| 摘要: | 近年來「社交工程(Social Engineering)」是最難防範的攻擊手法之一，社交工程利用人性缺乏警覺性或存在好奇心的弱點進行詐騙及釣魚，通常使用電話、電子郵件、假冒身分方式，用以取得受騙者個人資料、帳號密碼、金錢等利益。
本研究藉由電子郵件社交工程，探討政府/教育/電信/金融/物流機構在電子郵件社交工程點選信件類型偏好、點選時間差異、點選趨勢及點選前三名等，進行行為分析。
本研究社交工程信件分類共12類，點選前三名分別為：健康(16%)、科技(14%)、時事(13%)，推論國人較重視健康類型資訊。點選方式排名依序為：開啟信件(74%)、開啟附檔(19%)、點擊URL(7 %)，此為開啟信件時，預設自動下載圖片或自行下載圖片瀏覽信件。各機構點選率排名：物流(221%)、金融(218%)、電信(83%)、教育(30%)、政府(2%)，此由於物流機構2015年開始進行社交工程測試，點選人員較未受過相關資安認知課程，故點選率較高。
Social engineering is one of the attacks that are the most difficult to prevent in recent years. It takes advantage of people’s vulnerability such as the curiosity or the lack of alert awareness to perform fraud or phishing. It gets the profits from the victim, such as the personal information, account, password, and money through phone call, Email, and fake identity.
With case study method, the study explores the preference of clicking mail types, difference of clicking time, clicking trend and top three clicking items of the government/education/telecom/finance/logistics institutions in Email social engineering, so as to conduct behavioral analysis.
The top three among the 12 categories of social engineering mails classified by the study are: health (16%), science and technology(14%), and news(13%). It indicates that the citizens value the information related to health. The clicking mode ranks are: open letter (74%), open the attached file (19%), and click URL (7%).The clicking rate ranks of the institutions are: logistics(221%), finance(218%), telecom(83%), education(30%), and government(2%). |
