# Evaluation of Contextual and Game-Based Training for
## 3 Materials and Methods
### Experiment Environment  
An experiment environment containing an email system was set up on Ubuntu Linux using the email server and management platform Modoboa ([[https://modoboa.org/en/](https://modoboa.org/en/)]([https://modoboa.org/en/](https://modoboa.org/en/)) (accessed on 6 March 2022)). Both Ubuntu Linux and Modoboa were installed with default settings. Modoboa allowed for the creation of unlimited email domains and addresses and provided a webmail interface. Several email domains were configured so that different types of emails could be created:  
* Legitimate emails from service providers such as Google and banks. * Phishing emails that imitated phishing emails from hijacked sender accounts. * Phishing emails from domains made up to look similar to real domains, for instance, lundstro.mse instead of lundstrom.se. The fictitious company Lundstrom AB, and the character [PERSON] were developed. The company was given the domain lundstrom.se and the character was given the email address [EMAIL_ADDRESS]. A persona was developed for [PERSON]. The experiment participants were asked to assume [PERSON]'s persona and classify the email in her inbox. The persona was expressed as follows:  
Figure 1: Research process overview. [PERSON] is 34 years old and works as an accountant at a small company (Lundstrom AB), and her manager is [PERSON]. She lives with her husband and kids in a small town in Sweden. Your email address is [EMAIL_ADDRESS]. You use the banks SBAB and Swedbank and is interested in investing in Bitcoin. You are about to remodel your home and have applied for loans at several banks to finance that. You shop a fair bit online and are registered at several e-stores without really remembering where. You are currently about to remodel your bathroom. Ask the experiment supervisor if you need additional information about [PERSON] or the workplace during the experiment. [PERSON]'s inbox was populated with 11 emails where five were legitimate, and six were phishing. The legitimate emails were crafted as reasonable questions from her manager or communications from banks and craftsmen. The communications from banks and craftsmen were based on real emails taken from one of the researcher's inboxes. The six phishing emails were crafted to include different phishing identifiers. Five different phishing identifiers were included in the experiment. They are commonly mentioned in scientific and popular literature and were the following [41; 42; 43; 44]:  
1. Incorrect sender address where the attacker may use an arbitrary incorrect sender address, attempt to create an address that resembles that of the true sender, or use a sender name to hide the actual sender address. 2. Malicious attachments where the attacker will attempt to make the recipient download an attachment with malicious content. A modified file extension may disguise the attachment. 3. Malicious links that are commonly disguised so that the user needs to hover over them to see the true link target. 4. Persuasive tone where an attacker attempts to pressure the victim to act rapidly. 5. Poor spelling and grammar that may indicate that a text is machine translated or not written professionally. The included phishing emails are described as follows:  
1. The first phishing email came from the manager's real address and mimicked a spear-phishing attempt, including a malicious attachment and hijacked sender address. The attachment was a zip file with the filename \"annons.jpeg.zip (English: advertisement.jpeg.zip)\". The text body prompted the recipient to open the attached file. In addition to a suspicious file extension, the mail signatures differed from the signature in other emails sent by the manager. 2. The second phishing email came from [PERSON]'s own address and prompted the recipient to click a link that supposedly led to information about Bitcoin. The email could be identified as phishing by the strange addressing and the fact that the tone in the email was very persuasive. 3. The third phishing email appeared to be a request from the bank SBAB.