A Gamified Phishing Simulator Using Reinforcement Learning

Every electronic message poses some threat of being a phishing attack. If recipients underestimate that threat, they expose themselves, and those connected to them, to identity theft, ransom, malware, or worse. If recipients overestimate that threat, then they incur needless costs, perhaps reducing their willingness and ability to respond over time. In two experiments, we examined the appropriateness of individuals’ confidence in their judgments of whether email messages were legitimate or phishing, using calibration and resolution as metacognition metrics. Both experiments found that participants had reasonable calibration but poor resolution, reflecting a weak correlation between their confidence and knowledge. These patterns differed for legitimate and phishing emails, with participants being better calibrated for legitimate emails, except when expressing complete confidence in their judgments, but consistently overconfident for phishing emails. The second experiment compared performance on the laboratory task with individuals’ actual vulnerability, and found that participants with better resolution were less likely to have malicious files on their home computers. That comparison raised general questions about the design of anti-phishing training and of providing feedback essential to self-regulated learning.

Dakota State University has a unique computing environment. Every undergraduate student and professor has a school assigned tablet PC. In addition, it is the State of South Dakota's premier four year technology university. The university also hosts email, website, and website services for the state's K-12 program in addition to its own. The high use of the mobile computing environment serves as a reason why we chose it for our phishing experiment. For example, recently one staff member was able to be fooled into providing domain login and password information through a phishing email. This caused over 300,000 emails to be sent from that account and the university was therefore blacklisted from Microsoft and its associated affiliates such as Hotmail and MSN. This paper is an attempt to measure the viability of a phishing attack in a mobile computing environment as well as using an adaptation of a popular spam filtering technique to separate phishing emails from spam and phishing emails from legitimate email.

Cyber Security and IT Infrastructure Protection

This paper proposes a novel framework for modelling user behaviour from low-level computer usage logs aiming to find working patterns and behaviours of employees at work. The logs we analyse are recorded in individual computers for employees in a company, and include active window transitions on display. Our framework consists of three levels of abstraction: 1 modelling user behaviour patterns by hidden Markov models; 2 clustering user behaviour models by kernel principal component analysis with a graph kernel; 3 extracting common patterns from clusters. The experimental results show that our method reveals implicit user behaviour at a high level of abstraction, and allows us to understand individual user behaviour among groups, and over time.

This paper investigates the use of reinforcement learning algorithms for automated detection of SQL injection vulnerabilities in conversational AI agents that use APIs and databases. It was developed a Gymnasium-compatible environment called SQLiChatbotEnv and implemented a system based on Proximal Policy Optimisation (PPO), Advantage Actor-Critic (A2C) and REINFORCE methods to train an intelligent agent to detect and exploit various types of SQL injections in an automated manner. The created environment simulates realistic scenarios of interaction with vulnerable chatbots, including a multi-component action space, a reward system, and mechanisms for tracking the progress of vulnerability detection. A specialised reinforcement learning environment, SQLiChatbotEnv, simulates real-world scenarios of interaction with vulnerable chatbots and allows you to configure a chatbot environment with one of 5 major database management systems to choose from (MySQL, PostgreSQL, Microsoft SQL Server, Oracle, and SQLite). SQLiChatbotEnv also supports several key types of SQL injections, such as union-based attacks and error-based exploitation, and allows you to explore the database schema – to identify table and column names. The system allows you to use SQL query obfuscation in a message to a chatbot, which allows you to bypass basic security checks that may be present in a real system. Contextual framing allows you to use the natural integration of SQL injection into the conversation, for example, masking with phrases such as ‘I'm trying to understand...’, imitating the behaviour of a regular user. To encourage the agent to search for vulnerabilities efficiently, the system allows you to configure rewards and penalties for typical actions, such as discovering new information, data leakage, or using a SQL injection template that is incompatible with the actual database type. A comparative analysis of the performance of the three reinforcement learning algorithms over 2500 training episodes is conducted. The experimental results show that A2C demonstrates the best combination of convergence speed and learning stability, reaching a reward of 100 points in 30 episodes and a final performance of 232.82 ± 16.44 with the lowest coefficient of variation of 16.5%. PPO is characterised by the slowest convergence to high thresholds (221 episodes to a score of 150) and the highest variability of results (35.6%), but demonstrates the best ability to fully detect all types of vulnerabilities (87.4% of episodes). REINFORCE shows balanced intermediate results with a moderate convergence rate (145 episodes to a reward of 100), stability (coefficient of variation 21.4%) and high efficiency of vulnerability research (78.0% of episodes with all types of attacks). The practical significance of the work is to create an automated tool for testing the security of conversational AI agents. The results of the study demonstrate the prospects of using reinforcement learning for cybersecurity tasks and automating penetration testing processes.

Shared bikes have become a primary supplement to city transportation, offering the advantages of low carbon emissions and convenience. However, low dispatching efficiency restricts their sustainable development and causes a demand-supply imbalance, affecting the user experience. This research discusses a dispatching optimisation strategy for shared bikes based on the application of Artificial Intelligence, which combines demand forecasting, user behaviour analysis, and dispatching optimisation. According to multiple machine learning methods, research demonstrates an enhancement in the accuracy of predicting and dispatching efficiency, including supervised learning, unsupervised learning, deep learning and reinforcement learning. At the application level, this paper mainly discusses how to predict shared-bike long-term or short-term demand using machine learning models, such as LSTM and XGBoost; analyse user behaviour and station classification based on clustering methods like K-Means; optimise dynamic scheduling strategies for intelligent decision-making through reinforcement learning; and detect abnormal behaviours based on the dedimensional techniques. The discussion part of the research highlights that, although existing research has made significant progress, several challenges remain. Finally, this research argues that integrating predictive analysis and scheduling optimisation will provide an important direction for the construction of an intelligent, low-carbon and sustainable shared bicycle system.

As the world rapidly transitions to digitization and cashless transactions, the use of credit cards has surged. Alongside this growth, fraudulent activities have also increased, leading to significant financial losses for institutions. Therefore, it is crucial to identify and assess fraudulent transactions to distinguish them from legitimate ones. In this study, we propose combining Deep Learning with Reinforcement Learning to effectively detect online payment fraud. Specifically, we employ a Long Short-Term Memory recurrent neural network in conjunction with a Deep Q Network, naming this hybrid model DQN-LSTM. A key challenge in this study is achieving high accuracy using an unbalanced credit card fraud dataset, compared to existing methods. Our main goal is to eliminate false positives and false negatives and improve the overall F1 score without using any data balancing techniques. For feature selection from imbalanced datasets, we utilize a deep autoencoder. The deep auto encoder generates accurate data representations that can be used for classification and reconstruction. Experimental results show that the proposed hybrid model consistently outperforms other classifiers as well as state of the arts, achieving better precision, recall and f1 score using the train-test method. Additionally, our model excels in 5-fold cross-validation, demonstrating its robustness and reliability. SHAP (SHapley Additive exPlanations) values enhance model interpretability by quantifying the contribution of each feature to the model's predictions. The SHAP summary plot provides a global view of feature importance, identifying key drivers such as “V19” and “V15” that influence the model's decisions across the European cardholder dataset. IEEE and German datasets are also tested by SHAP. On the other hand, SHAP force plots focus on local interpretability, illustrating how specific features contribute to individual predictions, making it easier to understand why a particular transaction was flagged as fraudulent.

Traffic congestion is a burgeoning issue within cities, prompted by rising populations, aging infrastructure, and inefficient traffic management systems. Current AI-based models for traffic control are mainly based on deep learning or reinforcement learning, which, as powerful as they are in prediction, have high computational complexity and poor interpretability. In contrast, rule-based symbolic AI is explainable but poor at real-time adaptation. To bridge these gaps, we introduce the NSFE, a new hybrid AI framework that combines transformer-based deep learning, rule-based GNNs and symbolic logic, and reinforcement learning to boost real-time traffic optimization decision-making. The novelty of NSFE is its attention-based fusion process that balances dynamic neural perception with symbolic reasoning while ensuring interpretability and accuracy. Deep insight module learns fast traffic patterns, while the symbolic reasoning module maintains logical constraints as well as regulation adherence. Ongoing reinforcement learning loop optimizes traffic control maneuvers at all times and adapts to changing situations. Edge computing integration maximizes computational effectiveness in order to accomplish real-time handling with zero delay. Experimental evidence shows that NSFE surpasses conventional DRL and rule-based hybrid models, realizing up to 15% better accuracy, 30% lower computational overhead, and improved resistance to anomalies. Through the fusion of high-precision forecasting with structured reasoning, NSFE delivers a scalable, interpretable, and efficient AI-based solution to urban traffic control. Apart from traffic control, its structure has wider applications in autonomous systems, finance, robotics, and IoT, hence being a revolutionary methodology to real time decision making.

We examined the patterns of cues people utilised as they attempted to classify emails as legitimate or phishing via a novel approach – an information board study. In this paradigm, participants had to click on email elements to examine them, revealing which cues are utilised in the decision-making process as well as viewing duration. An online email classification task (87 Ps) was presented, including a between-subjects’ manipulation of cognitive load. This revealed consistent patterns of behaviour associated with identification of legitimate emails such as more time spent looking at signoffs aiding in identification, whereas more time spent looking at logo and greetings was associated with worse performance. We also found no-load condition participants with lower intuitive decision-making style scores identified more phishing emails correctly suggesting elaborative processing as an important determinant of good decision-making. However, none of; cyber security experience, impulsivity, and checking the sender’s address corresponded to higher rates of phishing email identification. Furthermore, we found no behavioural, cue-based patterns associated with correct decisions for phishing emails. We speculate that this decision-making process may be based on a global, holistic interpretation of the stimuli. This has important implications for awareness campaigns suggesting a more holistic approach to email evaluation.

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Aiming at the problems existing in traditional upper limb rehabilitation training, such as low rehabilitation efficiency, single and passive training methods, etc. Deep reinforcement learning can provide a better trajectory planning scheme for the upper limb rehabilitation robot working in multi-dynamic environment. It can make more efficient and active rehabilitation training plan for rehabilitation patients. In the actual rehabilitation training, it is necessary to smooth the motion track without mutation and avoid the singular region. In this paper, DDPG deep learning reinforcement learning algorithm is used to propose an improved reward function to provide global guidance for exploring optimal trajectory planning. At the same time, the nonlinear function of the feedback regulation mechanism is constructed by dividing the working interval property to accelerate the exploration process and avoid the singular region. Experiments show that the convergence of the reward value of the improved model is significantly improved compared with the traditional model. The method proposed in this paper provides a good theoretical basis for the research of active rehabilitation control system of upper limb rehabilitation robot.

The changeable structures and variability of email attacks render current email filtering solutions useless. Consequently, the need for new techniques to harden the protection of users' security and privacy becomes a necessity. The variety of email attacks, namely spam, damages networks' infrastructure and exposes users to new attack vectors daily. Spam is unsolicited email which targets users with different types of commercial messages or advertisements. Porn-related content that contains explicit material or commercials of exploited children is a major trend in these messages as well. The waste of network bandwidth due to the numerous number of spam messages sent and the requirement of complex hardware, software, network resources, and human power are other problems associated with these attacks. Recently, security researchers have noticed an increase in malicious content delivered by these messages, which arises security concerns due to their attack potential. More seriously, phishing attacks have been on the rise for the past couple of years. Phishing is the act of sending a forged e-mail to a recipient, falsely mimicking a legitimate establishment in an attempt to scam the recipient into divulging private information such as credit card numbers or bank account passwords (James, 2005). Recently phishing attacks have become a major concern to financial institutions and law enforcement due to the heavy monetary losses involved. According to a survey by Gartner group, in 2006 approximately 3.25 million victims were spoofed by phishing attacks and in 2007 the number increased by almost 1.3 million victims. Furthermore, in 2007, monetary losses, related to phishing attacks, were estimated by $3.2 billion. All the aforementioned concerns raise the need for new detection mechanisms to subvert email attacks in their various forms. Despite the abundance of applications available for phishing detection, unlike spam classification, there are only few studies that compare machine learning techniques in predicting phishing emails (Abu-Nimeh et al., 2007). We describe a new version of Bayesian Additive Regression Trees (BART) and apply it to phishing detection. A phishing dataset is constructed from 1409 raw phishing emails and 5152 legitimate emails, where 71 features (variables) are used in classifiers' training and testing. The variables consist of both textual and structural features that are extracted from raw emails. The performance of six classifiers, on this dataset, is compared using the area under the curve (AUC) (Huang & Ling, 2005). The classifiers include Logistic Regression (LR), Classification and Regression Trees (CART), Bayesian Additive Regression Trees (BART), Support Vector Machines (SVM), Random O pe n A cc es s D at ab as e w w w .in te ch w eb .o rg

Let's Go Phishing: A Phishing Awareness Campaign Using Smishing, Email Phishing, and Social Media Phishing Tools

School systems may pay attention to the fact that individuals and companies using smart devices are increasingly at risk of becoming victims of cybercrime. The literature on how effective students in developed countries such as the Netherlands are taught about cyber security skills during their school career is scarce. Although curriculum materials are available, scaling up computer science education is behind. Therefore, this study explores to what extent Dutch students develop cyber secure behavior at elementary and high school. A questionnaire was used for self-assessment of cyber security behavior. After the questionnaire was completed, two group interviews were conducted to improve the interpretation of the questionnaire results. The study findings revealed that the Dutch school curriculum hardly pays attention to this topic and that students acquire their online behavior mainly through experience, instructions on the internet, through parents, and through siblings. In addition, many students developed more reckless behavior over time. We recommend that cyber security education should start at elementary school as soon as children begin to use online equipment. A subject that deserves special attention is recognizing phishing emails and phishing websites. The learners should be convinced that risky behavior on the internet may turn against them and against the organization to which they belong.

The misuse of privileges by users can lead to significant reputational and financial losses for enterprises. To reduce the risk of information leakage, it is crucial to detect and analyze abnormal behaviours of internal employees. Firstly, based on the characteristics of internal employee behaviour, a data filter strategy based on user behaviour is proposed. Then, a data balancing strategy based on the concept of hybrid sampling is introduced. Moreover, to further construct the behaviour model, an improved particle swarm optimization algorithm based on adaptive delay and genetic factors is proposed, and it is used to search for the optimal parameters of LightGBM. Experimental results demonstrate that the proposed method is highly effective in detecting internal threats.