Analyzing Instance Representation in Cognitive Models of Phishing Decision Making

Abstract Phishing attacks remain a significant security threat. One approach to addressing this challenge is through personalized and adaptive anti-phishing training solutions capable of tailoring learning experiences to individual needs and context. This requires cognitive models that are predictive of individual phishing responses and are amenable to analyzing and measuring the cognitive factors underlying people's susceptibility to phishing attacks. In this paper, we study a key challenge associated with developing cognitive models of phishing decision making grounded in instance based learning theory (IBLT): instance engineering. We investigate the effectiveness of different approaches to designing instances using transformer based methods for natural language representation. This work also investigates which aspects of phishing decision making IBL models could represent and predict. We found that using representations that consider contextual meanings assigned by humans could enable cognitive agents to predict human responses to phishing emails with high accuracy. Notably, we also found that IBL models were predictive of responses from participants who engaged in the quick and intuitive form of decision making process. This work underscores cognitive models' potential to analyze differences in individual's responses to phishing attacks, identify gaps in security awareness, and enhance anti-phishing training effectiveness.