Social engineering cyberattacks are a major threat because they often prelude sophisticated and devastating cyberattacks. Social engineering cyberattacks are a kind of psychological attack that exploits weaknesses in human cognitive functions. Adequate defense against social engineering cyberattacks requires a deeper understanding of what aspects of human cognition are exploited by these cyberattacks, why humans are susceptible to these cyberattacks, and how we can minimize or at least mitigate their damage. These questions have received some amount of attention but the state-of-the-art understanding is superficial and scattered in the literature. In this paper, we review human cognition through the lens of social engineering cyberattacks. Then, we propose an extended framework of human cognitive functions to accommodate social engineering cyberattacks. We cast existing studies on various aspects of social engineering cyberattacks into the extended framework, while drawing a number of insights that represent the current understanding and shed light on future research directions. The extended framework might inspire future research endeavors towards a new sub-field that can be called Cybersecurity Cognitive Psychology, which tailors or adapts principles of Cognitive Psychology to the cybersecurity domain while embracing new notions and concepts that are unique to the cybersecurity domain.

中文翻译：

---

从社会工程网络攻击的角度看人类认知

社会工程学网络攻击是一个主要威胁，因为它们通常是复杂和毁灭性的网络攻击的前奏。社会工程学网络攻击是一种利用人类认知功能弱点的心理攻击。充分防御社会工程网络攻击需要更深入地了解这些网络攻击利用了人类认知的哪些方面，为什么人类容易受到这些网络攻击的影响，以及我们如何最大限度地减少或至少减轻它们的损害。这些问题受到了一定程度的关注，但最先进的理解是肤浅的，分散在文献中。在本文中，我们从社会工程网络攻击的角度回顾了人类的认知。然后，我们提出了一个人类认知功能的扩展框架，以适应社会工程网络攻击。我们将关于社会工程网络攻击各个方面的现有研究纳入扩展框架，同时得出了一些代表当前理解并阐明未来研究方向的见解。扩展的框架可能会激发未来的研究工作，转向一个可以称为网络安全认知心理学的新子领域，该子领域将认知心理学的原则裁剪或调整到网络安全领域，同时包含网络安全领域独有的新概念和概念。同时绘制了许多代表当前理解并阐明未来研究方向的见解。扩展的框架可能会激发未来的研究工作，转向一个可以称为网络安全认知心理学的新子领域，该子领域将认知心理学的原则裁剪或调整到网络安全领域，同时包含网络安全领域独有的新概念和概念。同时绘制了许多代表当前理解并阐明未来研究方向的见解。扩展的框架可能会激发未来的研究工作，转向一个可以称为网络安全认知心理学的新子领域，该子领域将认知心理学的原则裁剪或调整到网络安全领域，同时包含网络安全领域独有的新概念和概念。