SEADer++: social engineering attack detection in online environments using machine learning

Abstract

Social engineering attacks are one of the most well-known and easiest to apply attacks in the cybersecurity domain. Research has shown that the majority of attacks against computer systems was based on the use of social engineering methods. Considering the importance of emerging fields such as machine learning and cybersecurity we have developed a method that detects social engineering attacks that is based on natural language processing and artificial neural networks. This method can be applied in offline texts or online environments and flag a conversation as a social engineering attack or not. Initially, the conversation text is parsed and checked for grammatical errors using natural language processing techniques and then an artificial neural network is used to classify possible attacks. The proposed method has been evaluated using a real dataset and a semi-synthetic dataset with very high accuracy results. Furthermore, alternative classification methods have been used for comparisons in both datasets.

SEADer++ v2: Detecting Social Engineering Attacks using Natural Language Processing and Machine Learning

“…The authors of [14] give a good explanation of how social engineering attacks can be detected whereas in [15] and [16] different attack scenarios are delivered. More practical works include the ones in [5] and [6] where the authors use NLP and machine learning to detect attacks successfully.…”

“…The dataset consists of 1,051 entries and was originally derived from social engineering dialogues as described in [8] and was later extended and used in [6]. The extended dataset from [6] was used which has 4 columns: 1. Intent 2.…”

“…In the past there were various approaches arguing theoretically that social engineering detection is important [1][2][3][4]. Apart from those there are some practical works based on natural language processing (NLP) and machine learning, including neural networks [5][6]. It is also important to mention the important role that psychology plays in social engineering attacks and the part that it plays in NLP when software needs to be developed to detect attacks.…”

“…There are different online environments such as business domains where customers talk to employees through online chat and in social networking where people talk to each other which are considered very attractive to apply social engineering attacks. There are research approaches that consider attacks in such domains and apply NLP and machine learning to detect attack successfully to an extent [5][6]. To detect attacks written in human language such as English pre-processing of the dialogue is necessary using a parser such as the Stanford core NLP [7].…”

“…By using such a library then a classification dataset can be created, and a classifier applied. This paper builds on top of the algorithm found in [6]. The proposed method is based on the 12 steps of the SEADer++ algorithm which are also explained in section 3 and 2 more pre-processing steps are added to improve the quality of the output as shown in the evaluation section.…”