A method for identifying cognitive bias exploitation in phishing emails

Abstract

The present invention provides an identification method for the exploitation of cognitive biases in phishing emails, aiming to detect cognitive biases in phishing emails. By combining natural language processing, machine learning and artificial intelligence technology, the method accurately identifies and analyzes cognitive biases in the content of phishing emails that are designed to manipulate user psychology, thereby revealing the attacker's psychological manipulation mechanism. The identification method of the present invention not only enhances the understanding of phishing email strategies, but also provides a scientific basis for formulating effective preventive measures, thereby more effectively reducing the risk of users being deceived. It is a new method for enhancing phishing email defense from a cognitive level.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and in particular relates to a method for identifying cognitive bias exploitation in phishing emails. Background Art

[0002] The rapid development of the Internet has greatly changed the quality and way of people's lives, bringing unprecedented convenience and opportunities. However, with the popularization of the Internet, criminals have also begun to use this platform to launch various network attacks, such as Trojan viruses, cross-site scripting attacks, SQL injections, etc., to steal user privacy and property. Although network defense technology continues to advance, the success rate of attackers at the technical level has declined, but they have turned to exploit human weaknesses and adopt more covert social engineering attack methods. Social engineering attacks do not directly target technical systems, but target human psychology. Attackers use carefully designed deception, manipulation or misleading strategies to induce users to unconsciously perform harmful operations or disclose sensitive information. This type of attack relies on a deep understanding of human behavior and the clever use of psychological tactics, making it a major threat to network security.

[0003] With the development of the Internet, email has become an indispensable part of global communication. According to Statista, the number of global email users reached 4.26 billion in 2022 and is expected to grow to 4.73 billion by 2026. At the same time, it is expected that by 2025, the number of daily emails sent and received worldwide will reach 376 billion. The widespread use of email has also attracted many attackers, making it the main carrier of social engineering attacks, especially phishing email attacks. The continuous evolution and spread of phishing email attacks have had a significant negative impact on global economic stability and personal information security. These emails usually use carefully planned fraudulent means to induce users to inadvertently disclose personal information, bank account details, and even install malware. According to Coremail statistics, in the fourth quarter of 2023, the number of phishing emails in China reached 141 million, an increase of 111% compared with the same period last year, almost twice the same period of the previous year.

[0004] Current research in the field of phishing emails mainly focuses on the development of identification technologies, aiming to detect and intercept these malicious emails through various algorithms and mechanisms. However, these studies rarely delve into the root causes of why phishing emails are able to successfully deceive recipients. In particular, no research has focused on analyzing how phishing emails exploit people's cognitive biases to achieve their deceptive purposes. The lack of this area means that our strategies for defending against phishing emails may only remain at the surface level, without touching on the deeper psychological mechanisms, that is, how attackers exploit people's thinking patterns to design effective baits.

[0005] The difficulty of this research is that, firstly, there is no clear framework or theoretical basis for identifying and understanding cognitive biases in phishing emails. Secondly, there is a lack of relevant experimental data and empirical research, especially the cognitive biases contained in phishing emails, which need to be labeled on a large scale in combination with expert experience. Finally, this research direction is at the intersection of psychology and network security technology, which requires people to cross disciplinary boundaries and integrate knowledge and methods from different fields. Summary of the invention

[0006] In order to solve the problem that the existing technology fails to fully identify the psychological manipulation methods in phishing emails, the present invention provides a method for identifying the exploitation of cognitive biases in phishing emails, accurately identifying and analyzing the strategies designed to manipulate the user's psychology in the content of phishing emails, revealing the attacker's psychological manipulation mechanism, and providing a scientific basis for formulating effective preventive measures, thereby more effectively reducing the risk of users being deceived.

[0007] A method for identifying cognitive biases in phishing emails, using an artificial intelligence classification model to identify cognitive biases in phishing emails, wherein the training method of the artificial intelligence classification model is:

[0008] The pre-trained language representation model BERT is used to extract the text features of each phishing email in the phishing email dataset;

[0009] The TF-IDF method is used to obtain the word weight of each word in each phishing email;

[0010] The text sentiment analysis model VADER is used to obtain the sentiment score of each phishing email;

[0011] The text features of each phishing email, the word weight of each word, and the sentiment score are integrated to obtain the feature vector corresponding to each phishing email;

[0012] The feature vectors corresponding to each phishing email are sent to the long short-term memory network LSTM and the multi-layer perceptron MLP respectively, and the corresponding cognitive bias category vector prediction values ​​of each phishing email are obtained. Predicted value of cognitive bias category vector ; Among them, the cognitive bias category vector is composed of authority bias, anchoring effect, urgency bias, curiosity effect, zero risk bias, and social identity;

[0013] Will and Perform weighted fusion to obtain the final cognitive bias category vector prediction value corresponding to each phishing email ;

[0014] According to the cognitive bias category vector label value and cognitive bias category vector prediction value corresponding to each phishing email The cross entropy loss function is constructed based on the difference between them to perform back propagation on LSTM and MLP respectively, so as to adjust the network parameters of LSTM and MLP until the final LSTM and MLP are obtained.

[0015] Furthermore, the method for obtaining the label value of the cognitive bias category vector is:

[0016] Use the pre-trained sentiment analysis model to obtain the sentiment tendency of each phishing email in the phishing email dataset;

[0017] Text analysis technology is used to extract keywords and phrases related to cognitive bias contained in each phishing email in the phishing email dataset, wherein the cognitive bias includes authority bias, anchoring effect, urgency bias, curiosity effect, zero risk bias, and social identity;

[0018] Experts annotated the cognitive bias category vector label value corresponding to each phishing email in the phishing email dataset based on the emotional tendency of each phishing email and the keywords and phrases related to cognitive bias.

[0019] Furthermore, multiple experts annotate the cognitive bias category vector label value for the same phishing email, and use the most frequently appearing annotated result as the cognitive bias category vector label value corresponding to the current phishing email.

[0020] Furthermore, the cognitive bias category vector is a 6-bit vector composed of 0 and 1, wherein if any bit is 1, it indicates that the cognitive bias corresponding to the bit exists in the phishing email, and if any bit is 0, it indicates that the cognitive bias corresponding to the bit does not exist in the phishing email.

[0021] Furthermore, before obtaining the text features, word weights of each word, and sentiment scores of each phishing email, each phishing email is first cleaned, wherein the cleaning method is:

[0022] Remove HTML tags from each phishing email;

[0023] All text in each phishing email is converted to lowercase or uppercase;

[0024] Eliminate non-specified languages ​​in phishing emails;

[0025] Remove special characters and stop words from each phishing email;

[0026] Perform stem extraction and lemmatization on the words in each phishing email.

[0027] Beneficial effects:

[0028] 1. The present invention provides a method for identifying the exploitation of cognitive biases in phishing emails, aiming to detect cognitive biases in phishing emails. By combining natural language processing, machine learning, and artificial intelligence technologies, it accurately identifies and analyzes the cognitive biases designed to manipulate users' psychology in the content of phishing emails, revealing the psychological manipulation mechanism of attackers. The identification method of the present invention not only enhances the understanding of phishing email strategies but also provides a scientific basis for formulating effective preventive measures, thereby more effectively reducing the risk of users being deceived. It is a new method for enhancing phishing email defense at the cognitive level.

[0029] 2. The present invention provides a method for identifying the exploitation of cognitive biases in phishing emails. Through expert experience, it deeply analyzes and defines the cognitive biases in phishing emails, and then constructs a phishing email cognitive bias dataset, which can not only promote the development of accurate models but also deepen the understanding of the psychological manipulation mechanism of phishing emails.

[0030] 3. The present invention provides a method for identifying the exploitation of cognitive biases in phishing emails. Data cleaning ensures the quality of data for subsequent analysis model and model training. Specifically, all HTML codes are deleted from the email text, leaving only the plain text content for subsequent analysis; all texts are uniformly converted to lowercase or uppercase to eliminate the differences in letter case in text processing; according to the language to be analyzed, specific language email texts are screened out to exclude the interference of other languages; non-alphanumeric characters such as punctuation marks and common meaningless words such as "de", "he" are deleted from the text to simplify the text data; stemming is used to reduce the differences of words to their root forms, or lemmatization is used to restore words to their original forms to unify the vocabulary forms, which is helpful for text analysis and processing.

[0031] 4. The present invention provides a method for identifying the exploitation of cognitive biases in phishing emails. It extracts the text features of the phishing email body through BERT, pays attention to the weight features of the words in the phishing email body through TF-IDF, and extracts the sentiment features of the phishing email body through VADER. That is to say, the present invention uses multiple technologies to simultaneously mine the key information of the email text, pays attention to the features of different dimensions of the phishing email, which is conducive to identifying more accurate cognitive biases.

[0032] 5. The present invention provides a method for identifying cognitive biases used in phishing emails. A phishing email cognitive bias dataset is constructed through expert experience to fill in the gaps in the data, and then efficient data processing and advanced analysis models are used to identify specific psychological induction elements used in phishing emails. Specifically, when annotating the phishing email dataset, sentiment analysis is used to identify emotional tendencies in email texts, which helps to reveal how emails trigger specific emotional reactions, and then use these emotional reactions to induce cognitive biases; text analysis technology is used to extract keywords and phrases related to cognitive biases contained in each phishing email in the phishing email dataset, which can quickly locate email content that may contain cognitive biases; manual annotation can play a key role in subtle and complex situations that are difficult for automated methods to handle, and can more accurately identify and classify cognitive biases in emails. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flowchart of a method for identifying cognitive bias exploitation in phishing emails provided by the present invention.

[0034] Figure 2 This is a diagram of the feature extraction and recognition model architecture provided by the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0036] Cognitive biases in phishing emails refer to systematic errors that people may make when processing information. These cognitive biases are cleverly used by phishing email designers to increase the success rate of fraud. By combining psychological principles and information security-related content, psychological theory provides a definition of cognitive biases, while information security provides actual cases of cognitive biases being applied in phishing emails. By studying common thinking loopholes in the human decision-making process, we can define specific cognitive biases that may be exploited in phishing emails. These cognitive biases manipulate the victim's cognitive process to prompt the victim to take specific actions.

[0037] When defining the specific bias, we rely on the in-depth analysis of systematic biases that occur in people's decision-making processes in psychology. For example, people pay more attention to things that interest them (curiosity effect), or how people are influenced by information they are exposed to for the first time (anchoring effect). These are common cognitive manipulation techniques in phishing emails. While analyzing based on psychology, combined with information security knowledge, we analyze how cognitive biases are transformed into specific email content. For example, using urgent language to prompt recipients to have the illusion that they must act immediately, or disguising as a credible source to exploit authority bias or social identity. The following are some examples of cognitive biases that frequently appear in phishing emails that have been analyzed and are used to manipulate target victims:

[0038] 1) Authority Bias: The email usually claims to be from an important person or his agent, claiming that he needs help transferring large amounts of money out of the country.

[0039] 2) Anchoring effect: The emails usually promise huge rewards to those who help, usually millions of dollars.

[0040] 3) Urgency bias: Emails often create an atmosphere of urgency, urging recipients to act quickly to avoid missing opportunities.

[0041] 4) Curiosity effect: Emails often tell a story to stimulate the victim’s curiosity, sympathy, anger, etc.

[0042] 5) Zero-risk bias: The email states that the behavior is zero-risk or guaranteed not to be discovered, using the identity of an insider.

[0043] 6) Social proof: Emails exploit this sense of proof by faking social media updates, comments, or recommendations, misleading victims into believing the legitimacy of the email content.

[0044] In the process of studying cognitive bias in phishing emails, data collection is a key step. The datasets come from two datasets, one is a collection of emails focusing on Nigerian scams, and the other is a mixed dataset containing multiple types of phishing emails. The two datasets provide a wealth of relevant cases, including classic "419" scam emails and other phishing emails such as fake banks and social engineering attacks.

[0045] Through case analysis of phishing emails impersonating banks, the present invention finds that: phishing emails usually first fabricate the identity of a false bank insider, utilizing the authority bias; phishing emails arouse the curiosity of recipients by making up stories, utilizing the curiosity effect; phishing emails promise recipients that "there is no risk", utilizing the zero-risk bias; and phishing emails urge recipients to "reply immediately" at the end, utilizing the urgency bias.

[0046] It can be seen that by defining and understanding the above cognitive biases in detail, we can better identify and prevent cognitive manipulation strategies in phishing emails.

[0047] However, supervised learning algorithms represented by machine learning and deep learning usually rely on large-scale labeled samples to continue model training and data mining. In the field of research on cognitive bias in phishing emails, there is currently a lack of specialized annotation and induction work, which limits the in-depth research in this field. In order to fill this gap, it is particularly important to analyze and define cognitive biases in phishing emails through in-depth analysis of expert experience and then construct a phishing email cognitive bias dataset through a variety of methods. This can not only promote the development of accurate models, but also deepen the understanding of the psychological mechanism of phishing email manipulation.

[0048] Specifically, Figure 1 As shown, the present invention provides a method for identifying cognitive bias exploitation in phishing emails, comprising the following contents:

[0049] (1) Constructing a phishing email cognitive bias dataset: This paper proposes a process for constructing a phishing email cognitive bias dataset, including phishing email cognitive bias analysis and definition, phishing email data collection, sentiment analysis methods, keyword detection and recognition, and manual labeling methods, thereby forming the "Phishing Email Cognitive Bias_500" dataset. This dataset fills a gap in this field, not only promoting a deeper understanding of the use of cognitive bias in phishing emails, but also providing researchers with resources for use. It also opens up new avenues for interdisciplinary research in the fields of psychology and information security, and promotes knowledge sharing and technical integration between the two fields.

[0050] (2) Phishing email cognitive bias identification model: Based on the above data set, the data is first cleaned. The data cleaning methods include removing HTML tags, case conversion, language screening, special characters and stop words removal, stemming, and word form restoration. After the data cleaning is completed, a variety of methods are used to extract the features of the data set, including BERT text feature extraction, TF-IDF feature extraction, and VADER text sentiment analysis, and multiple features are integrated to form richer text features. After the feature extraction is completed, an accurate classification model is constructed to specifically identify cognitive biases in phishing emails. At the same time, the constructed classification model is tested using the cross-validation method, and the performance of the model is evaluated using a variety of performance indicators, such as accuracy and recall.

[0051] That is to say, the present invention provides a method for identifying cognitive biases in phishing emails, which uses an artificial intelligence classification model to identify cognitive biases in phishing emails, wherein the training method of the artificial intelligence classification model is:

[0052] S0: Clean each phishing email in the phishing email data set, and use the cleaned phishing emails to perform subsequent steps, wherein the cleaning method is:

[0053] 1) Remove HTML tags from each phishing email. It should be noted that since phishing emails are often written in HTML format and contain a large amount of tags and style information, regular expressions are used to remove all HTML codes from the email text and retain the plain text content, thus removing irrelevant formatting information and allowing the recognition model to focus on the actual text content of the email.

[0054] 2) All texts in each phishing email are uniformly converted to lowercase or uppercase. It should be noted that the difference in uppercase and lowercase in the text may cause different forms of the same word to be regarded as different terms, which may affect the results of text processing. In order to eliminate this difference, all texts are uniformly converted to lowercase or uppercase, thereby ensuring the consistency of terms.

[0055] 3) Eliminate non-specified languages ​​in each phishing email; It should be noted that phishing emails may involve other, designated target languages ​​of emails. Automatic tools are used to identify the designated target languages ​​of emails, and email texts in the designated target languages ​​are screened out to eliminate interference from other non-specified languages, thus ensuring the accuracy and efficiency of the analysis.

[0056] 4) Remove special characters and stop words from each phishing email. It should be noted that special characters and stop words (words that are extremely common in a specific language but have little meaning to the text, such as "the" and "and" in English) in the email text may interfere with text analysis. Remove special characters and stop words to further simplify the text data and highlight meaningful information.

[0057] 5) Perform stemming and lemmatization on the words in each phishing email; It should be noted that both stemming and lemmatization aim to convert words into a more basic form in order to unify lexical forms and reduce lexical diversity. Stemming reduces the difference between words and their basic forms by removing affixes, while lemmatization attempts to restore inflected words to their original form or dictionary form. In this way, different forms of the same word can be correctly classified and compared in text analysis.

[0058] S1: The pre-trained language representation model BERT is used to extract the text features of each phishing email in the phishing email dataset. That is, the powerful language understanding ability of BERT is used to extract deep semantic features.

[0059] It should be noted that BERT is a pre-trained deep learning model based on the Transformer architecture. It has mastered rich language knowledge and language comprehension capabilities through pre-training on a large-scale text corpus. In the feature extraction of phishing email text, the BERT model is used to capture the deep semantic information in the email, including context associations and potential language models. First, the email text The segmented words are converted into BERT model input word sequence ,in Indicates the number of tokens in the email text. Then each token is embedded into a fixed-length vector as follows middle:

[0060]

[0061] in, , The length of is defined as 768.

[0062] Each word is represented as a vector with a dimension of 768. These high-dimensional feature vectors not only capture the original meaning of the word, but also focus on the meaning of the word in context, using BERT's bidirectional training mechanism to integrate the contextual information on the left and right sides. , context word vector It can be expressed as:

[0063]

[0064] Finally, the feature vector is extracted from the BERT model as the email representation through the pooling layer and the specific layer output method. .

[0065] S2: Use the TF-IDF method to obtain the word weight of each word in each phishing email to capture the importance of keywords;

[0066] It should be noted that the TF-IDF method measures the importance of each word in an email. In the process of extracting features from phishing email text, each email text is first segmented into individual terms and the word importance is calculated. In a single email The word frequency in , use the following formula to calculate word frequency:

[0067]

[0068] in Yes word In Mail The number of occurrences in the denominator is the number of emails The total number of occurrences of all words in .

[0069] Then calculate the inverse document frequency , by taking the logarithmic form of the total number of emails divided by the number of emails containing the term), we can reduce the weight of frequently occurring words and increase the weight of those rare but important words, using the formula:

[0070]

[0071] in Is a mail collection Total number of emails, Contains words The number of emails.

[0072] Then multiply TF and IDF using the following formula:

[0073]

[0074] Finally, for each phishing email, use the above method to calculate the email’s The values ​​form a feature vector , represents the importance of different words in the email body, Specifically, it can be expressed using the following formula:

[0075]

[0076] in, Indicates different words in the body of the message.

[0077] S3: Use the text sentiment analysis model VADER to obtain the sentiment score of each phishing email, that is, use the sentiment analysis tool to extract the emotional tendency of the email text as an auxiliary feature for cognitive bias identification;

[0078] It should be noted that sentiment analysis methods are used to assist in labeling when constructing cognitive bias data for phishing emails. In addition to obtaining emotions related to fear, greed, sense of security, and sense of urgency that may exist in emails, sentiment analysis models can also output sentiment classifications and sentiment intensity scores. By analyzing the emotional tendencies in email texts, auxiliary features are provided for recognition models. VADER (Valence Aware Dictionary and sEntiment Reasoner) is a text sentiment analysis model that is suitable for social media and short text sentiment analysis scenarios. VADER analyzes the emotional tendencies of texts based on dictionaries and rules. First, a pre-defined list of emotion-dense vocabulary and a set of rules that consider the intensity and context of emotional expression in the text are used to classify the body of the email. , the sentiment score can be obtained as follows:

[0079]

[0080] in, is the number of sentiment words in the text, It is The scores of sentiment words are obtained from the sentiment dictionary in VADER.

[0081] Then, VADER further adjusts the sentiment score of each word, such as negative words, strengthening words, etc., by adjusting the vocabulary scores as follows:

[0082]

[0083] in, is a function that adjusts the sentiment score according to the context, Indicates Contextual information of a word.

[0084] Finally, the compliance score is calculated as follows:

[0085]

[0086] The score is normalized to the [-1, 1] interval through the normalization function, where positive values ​​represent positive emotions, negative values ​​represent negative emotions, and the absolute value represents the intensity of the emotion. The final emotion score .

[0087] S4: The text features of each phishing email, the word weight of each word, and the sentiment score are integrated to obtain the feature vector corresponding to each phishing email;

[0088] It can be seen that the present invention uses steps S1 to S3 to focus on the features of different dimensions of phishing emails respectively. BERT is used to extract the text features of the phishing email body, TF-IDF is used to focus on the weight features of the words in the phishing email body, and VADER is used to extract the emotional features of the phishing email body. A simple feature fusion method is used to directly merge the three features into a feature array through numpy's concatenate.

[0089]

[0090] in, Respectively represent the feature vectors extracted by BERT, TF-IDF, and VADER. That is to say, in order to obtain more comprehensive features, the present invention adopts Figure 2 The multiple technologies shown simultaneously mine key information in email text, which is conducive to identifying more accurate cognitive biases.

[0091] S5: The feature vectors corresponding to each phishing email are sent to the long short-term memory network LSTM and the multi-layer perceptron MLP respectively to obtain the cognitive bias category vector prediction value corresponding to each phishing email. Predicted value of cognitive bias category vector ; Among them, the cognitive bias category vector is composed of authority bias, anchoring effect, urgency bias, curiosity effect, zero risk bias, and social identity; at the same time, the cognitive bias category vector is a 6-bit vector composed of 0 and 1, where if any bit is 1, it means that the cognitive bias corresponding to the bit exists in the phishing email, and if any bit is 0, it means that the cognitive bias corresponding to the bit does not exist in the phishing email;

[0092] That is to say, the present invention constructs a classification model scheme to efficiently process the above-mentioned fused feature vectors to identify cognitive biases in phishing emails. The model architecture comprehensively considers the advantages and characteristics of the long short-term memory network (LSTM) and the multi-layer perceptron (MLP), and designs the network hierarchy in combination with the characteristics of phishing emails, such as Figure 2 As shown, in obtaining the above features The classification model designed later uses two paths to process features separately. The features are sent to LSTM and MLP for processing respectively. The dual-path structure allows the model to analyze and understand the cognitive bias in phishing emails from two different perspectives, thereby improving the accuracy and robustness of recognition.

[0093] LSTM has advantages in processing sequence data. It can be used to identify and abstract long-term dependent features in email text. The overall fusion features are processed by the LSTM layer. The processing results will be directly used for the final classification task. The output results are given by express:

[0094]

[0095] Specifically, it is expressed as the probability that the email contains each cognitive bias category.

[0096] The MLP model can directly output classification results by analyzing the complex relationship between features through deep network results :

[0097]

[0098] Specifically, it is expressed as the probability that the email contains each cognitive bias category.

[0099] S6: and Perform weighted fusion to obtain the final cognitive bias category vector prediction value corresponding to each phishing email :

[0100]

[0101] in, is a parameter between 0 and 1 that controls the relative importance of the LSTM output and the MLP output in the final prediction. The value of can find the optimal model fusion strategy to achieve the best classification performance.

[0102] S7: Based on the cognitive bias category vector label value and cognitive bias category vector prediction value corresponding to each phishing email The cross entropy loss function is constructed based on the difference between them to perform back propagation on LSTM and MLP respectively, so as to adjust the network parameters of LSTM and MLP until the final LSTM and MLP are obtained.

[0103] It should be noted that phishing email cognitive bias recognition is a classification task, so the cross entropy loss function is used in the training process. To measure the difference between the predicted value and the true value:

[0104]

[0105] in, is the number of cognitive bias categories, is the actual cognitive bias category vector label value, is the predicted value of the cognitive bias category vector predicted by the model.

[0106] The training was conducted on a server equipped with an NVIDIA GeForce RTX 4090 24G GPU. The Adam optimizer was selected as the optimizer because it combines the advantages of the AdaGrad and RMSProp optimizers and can adaptively adjust the learning rate of each parameter. The training batch size was set to 64 and the number of iterations was 100. To prevent overfitting, the early stopping method was used to detect the loss on the validation set. If the loss did not drop significantly for 10 consecutive epochs, the training was stopped.

[0107] It should be noted that in the preliminary stage of constructing a phishing email cognitive bias dataset, the key is to accurately define which cognitive biases may be exploited by phishing emails. This step involves studying psychological theories and identifying key bias types such as acquired heuristics, confirmation bias, and overconfidence. These biases explain how people make decisions in the absence of complete information and provide a theoretical basis for labeling phishing emails in the dataset.

[0108] Specifically, the label value of the cognitive bias category vector is obtained through manual annotation. In the process of labeling the cognitive bias of phishing emails, a series of methods are used to deeply analyze the content of the email, including sentiment analysis methods, keyword detection and recognition, and manual labeling methods. Multiple methods are combined to jointly reveal and understand the cognitive bias in the email. After analyzing and labeling the phishing emails, a recognition model can be developed for the cognitive bias of phishing emails. The model automatically identifies and classifies the cognitive bias in the email by using the data set obtained by labeling, combined with machine learning and natural language processing.

[0109] Specifically, the method for obtaining the label value of the cognitive bias category vector is:

[0110] Step 1: Use a pre-trained sentiment analysis model to obtain the sentiment tendency of each phishing email in the phishing email dataset; it should be noted that the present invention uses a natural language processing related pre-training model to perform sentiment analysis, because phishing emails may contain different emotional tendencies, such as fear, greed, sense of security, sense of urgency, etc. Different emotional tendencies can trigger specific emotional reactions of the recipient, and use the recipient's emotional reaction to cause the recipient's cognitive bias, and then take action or make decisions that are not in their favor. Through fine sentiment analysis, the emotional tendencies in the email text, such as fear, greed or sense of security, can be identified. It can be found how the email uses language skills to shape related emotions such as urgency and trust, prompting the recipient to fall into urgency bias and ignore rational thinking and rush to act. For example, the urgent emotion reflected in the email is often associated with the urgency bias. Therefore, sentiment analysis helps to reveal how emails trigger specific emotional reactions, and then use these emotional reactions to induce cognitive biases.

[0111] Step 2: Use text analysis technology to extract keywords and phrases related to cognitive bias contained in each phishing email in the phishing email data set, where the cognitive bias includes authority bias, anchoring effect, urgency bias, curiosity effect, zero-risk bias, and social identity; it should be noted that the present invention uses text analysis technology to identify specific keywords and phrases in emails, and these elements are often closely related to specific types of cognitive biases. For example, phrases such as "act now" and "last chance" may imply time pressure, causing the recipient to make decision-making errors due to a sense of urgency. At the same time, keyword detection in text analysis technology can be automatically executed to efficiently process data, and it can also be an auxiliary tool in the manual annotation process to quickly locate email content that may contain cognitive biases.

[0112] Step 3: Experts mark the cognitive bias category vector label value corresponding to each phishing email in the phishing email dataset based on the sentiment tendency of each phishing email and the keywords and phrases related to cognitive bias.

[0113] It should be noted that in the process of phishing email annotation, although sentiment analysis methods and keyword detection provide a basis for emotional tendencies and potential cognitive biases in preliminary identification, and keyword automated detection methods can efficiently process large amounts of data, the application of these technologies is ultimately intended to assist humans in more accurate analysis, and manual annotation is indispensable, especially when dealing with complex cognitive bias issues. Through in-depth reading and analysis by professionals, the implicit meaning and context of the text can be captured. Professionals can identify the cognitive biases used in emails based on context and psychological principles. Manual annotation can solve ambiguous and complex situations that are difficult for automated tools to solve, such as a sentence may trigger different cognitive biases in different contexts, thereby more accurately identifying and classifying cognitive biases in emails.

[0114] The implementation of manual labeling strategy requires personnel with professional backgrounds in psychology and information security, and requires the customization of unified standards: using cross-validation methods to improve labeling accuracy, by having multiple labelers independently evaluate the same email and compare their results, and using the most frequently occurring labeling results as the cognitive bias category vector label value corresponding to the current phishing email to resolve labeling disagreements. In addition, it is necessary to regularly review labeling results and analyze errors to resolve controversial phishing emails.

[0115] By combining sentiment analysis, keyword detection and manual labeling, the preliminary phishing email cognitive bias labeling work was completed. A total of 500 emails were labeled with eight different cognitive biases to form the phishing email cognitive bias_500 dataset.

[0116] Furthermore, in order to ensure the accuracy and robustness of the phishing email cognitive bias identification model and comprehensively evaluate the performance and generalization ability of the model, the present invention needs to adopt a systematic testing and verification process, such as the K-fold cross-validation method, to illustrate the effectiveness of the present invention.

[0117] Specifically, the entire phishing email dataset is evenly divided into K subsets, one of which is selected as the test set each time, and the remaining K-1 subsets are used as training sets. This process is repeated K times, and a different subset is selected as the test set each time. Finally, the evaluation results of K times are averaged to obtain a comprehensive and objective evaluation of the model performance. In other words, the present invention uses techniques such as K-fold cross-validation to evaluate the performance of the model on different data subsets to ensure that the model has good generalization ability.

[0118] In addition, multiple evaluation indicators, such as precision, recall, F1 score, etc., are used to evaluate the performance of the model comprehensively, as follows:

[0119] Accuracy : Precision refers to the proportion of samples correctly predicted as positive by the model to all samples predicted as positive. The higher the precision, the more accurate the model is in identifying phishing emails.

[0120]

[0121] Recall : Recall refers to the proportion of samples correctly predicted by the model as positive to all samples that are actually positive. The higher the recall, the fewer cases where the model misses phishing emails.

[0122]

[0123] F1 score: The F1 score is the harmonic average of precision and recall, and is used to measure the accuracy and robustness of the model. A higher F1 score indicates that the model has achieved a better balance between precision and recall.

[0124]

[0125] in, indicates that the true positives, i.e., the phishing emails that actually contain cognitive bias, are also correctly predicted as phishing emails that contain cognitive bias. represents a false positive, that is, a phishing email that actually does not contain cognitive bias is mistakenly predicted to contain cognitive bias. It represents a false negative example, that is, a phishing email that actually does not contain cognitive bias is mistakenly predicted to be a phishing email containing cognitive bias; through the above methods and indicators, it can ensure that the method proposed in the present invention is evaluated and verified in detail.

[0126] In summary, the present invention provides a method for identifying the use of cognitive bias in phishing emails. When using machine learning and artificial intelligence classification models to identify cognitive bias in phishing emails, the method mainly includes the following steps: cleaning the text data of the phishing email body; extracting features from the text data of the phishing email body; building and training a phishing email cognitive bias identification model; and verifying and testing the phishing email cognitive bias identification model.

[0127] It can be seen that the present invention aims to detect cognitive biases in phishing emails, and by combining natural language processing, machine learning and artificial intelligence technology, accurately identify and analyze strategies designed to manipulate user psychology in the content of phishing emails; the scheme constructs a phishing email cognitive bias data set through expert experience to fill in the gaps in the data, and then uses efficient data processing and advanced analysis models to identify the specific psychological induction elements used by phishing emails; that is, the present invention provides a new method for enhancing phishing email defense from a cognitive level, and through in-depth analysis of cognitive biases in emails, reveals the attacker's psychological manipulation mechanism, which not only enhances the understanding of phishing email strategies, but also provides a scientific basis for formulating effective preventive measures, thereby more effectively reducing the risk of users being deceived, and solving the problem that the prior art fails to fully identify psychological manipulation methods in phishing emails.

[0128] Of course, the present invention may have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art may certainly make various corresponding changes and modifications based on the present invention, but these corresponding changes and modifications should all fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for identifying cognitive bias exploitation in phishing emails, characterized in that: An artificial intelligence classification model is used to identify cognitive biases in phishing emails. The training method of the artificial intelligence classification model is as follows: The pre-trained language representation model BERT is used to extract the text features of each phishing email in the phishing email dataset; The TF-IDF method is used to obtain the word weight of each word in each phishing email; The text sentiment analysis model VADER is used to obtain the sentiment score of each phishing email; The text features of each phishing email, the word weight of each word, and the sentiment score are integrated to obtain the feature vector corresponding to each phishing email; The feature vectors corresponding to each phishing email are sent to the long short-term memory network LSTM and the multi-layer perceptron MLP respectively, and the corresponding cognitive bias category vector prediction values ​​of each phishing email are obtained. Predicted value of cognitive bias category vector ; Among them, the cognitive bias category vector is composed of authority bias, anchoring effect, urgency bias, curiosity effect, zero risk bias, and social identity; Will and Perform weighted fusion to obtain the final cognitive bias category vector prediction value corresponding to each phishing email ; According to the cognitive bias category vector label value and cognitive bias category vector prediction value corresponding to each phishing email The cross entropy loss function is constructed based on the difference between them to perform back propagation on LSTM and MLP respectively, so as to adjust the network parameters of LSTM and MLP until the final LSTM and MLP are obtained.

2. A method for identifying cognitive bias exploitation in phishing emails as claimed in claim 1, characterized in that: The method for obtaining the label value of the cognitive bias category vector is: Use the pre-trained sentiment analysis model to obtain the sentiment tendency of each phishing email in the phishing email dataset; Text analysis technology is used to extract keywords and phrases related to cognitive bias contained in each phishing email in the phishing email dataset, wherein the cognitive bias includes authority bias, anchoring effect, urgency bias, curiosity effect, zero risk bias, and social identity; Experts annotated the cognitive bias category vector label value corresponding to each phishing email in the phishing email dataset based on the emotional tendency of each phishing email and the keywords and phrases related to cognitive bias.

3. A method for identifying cognitive bias exploitation in phishing emails as claimed in claim 2, characterized in that: Multiple experts annotate the cognitive bias category vector label value for the same phishing email, and use the most frequently appearing annotation result as the cognitive bias category vector label value corresponding to the current phishing email.

4. A method for identifying cognitive bias exploitation in phishing emails as claimed in claim 1 or 2, characterized in that: The cognitive bias category vector is a 6-bit vector composed of 0 and 1, where if any bit is 1, it means that the cognitive bias corresponding to the bit exists in the phishing email; if any bit is 0, it means that the cognitive bias corresponding to the bit does not exist in the phishing email.

5. A method for identifying cognitive bias exploitation in phishing emails as claimed in claim 1, characterized in that: Before obtaining the text features, word weights of each word, and sentiment scores of each phishing email, each phishing email is first cleaned. The cleaning method is as follows: Remove HTML tags from each phishing email; All text in each phishing email is converted to lowercase or uppercase; Eliminate non-specified languages ​​in phishing emails; Remove special characters and stop words from each phishing email; Perform stem extraction and lemmatization on the words in each phishing email.

Images