Thesis Defence: Influencing Cybersecurity Awareness Using CyberGuard VR

Yiqi (Jason) Xu, supervised by Dr. Ifeoma Adaji, will defend their thesis titled “Influencing Cybersecurity Awareness Using CyberGuard VR: An Immersive Environment for Social Engineering and Cross-Site Scripting Training” in partial fulfillment of the requirements for the degree of Master of Science in Computer Science.

An abstract for Yiqi (Jason) Xu’s thesis is included below.

Defences are open to all members of the campus community as well as the general public. This defence will be held in hybrid format. Registration is not required to attend in person; however, please email ifeoma.adaji@ubc.ca to request the Zoom link for the defence.

Abstract

Cybersecurity education needs to support human-facing judgement and, for some topics, introductory technical reasoning. Learners may need to recognize social-engineering attempts while also developing a basic understanding of how web vulnerabilities such as cross-site scripting (XSS) arise. This thesis presents CyberGuard VR, a Meta Quest 2 prototype built in Unity that combines these areas in one immersive training environment. CyberGuard VR includes phishing, privacy and security, XSS recognition, feedback, navigation, and simulated social-engineering conversations. Some dialogue interactions use large-language-model support for flexible responses. The design gives learners a safe setting to practise recognizing suspicious cues, refusing unsafe disclosure, and connecting technical choices to security consequences. The prototype was evaluated through an exploratory controlled pretestposttest study with 21 matched participants. Twelve participants used CyberGuard VR, and nine completed active non-VR cybersecurity learning activities using existing online resources. Ten common knowledge items measured immediate learning; post-session questionnaires and open-ended responses captured user experience and design feedback. Both conditions were associated with immediate knowledge improvement. The VR group increased from 0.78 to 0.93 on the ten common items, while the control group increased from 0.83 to 0.98. A baseline-adjusted comparison did not show a clear advantage for either condition, partly because post-training scores were close to the maximum possible score. Results were clearest for phishing, privacy, multi-factor authentication, and social engineering decision items. The XSS findings are preliminary because only two common XSS items were available and control-group exposure to the XSS Game varied, but they still inform technical redesign. Participants rated CyberGuard VR positively, while noting barriers involving navigation, instructions, readability, controls, comfort, and explanations. The findings do not show VR superiority over active non-VR training, but support CyberGuard VR as a promising complementary tool for scenario-based cybersecurity education and future evaluation.