DOI: 10.5281/zenodo.17072807
title: Supplementary Materials for the Paper "Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital"

description: J. Tolsdorf, D. Langer, and L. Lo Iacono, “Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital,” in Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS), Taipei, Taiwan: ACM, 2025. doi: 10.1145/3719027.3765164.

Structure

Archive.zip
├── Study I/
│   ├── emails/                     # Phishing emails used in Study I
│   ├── panasx_data_study_i.csv     # PANAS-X survey data elicited in Study I
│   ├── phishing_data_study_i.csv   # Click and login data elicited in Study I
│   ├── script_ccs_study_i.R        # Analysis script for Study I
│   ├── renv.lock                   # R environment lock file
│   ├── renv/                       # R environment
│   │   ├── activate.R              # R environment activation script
│   │   ├── settings.json           # R environment settings
│   └── dockerfile                  # Dockerfile for Study I
├── Study II/   
│   ├── emails/                     # Phishing emails used in Study II
│   ├── phishing_data_study_ii.csv  # Click and login data elicited in Study II
│   ├── script_ccs_study_ii.R       # Analysis script for Study II
│   ├── renv.lock                   # R environment lock file
│   ├── renv/                       # R environment
│   │   ├── activate.R              # R environment activation script
│   │   ├── settings.json           # R environment settings
│   └── dockerfile                  # Dockerfile for Study II            
└── README.md                       # This file


Data

The data files include the raw click and login data we obtained from the hospital.

R-Scripts

The provided R scripts allow you to reproduce the analyses and results presented in the paper. They produce the statistical tests, tables, and figures reported in the paper.

Run using Docker



Install Docker

Run unzip Archive.zip

For Study I:



Change into directory Study I/

Open a terminal

Run: docker build -t r-script-study-i .

Run: docker run --rm -v "$(pwd)":/usr/src/app r-script-study-i



For Study II:



Change into directory Study II/

Open a terminal

Run: docker build -t r-script-study-ii .

Run: docker run --rm -v "$(pwd)":/usr/src/app r-script-study-ii




Run on your local machine



Install R (≥ 4.3)

Run unzip Archive.zip

For Study I:



Change into directory Study I/

Open a terminal

Run: Rscript script_ccs_study_i.R for Study I analysis



For Study II:



Change into directory Study II/

Open a terminal

Run: Rscript script_ccs_study_ii.R for Study II analysis




Note: Ensure to set setwd('path/to/Study I/') or setwd('path/to/Study II/') before running the scripts or when using RStudio.

Emails

We provide all emails used in our studies. For Study II, this includes the active warning triggered after the link in the email was clicked. Note that our study was conducted in German. We translated Emails used in Study II to English because we report screenshots in the paper. Emails in Study I are available in German only. All emails were anonymized to not reveal the organization.