基於遊戲式學習之釣魚網站防範訓練模式

Abstract

根據APWG 統計，釣魚網站的數量不斷在迅速增加，而釣魚網站的手法也不斷在更 新，造成大眾財產的損失，即便有工具可以偵測釣魚網站，但是他們仍然會有誤判的機 會。所以教會使用者如何防範釣魚網站是一件很重要的事。然而一般使用者對於傳統以 文件主的教學沒有興趣也未必看得懂，所以可以利用遊戲的方式來教使用者防範釣魚， 但是要將這些日新月異的釣魚手法加入遊戲式的教材非常曠日費時。在這篇研究中，我 們利用專家系統的技術來跟釣魚網頁的專家擷取這些釣魚的知識，以及WIKI 的方式讓 大眾可以提供網頁的情境，最後利用推論引擎根據使用者的學習狀態以及擷取來的知識 以及情境來產出適合使用者學習的教材。實驗結果顯示，我們所提出的方法跟傳統文件 的教學可以提昇使用者的學習效率。

APWG Statistics shows that phishing attack is increasing and causing enormous economic loss. However, existing phishing detection tools still suffer from false alarms and false negative. Educating user to defense phishing attack is important. Users do not have motivation for reading traditional document-based education materials. Therefore, several anti-phishing games have been proposed. These games are not sufficient for user to learn the phishing knowledge with limited learning case. We need to generate a large item bank of phishing cases. However, it is costly and time consuming to create phishing pages with the carious and reasonable scenario. We apply expert system approach to solve the issue. First, we implement a knowledge acquisition tool to gather phishing knowledge form multiple experts. Next, we provide adaptive education materials which are auto-generated for user. The experimental results show that students can make significant progress in identifying phishing page by using our approach