The Security Awareness Adventure: A serious game for security awareness training utilizing a state transition system and a probabilistic model

Abstract

Social engineering attacks target people who lack awareness of security. These attacks have become increasingly threatening to modern software systems, which rely heavily on human interactions. Recent studies propose to conduct serious game-based security training against such threats. However, it is challenging to simulate real-world scenarios in serious games, making the training less effective. In this paper, we introduce Security Awareness Adventure, a novel social engineering serious game that allows participants to play the role of attackers and realistically experience the social engineering attack process from the attacker’s perspective. Our game works with state transition models to realistically simulate stakeholder interactions within specific scenarios and to capture stakeholders’ alternative behaviors using a branching system. To evaluate our game’s effectiveness, we conducted an experiment with 41 participants and a real social engineering security scenario. The experimental results show that our game can effectively improve the learner’s security awareness.