection mechanisms against phishing attacks. Paper presented at the International Conference on Trust, Privacy and Security in Digital Business. Copenhagen, Denmark.
    Prentice-Dunn, S., & Rogers, R. W. (1986). Protection motivation theory and preventive health: Beyond the health belief model. Health Education Research, 1(3), 153-161.
    Prince, B. (2009). Phishing attacks cost millions despite low success rate E-Week.
    Purkait, S. (2012). Phishing counter measures and their effectiveness–literature review. Information Management & Computer Security, 20(5), 382-420.
    Rao, R. S., & Ali, S. T. (2015). A computer vision technique to detect phishing attacks. Paper presented at the Communication Systems and Network Technologies Conference. Gwalior, India.
    Ray, S., Kim, S. S., & Morris, J. G. (2012). Online users' switching costs: Their nature and formation. Information Systems Research, 23(1), 197-213.
    Reinig, B. A., Briggs, R. O., Shepherd, M. M., Yen, J., & Nunamaker Jr, J. F. (1995). Affective reward and the adoption of group support systems: Productivity is not always enough. Journal of Management Information Systems, 12(3), 171-185.
    Rippetoe, P. A., & Rogers, R. W. (1987). Effects of components of protection-motivation theory on adaptive and maladaptive coping with a health threat. Journal of Personality and Social Psychology, 52(3), 596-604.
    Rogers, R., Prentice-Dunn, S., & Gochman, D. (1997). Handbook of health behavior research 1: Personal and social determinants. New York, US: Plenum Press.
    Rogers, R. W. (1975). A protection motivation theory of fear appeals and attitude change1. The Journal of Psychology, 91(1), 93-114.
    Sengar, P. K. (2010). Client-side defense against phishing with pagesafe. Master Dissertation, Indian Institute of Technology Roorkee, Uttarakhand, India.
    Shafahi, M., Kempers, L., & Afsarmanesh, H. (2016). Phishing through social bots on Twitter. Paper presented at the Big Data International Conference. Washington, USA.
    Shcherbakova, N. M. V. T., & Tatyana, M. V. (2016). Kaspersky security bulletin. spam and phishing in 2015.
    Sheng, S., Holbrook, M., Kumaraguru, P., Cranor, L. F., & Downs, J. (2010). Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions. Paper presented at the Proceedings of the Conference on Human Factors in Computing Systems. Atlanta, Georgia, USA.
    Sheng, S., Magnien, B., Kumaraguru, P., Acquisti, A., Cranor, L. F., Hong, J., & Nunge, E. (2007). Anti-phishing phil: The design and evaluation of a game that teaches people not to fall for phish. Paper presented at the Proceedings of the 3rd Symposium on Usable Privacy and Security. Pittsburgh, Pennsylvania, USA.
    Steel, C. M., & Lu, C.-T. (2008). Impersonator identification through dynamic fingerprinting. Digital Investigation, 5(1-2), 60-70.
    Sun, J. C.-Y., Yu, S.-J., Lin, S. S., & Tseng, S.-S. (2016). The mediating effect of anti-phishing self-efficacy between college students’ internet self-efficacy and anti-phishing behavior and gender difference. Computers in Human Behavior, 59(0), 249-257.
    Tan, C. L., Chiew, K. L., & Wong, K. (2016). PhishWHO: Phishing webpage detection via identity keywords extraction and target domain name finder. Decision Support Systems, 88(0), 18-27.
    Van Kleef, G. A., Homan, A. C., Beersma, B., Van Knippenberg, D., Van Knippenberg, B., & Damen, F. (2009). Searing sentiment or cold calculation? The effects of leader emotional displays on team performance depend on follower epistemic motivation. Academy of Management Journal, 52(3), 562-580.
    Verhagen, T., Feldberg, F., van den Hooff, B., Meents, S., & Merikivi, J. (2011). Satisfaction with virtual worlds: An integrated model of experiential value. Information & Management, 48(6), 201-207.
    Vishwanath, A. (2017). Getting phished on social media. Decision Support Systems, 103(0), 70-81.
    Vishwanath, A., Herath, T., Chen, R., Wang, J., & Rao, H. R. (2011). Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model. Decision Support Systems, 51(3), 576-586.
    Wang, J., Herath, T., Chen, R., Vishwanath, A., & Rao, H. R. (2012). Research article phishing susceptibility: An investigation into the processing of a targeted spear phishing email. Transactions on Professional Communication, 55(4), 345-362.
    Wang, J., Li, Y., & Rao, H. R. (2017). Coping Responses in Phishing Detection: An Investigation of Antecedents and Consequences. Information Systems Research. 28(2), 378-396.
    Witte, K. (1992). Putting the fear back into fear appeals: The extended parallel process model. Communications Monographs, 59(4), 329-349.
    Workman, M. (2008). Wisecrackers: A theory‐grounded investigation of phishing and pretext social engineering threats to information security. Journal of the Association for Information Science and Technology, 59(4), 662-674.
    Wright, R. T., Jensen, M. L., Thatcher, J. B., Dinger, M., & Marett, K. (2014). Research note—influence techniques in phishing attacks: an examination of vulnerability and resistance. Information Systems Research, 25(2), 385-400.
    Wright, R. T., & Marett, K. (2010). The influence of experiential and dispositional factors in phishing: An empirical investigation of the deceived. Journal of Management Information Systems, 27(1), 273-303.
    Wu, L., Du, X., & Wu, J. (2014). MobiFish: A lightweight anti-phishing scheme for mobile phones. Paper presented at the Computer Communication and Networks International Conference. Shanghai, China.
    Wu, M., Miller, R. C., & Garfinkel, S. L. (2006). Do security toolbars actually prevent phishing attacks? Paper presented at the Proceedings of the Conference on Human Factors in Computing Systems. Montreal, Québec, Canada.
    Yee, K.-P., & Sitaker, K. (2006). Passpet: Convenient password management and phishing protection. Paper presented at the Proceedings of the second Symposium on Usable Privacy and Security. Pittsburgh, Pennsylvania, USA.
    Youn, S. (2009). Determinants of online privacy concern and its influence on privacy protection behaviors among young adolescents. Journal of Consumer affairs, 43(3), 389-418.
    Zhang, H., Liu, G., Chow, T. W., & Liu, W. (2011). Textual and visual content-based anti-phishing: a Bayesian approach. Transactions on Neural Networks, 22(10), 1532-1546.
    Zhou, Z., Fang, Y., Vogel, D. R., Jin, X.-L., & Zhang, X. (2012). Attracted to or locked in? Predicting continuance intention in social virtual world services. Journal of Management Information Systems, 29(1), 273-306.
    Zhou, Z., Jin, X.-L., Vogel, D. R., Fang, Y., & Chen, X. (2011). Individual motivations and demographic differences in social virtual world uses: An exploratory investigation in Second Life. International Journal of Information Management, 31(3), 261-271.

    下載圖示 校內:2023-09-01公開
    校外:2023-09-01公開
    QR CODE