Approximately 65% of the organizations in the United States have fallen victim to a successful phishing attack. Many organizations offer anti-phishing training to their employees to defend against phishing attacks. The purpose of this study is to examine factors impacting the effectiveness of anti-phishing training and study the relationship between personality traits and phishing susceptibility. Participants filled out pre- and post-training surveys that included questions on identifying phishing and legitimate URLs and questions to determine DISC (Dominant, Influence, Steadiness, and Conscientiousness) personality traits. An analysis of the survey data shows that the participants' average accuracy in detecting phishing URLs increased 8% (t = 2.144, p-value = 0.0374) and their confidence in their answer choices increased 6% (t = 2.032, p-value = 0.0464) from pre-training to post-training surveys. Before and after training, participants with the Influence personality trait had the lowest susceptibility while both Dominant and Steadiness personalities had the highest susceptibility before and after training respectively.

Social engineering is the process of getting a person to provide a service or complete a task that may give away private or confidential information. Phishing is the most common type of social engineering. In phishing, an attacker poses as a trustworthy source in an attempt to have the victim release personal or private information. This research aims to identify phishing emails by examining the domain section of URLs. What makes this research novel is the extraction of concise and high quality features used to identify phishing emails in high accuracy as well as provide users with features to identify phishing emails. Through our experiments, we discovered that all of our phishing detection models performed similarly; however, the multinomial naïve bayes model may be best suited for phishing detection via URL domain. This model produced an accuracy of 97.22% with a precision of 0.974 and recall of 0.9776. We also discovered that the most significant features in determining whether a URL is phishing or legitimate were the age of the domain, the length, and the presence of a dash "-".

Social engineering is the process of getting a person to provide a service or complete a task that may give away private or confidential information. Phishing is the most common type of social engineering. In phishing, an attacker poses as a trustworthy source in an attempt to have the victim release personal or private information. Spear phishing is a popular type of phishing attack where the attacker provides information retaining to a select few targets rather than generic information for a mass amount of targets. This paper provides an overview of social engineering attacks, the detection methods of social engineering and phishing attacks, the education and training techniques for preventing social engineering and phishing attacks, as well as the susceptibility of users to social engineering and phishing attacks.