Toward Increasing Awareness of Suspicious Content through Game Play

Phishing, elicitation, and impersonation techniques are performed using multiple forms, targeting content specific to the delivery modality, such as email, social media, and general browser communications. Education to increase awareness is one mechanism to combat phishing. Average email and internet users are less attentive to media warnings and training materials provided by employers than they are in interactive environments. In this paper, we overview a game concept that immerses users in a role play challenge where they must send email, use social media, and browse the web and determine whether content received within these modalities is trustworthy or not. The game, built as a Javascript framework, simulates phishing scams, measures trust and suspicion levels, and individualizes training for users. The game architecture employs components that facilitate dynamic content generation in each of the modalities, customize experiment design for specific assessment and training, and perform sophisticated tracking for automated analysis of user trust content assessments. We discuss the game content, the specific requirements the game must comply with, and the experiments to be conducted using the game.