Intelligent Human-Centric Cybersecurity Framework For Adaptive Phishing Mitigation In Higher Education Institutions
DOI:
https://doi.org/10.24269/mtkind.v20i2.14612Keywords:
adaptive cybersecurity, behavioral monitoring, higher education, human-centric cybersecurity, phishing mitigationAbstract
Phishing in higher education combines technical exposure with user-level and organizational vulnerabilities, yet the literature often treats these dimensions separately. This study develops an Intelligent Human-Centric Cybersecurity Framework through a structured narrative review and thematic synthesis. Sources were drawn from Scopus, IEEE Xplore, SpringerLink, and ScienceDirect, with the main search window covering 2021–2026. The review screened 268 candidate records and retained 25 sources represented in the final synthesis. A hybrid deductive–inductive coding procedure was used to examine digital literacy, cybersecurity awareness, organizational security culture, behavioral monitoring, and adaptive response while allowing additional themes such as phishing simulation, user compliance, and security fatigue to emerge. The synthesis indicates that human capability and institutional reinforcement become more actionable when they are connected to behavioral evidence and a feedback mechanism. In the proposed framework, “intelligent” refers to the use of monitoring and analytics to support evidence-informed mitigation decisions, whereas “adaptive” refers to the adjustment of training, policy, or controls in response to observed behavior and evolving phishing patterns. The framework is conceptual rather than empirically validated; therefore, controlled phishing simulations and quantitative model testing are proposed as subsequent validation steps.
Downloads
References
[1] E. Morrow, “Scamming higher ed: An analysis of phishing content and trends,” Computers in Human Behavior Reports, vol. 14, p. 100411, 2024, doi: 10.1016/j.chb.2024.108274.
[2] S. Chaudhary, V. Gkioulos, and S. Katsikas, “Developing metrics to assess the effectiveness of cybersecurity awareness program,” Journal of Cybersecurity, vol. 8, no. 1, p. tyac006, 2022, doi: 10.1093/cybsec/tyac006.
[3] A. Gavaza, B. Kandiero, and C. Katsande, “A human-centric cybersecurity framework for ensuring cybersecurity readiness in universities,” in Effective Cybersecurity Operations for Enterprise-Wide Systems, IGI Global, 2023, pp. 242–276, doi: 10.4018/978-1-6684-9018-1.ch012.
[4] R. Armas and H. Taherdoost, “Building a cybersecurity culture in higher education: Proposing a cybersecurity awareness paradigm,” Information, vol. 16, no. 5, p. 336, 2025, doi: 10.3390/info16050336.
[5] B. Uchendu, J. R. C. Nurse, M. Bada, and S. Furnell, “Developing a cyber security culture: Current practices and future needs,” Computers & Security, vol. 109, p. 102387, 2021, doi: 10.1016/j.cose.2021.102387.
[6] Z. Fan, X. Li, and Y. Zhang, “Investigation of phishing susceptibility with explainable artificial intelligence,” Future Internet, vol. 16, no. 1, p. 31, 2024, doi: 10.3390/fi16010031.
[7] N. Chowdhury and V. Gkioulos, “Cyber security training for critical infrastructure protection: A literature review,” Computer Science Review, vol. 40, p. 100361, 2021, doi: 10.1016/j.cosrev.2021.100361.
[8] B. B. Gupta, A. Tewari, A. K. Jain, and D. P. Agrawal, “Fighting against phishing attacks: State of the art and future challenges,” Neural Computing and Applications, vol. 28, no. 12, pp. 3629–3654, 2017, doi: 10.1007/s00521-016-2275-y.
[9] S. M. Albladi and G. R. S. Weir, “User characteristics that influence judgment of social engineering attacks in social networks,” Human-centric Computing and Information Sciences, vol. 8, no. 1, p. 5, 2018, doi: 10.1186/s13673-018-0128-7.
[10] I. Riadi, I. T. Riyadi Yanto, and E. Handoyo, “Cyber security analysis of academic services based on domain delivery services and support using Indonesian e-government ratings (PEGI),” Kinetik: Game Technology, Information System, Computer Network, Computing, Electronics, and Control, vol. 5, no. 4, pp. 263–270, 2020, doi: 10.22219/kinetik.v5i4.1083.
[11] M. Zulfadhilah, Y. Prayudi, and I. Riadi, “Cyber profiling using log analysis and K-means clustering: A case study higher education in Indonesia,” International Journal of Advanced Computer Science and Applications, vol. 7, no. 7, pp. 430–435, 2016.
[12] A. Kulkarni, V. Balachandran, D. M. Divakaran, and T. Das, “Evaluating the robustness of phishing webpage detection models against adversarial attacks,” Computers & Security, vol. 142, p. 103987, 2024, doi: https://doi.org/10.48550/arXiv.2407.20361
[13] M. Jalali, J. Bruckes, and M. Westmattelmann, “Why employees still click on phishing links: Investigation in hospitals,” Journal of Medical Internet Research, vol. 22, no. 1, p. e16775, 2020, doi: 10.2196/16775.
[14] S. Furnell and K. Thomson, “Recognising and addressing ‘security fatigue’,” Computer Fraud & Security, vol. 2021, no. 11, pp. 5–10, 2021, doi: https://doi.org/10.1016/S1361-3723(09)70139-3.
[15] P. Kirlappos and M. A. Sasse, “Security education against phishing: A modest proposal for a major rethink,” IEEE Security & Privacy, vol. 20, no. 2, pp. 72–77, 2022, doi: 10.1109/MSP.2011.179
[16] A. Vishwanath, T. Herath, R. Chen, J. Wang, and H. R. Rao, “Suspicion, cognition, and automaticity model of phishing susceptibility,” Communication Research, vol. 45, no. 8, pp. 1146–1166, 2018, doi: 10.1177/0093650215627483.
[17] K. Parsons, D. Calic, M. Pattinson, M. Butavicius, A. McCormac, and T. Zwaans, “The Human Aspects of Information Security Questionnaire (HAIS-Q): Two further validation studies,” Computers & Security, vol. 66, pp. 40–51, 2017, doi: 10.1016/j.cose.2017.01.004.
[18] A. AlHogail, “Design and validation of information security culture framework,” Computers in Human Behavior, vol. 49, pp. 567–575, 2015, doi: 10.1016/j.chb.2015.03.054.
[19] M. Workman, “Wisecrackers: A theory-grounded investigation of phishing and pretext social engineering threats to information security,” Journal of the American Society for Information Science and Technology, vol. 59, no. 4, pp. 662–674, 2008, doi: 10.1002/asi.20779.
[20] A. Ferreira and R. Teles, “Persuasion: How phishing emails can influence users and bypass security mechanisms,” International Journal of Human-Computer Studies, vol. 125, pp. 19–31, 2019, doi: 10.1016/j.ijhcs.2018.12.004.
[21] R. Umar, I. Riadi, and R. S. Kusuma, “Analysis of Conti ransomware attack on computer network with live forensic method,” International Journal on Informatics for Development, vol. 10, no. 1, pp. 53–61, 2021, doi: 10.14421/ijid.2021.2423.
[22] A. Kurniawan, I. Riadi, and A. Luthfi, “Forensic analysis and prevent of cross site scripting in single victim attack using Open Web Application Security Project (OWASP) framework,” Journal of Theoretical and Applied Information Technology, vol. 95, no. 6, pp. 1363–1371, 2017.
[23] A. Kurniawan and I. Riadi, “Detection and analysis Cerber ransomware based on network forensics behavior,” International Journal of Network Security, vol. 20, no. 5, pp. 836–843, 2018, doi: 10.6633/IJNS.201809.20(5).04.
[24] A. Fadlil, I. Riadi, and A. Nugrahantoro, “Data security for school service top-up transactions based on AES combination blockchain technology modification,” Lontar Komputer: Jurnal Ilmiah Teknologi Informasi, vol. 11, no. 3, pp. 155–166, 2020, doi: 10.24843/LKJITI.2020.v11.i03.p04.
[25] Sunardi, I. Riadi, and P. A. Raharja, “Vulnerability analysis of e-voting application using Open Web Application Security Project (OWASP) framework,” International Journal of Advanced Computer Science and Applications, vol. 10, no. 11, pp. 135–142, 2019.
Downloads
Published
How to Cite
Issue
Section
Citation Check
License
Copyright (c) 1970 Multitek Indonesia : Jurnal Ilmiah
This work is licensed under a Creative Commons Attribution 4.0 International License.
MULTITEK is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License
