Abstract:

Social engineering is the most common technique used in cyberattacks (According to EC-Council, 98% of cyberattacks rely on social engineering). Such attacks typically involve psychological manipulation, tricking users into clicking on links that direct them to websites, which steal sensitive information and contain malicious software (i.e., malware). Clickbait is often exploited in social engineering attacks through the spread of sensationalized or misleading posts in online social media that trick users into clicking malicious links.

Many online social media users lack knowledge and awareness about clickbait. Therefore, clickbait education has become necessary more than ever. To this end, we leveraged the learning science principles to guide our educational content design (baseline design), aimed at the safe and secure use of social networking sites through avoiding clickbait. While learning science principles are proven to improve the understanding of a concept, prior studies also recommended the contextualization of information to further enhance the perspicuity of users while maintaining their interest in learning. However, there is a gap in existing literature in implementing such recommendations, especially in the context of security education.

Mental models that represent the user's understanding of a concept present a viable method for categorizing users to provide information contextualized to their current knowledge, perceptions, and misconceptions. To this end, we addressed the following research questions in our work:
RQ1: How can we integrate mental models with learning science principles to design content for clickbait education?
RQ2: How do mental model based clickbait education content compare to the baseline?

To note, we leveraged the same learning science principles in our treatment designs (based on mental models) and the baseline design (an informative article with graphics).

To integrate mental models with learning science principles (RQ1), we first need to identify the existing mental models of social media users about clickbait, where we conducted a study with 770 participants on Amazon Mechanical Turk (MTurk), asking them about their understanding of clickbait. We derived six mental models from our analysis – three based on how clickbait works (e.g., hiding information) and three based on what clickbait aims to achieve (e.g., website traffic). Based on these mental models, we designed educational content aimed at improving users' understanding of clickbait.

We evaluated our designs through an online study with 64 participants (based on power analysis for large effect size) on MTurk (RQ2). The findings from this study denoted the efficacy of leveraging user mental models in clickbait education design. Our results also represented a significant improvement in users' knowledge regarding clickbait with both the baseline and treatment educational content, unveiling the potential of integrating learning science principles into the design process of clickbait education, and security education in general.

Taken together, our findings provide valuable insights into users' mental models of clickbait, translating them into contextualized education designs, and their effectiveness in enhancing users’ security knowledge. Based on our findings, we provide recommendations for future designs, which include exploring user mental models as a viable education tool in the broader context of cybersecurity education.

Keywords:

Clickbait education, mental models, learning science.