AI | Kami Vaniea

AI-Enhanced Email Security: A Novel Pipeline for Phishing Campaign Detection and Profiling

Fri, 26 Jun 2026 00:00:00 +0000

SoK: Grouping Spam and Phishing Email Threats for Smarter Security

Fri, 28 Mar 2025 00:00:00 +0000

Judging Phishing Under Uncertainty: How Do Users Handle Inaccurate Automated Advice?

Wed, 26 Mar 2025 00:00:00 +0000

PhishCoder: Efficient Extraction of Contextual Information from Phishing Emails

Fri, 13 Sep 2024 00:00:00 +0000

Phishing Codebook: A Structured Framework for the Characterization of Phishing Emails

Fri, 16 Aug 2024 00:00:00 +0000

Using Clustering Algorithms to Automatically Identify Phishing Campaigns

Tue, 01 Aug 2023 00:00:00 +0000

Context-based Clustering to Mitigate Phishing Attacks

Tue, 01 Nov 2022 00:00:00 +0000

PhishEd

Tue, 27 Apr 2021 00:00:00 +0000

Phishing is one of the most effective vectors for tricking users into providing sensitive information, such as account details, to attackers who then use the information to harm users, organizations, and society at large. Recent attacks, such as the Colonial Pipeline shutdown in the US can be attributed to phishing. In the UK, 86% of businesses reported receiving phishing attacks [1] and while 76% of UK users believe that they can recognize and avoid suspicious links in emails [2], our own research shows that only about 8% can accurately read a URL [3]. The staggering £53.7 million lost in the UK in 2020 to impersonation fraud also attests to the problem [4].

Employer-provided training tends to be delivered either up-front or given after the employee has fallen for a mock phishing attack. These approaches do work, but they are very employer-centric in that employers choose the time and content of the training. Delivering the same training to everyone also forces a compromise between comprehensively covering topics and containing detailed actionable guidance. For example, training commonly advises users to “look at the destination of links” but does not have the space to explain how to do so. Users in this situation have virtually no agency or control and lack the ability to shape their own learning to match their needs. Users also experience phishing as an infrequent unexpected event that is mixed in with other activities. Phishing by its nature is designed to appear urgent or threatening. A user receiving such a message may be worried or scared about what might happen if they were to ignore it. Currently their only options are to delete the potential phish (scary) or report it and ask for advice (slow).

In this project, we propose a novel phishing-advice tool, PhishEd, which accepts reports from users of potential phishing emails, uses AI to parse out contextual phishing features, and quickly responds back to the user with advice based on the content of the reported email. to explain the reasoning or frame the decision the user needs to make. For example, a reported phishing might contain “HMRC” but have links leading to Dropbox. The auto response would inform the user that the email is not from HMRC (DKIM) and the links lead to Dropbox which HMRC would never use. It would also provide examples from the email to evidence these claims. The objectives of this project are: (i) help users confidently make safety decisions, (ii) teach them skills about how to detect fraud, and (iii) make them want to report phishing in the future.

NCSC Cyber Security Breaches Survey 2020.
UK Consumer Digital Index 2019.
S.S. Albakry, K. Vaniea, M.K. Wolters; What is this URL’s Destination? Empirical Evaluation of Users’ URL Reading; In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. 2020.
UK Finance, Fraud – The Facts 2021.

Phishing

Tue, 27 Apr 2021 00:00:00 +0000

My lab has a range of publications and projects involving phishing. This project page provides an overview of the different types of work we conduct.

PhishEd aims to make reporting phishing a helpful and friendly experience where the user feels heard, gets helpful feedback, and can confidently determine if an urgent sounding email is fraudulent or real.

People

Sara Albakry
Kholoud Althobaiti
Adam Jenkins
Tarini Saka
Nadin Kokciyan
Kami Vaniea

Chatty Factories

Sat, 27 Apr 2019 00:00:00 +0000

The first industrial revolution saw a transformation based on water and steam power. The second harnessed electricity to support mass production. The third used electronics and IT to innovate and automate. Now, the World Economic Forum defines the fourth industrial revolution as “a fusion of technologies that is blurring the lines between the physical, digital, and biological spheres”. This builds on the rapid growth of the third revolution to bring data, artificial intelligence and robotic fabrication systems to the forefront of the manufacturing industry.

Current manufacturing systems are characterised by a multitude of interconnected procedures that include many discrete, highly specialised and human intensive activities, such as: consumer research, concept design, engineering design & prototyping, and manufacturing operations that combine robots with human workers on the factory floor. Two significant limitations of current manufacturing systems are (a) the inability to quickly and continuously refine product design in response to real-time consumer insights (i.e. how the product is being used and its ’experience’ of the world) and (b) the inability to quickly reconfigure and reskill the human and robotic production elements on the factory floor in response to real-time data captured from embedded product sensors. For example - if sensor data suggests a product needs a design change based on its current use, how do we update the fabrication instructions and reshuffle the factory floor between shifts, and tell human and robot workers how to alter their duties within minutes?

Our vision for the manufacturing factory of the future is to embrace the rapid growth of internet-connected products via embedded sensors producing massive volumes of data, and transform these traditionally discrete activities into one seamless process that is capable of real-time continuous product refinement. Firstly, mindful of the potential disruption to labour markets, we will develop new fundamental theory that relates to learning and seamless communication between products, humans, robots and factory floor operations - to ensure equality and collaborative real-time learning. Secondly, we will develop data-driven systems that provide an auditable, secure and seamless flow of information between all operations inside and outside the factory to facilitate real-time adaption and re-orientation of the entire manufacturing system based on data harvested via product-embedded sensors and Internet of Things (IoT) connectivity.

The research will achieve a radical interruption of the existing ‘consumer sovereignty’ model based around surveys and market research - and introduce ‘use sovereignty’ via an embedded understanding of consumer behaviour - making products that are fit for purpose based on how they are used. This will not be unmediated but buffered by robust, secure and interpretable data analysis at scale - with ethical integration of human labour. Designers will have a completely transformed role being ’embedded in production’ in a world of “chatty” products and a dynamically evolving factory floor.

Our approach will transform the ways in which traditional factories are reconfigured in real time by adopting a first mover approach to real time reconfiguration, production element reskilling (human, robot or both collaboratively). Radically, we will use exopedagogy, the first time it has ever been applied in a practical setting and couple this with insights from robotics. Exopedagogy considers alien forms of learning and uses those metaphors to develop models of learning which go beyond human learning. In contrast to existing techniques such as jet engine telemetry that allow for optimisation tweaks around a clearly defined product, our work will allow for both i) redesigns to support new uses or usage patterns; ii) generation of new products based on observing alternative use.

Early Publications

Publications from Edinburgh-based academics from before 2020 when Kami Vaniea joined the project.

Murray-Rust, D., Gorkovenko, K., Burnett, D., & Richards, D. (2019). Entangled Ethnography: Towards a Collective Future Understanding. Proceedings of the Halfway to the Future Symposium 2019, 1–10. New York, NY, USA: Association for Computing Machinery.
Gorkovenko, K., Burnett, D. J., Thorp, J. K., Richards, D., & Murray-Rust, D. (2020). Exploring The Future of Data-Driven Product Design. Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, 1–14. New York, NY, USA: Association for Computing Machinery.
Gorkovenko, K., Burnett, D., Thorp, J., Richards, D., & Murray-Rust, D. (2019). Supporting Real-Time Contextual Inquiry Through Sensor Data. Ethnographic Praxis in Industry (EPIC2019).
Burnett, D., Thorp, J., Richards, D., Gorkovenko, K., & Murray-Rust, D. (2019). Digital Twins as a Resource for Design Research. Proceedings of the 8th ACM International Symposium on Pervasive Displays, 1–2. New York, NY, USA: Association for Computing Machinery.
Burnap, P., Branson, D., Murray-Rust, D., Preston, J., Richards, D., Burnett, D., … Thorp, J. (2019). Chatty Factories: A Vision for the Future of Product Design and Manufacture with IoT. Living in the IoT: PETRAS/IET Conference 2019.

Grant

EPSRC grant on

Automatic phishing detection versus user training, Is there a middle ground using XAI?

Fri, 01 Jun 2018 00:00:00 +0000