Leveraging Machine Learning Techniques to Identify Deceptive Decoy Documents Associated With Targeted Email Attacks

Abstract

Detecting and preventing targeted email attacks is a long-standing challenge in cybersecurity research and practice. A typical targeted email attack capitalizes on a sophisticated email message to persuade a victim to run a specific, seemingly innocuous, action such as opening a link or an attachment and downloading and installing a software program. To successfully perform such an attack without being noticed afterwards, the attached exploit documents (hereafter referred to as decoy documents), must contain content that is highly relevant to the target. An analysis of such decoy documents can provide crucial information for inferring and identifying the targeted or potentially harmed victims. In this paper, we propose an automatic approach that leverages natural language processing and machine learning to identify decoy documents that have a high chance of deceiving the targeted users. The experimental results show that the proposed method provides good prediction accuracy: the best result obtained on a collection of 200 Chinese decoy documents yielded an accuracy of 97.5%, an F-measure of 97.9% and a low FPR of 3.1%. The proposed scheme can be deployed at various access points to fortify the defense against targeted email attacks that threaten various targets.INDEX TERMS Targeted email attack, decoy document, machine learning, natural language processing

Tendencias de las técnicas de la inteligencia artificial, en la detección de delitos informáticos: Revisión Sistemática de la Literatura (SLR)

“…Para ilustrar, el estudio realizado por Sun et al (2021) emplearon el algoritmo de aprendizaje automático Random Forest para la clasificación de documentos, logrando identificar correctamente documentos engañosos con una exactitud notable del 99.7%. Este caso ilustra el potencial de eficiencia que la inteligencia artificial puede alcanzar en la detección de delitos informáticos.…”