Social Engineering: Application of Psychology to Information Security

Pozo, Ivan Del; Iturralde, Mauricio; Restrepo, Felipe

doi:10.1109/w-ficloud.2018.00023

Cited by 7 publications

(4 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Bridging the gap between psychology and information security, investigations by Del Pozo et al (2018) and Chayal and Patel (2021) have illuminated the psychological underpinnings crucial to fortifying cyber defenses. Suryapranata et al (2017) studied the activities of a user forum to identify the variables that can be used to predict the likelihood of a user being involved in cybercrime.…”

Section: Literature Reviewmentioning

confidence: 99%

Psychological profiling of hackers via machine learning toward sustainable cybersecurity

Hani,

Sohaib,

Khan

et al. 2024

Front. Comput. Sci.

View full text Add to dashboard Cite

This research addresses a challenge of the hacker classification framework based on the “big five personality traits” model (OCEAN) and explores associations between personality traits and hacker types. The method's application prediction performance was evaluated in two groups: Students with hacking experience who intend to pursue information security and ethical hacking and industry professionals who work as White Hat hackers. These professionals were further categorized based on their behavioral tendencies, incorporating Gray Hat traits. The k-means algorithm analyzed intra-cluster dependencies, elucidating variations within different clusters and their correlation with Hat types. The study achieved an 88% accuracy in mapping clusters with Hat types, effectively identifying cyber-criminal behaviors. Ethical considerations regarding privacy and bias in personality profiling methodologies within cybersecurity are discussed, emphasizing the importance of informed consent, transparency, and accountability in data management practices. Furthermore, the research underscores the need for sustainable cybersecurity practices, integrating environmental and societal impacts into security frameworks. This study aims to advance responsible cybersecurity practices by promoting awareness and ethical considerations and prioritizing privacy, equity, and sustainability principles.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Psychological profiling of hackers via machine learning toward sustainable cybersecurity

Hani,

Sohaib,

Khan

et al. 2024

Front. Comput. Sci.

View full text Add to dashboard Cite

show abstract

“…All people share specific influence patterns (Del Pozo et al, 2018). Social engineering is based on both security and psychological terms to take advantage of people's naivety.…”

Section: User's Behavior In Cybersecuritymentioning

confidence: 99%

“…This is the use of deception, persuasion, and misdirection to engineer a false perception of the situation in the victim's mind and insinuate that the hacker as a reliable person or organization. The main goal of manipulating unsuspecting users is to fool them into breaking standard security procedures, either to gain access to the system or to obtain sensitive information (Del Pozo et al, 2018). For instance, personalized spear-phishing, tax, and bank scams, misplaced flash drives, phishing campaigns, etc.…”

Section: Social Engineering and Manipulationmentioning

confidence: 99%

Handling User-Oriented Cyber-Attacks: STRIM, a User-Based Security Training Model

Hamoud

Aïmeur

2020

Front. Comput. Sci.

View full text Add to dashboard Cite

Privacy is an increasingly rare commodity. Once personal information is entered into a social network, it is no longer private. Such networks have become an incubation environment and carrier for cyber-attacks either by providing the necessary information about victims or facilitating the ways in which cyber-criminals can reach them. Social media create relationships and trust between individuals, but there is often no authority checking and validating user identities. This paper analyses different attack vectors examining the techniques used against end-users, who are targeted as a way of accessing larger organizations. It shows how the information that is disclosed to social networks can be transformed to provide insights about an organization, and the role of the victim in this process. These leaks not only expose users to the risk of cyber-attacks, but they also give attackers the opportunity to create personalized strategies that are difficult to avoid. This paper highlights these user-oriented attacks by first demonstrating the impact of disclosed information in the process of formulating an attack, in addition to group influence on an individual's vulnerability. Next, the various psychological manipulation factors and cognitive bias behind the user's failure to detect these attacks is demonstrated. This research introduces a theoretical user-based security training model called STRIM, which aims to educate and train users to detect, avoid, and report cyberattacks in which they are the primary target. The proposed model is a solution to help organizations establish security-conscious behaviors among their employees.

show abstract

“…S OCIAL engineering is a multifaceted technique that manifests both in real-life and digital environments. It is related to a manipulative form of communication that exploits human personality traits either in a mass personal or interpersonal way [1], [2]. From "fake news" to psychographic advertisements and from cognitive hacking to spear-phishing, there is a plethora of different types of social engineering attacks [3], [4], [5] .…”

Section: Introductionmentioning

confidence: 99%

CSE-ARS: Deep Learning-Based Late Fusion of Multimodal Information for Chat-Based Social Engineering Attack Recognition

Tsinganos,

Fouliras,

Mavridis

et al. 2024

IEEE Access

View full text Add to dashboard Cite

With the increasing prevalence of chat-based social engineering (CSE) attacks targeting unsuspecting users, the need for robust defenses has never been more critical. In this paper, we introduce Chat-based Social Engineering Attack Recognition System (CSE-ARS), an innovative and effective CSE defense system. CSE-ARS employs a late fusion strategy that integrates the findings of five specialized deep learning models, each focused on detecting distinct CSE attack enablers: critical information leakage recognizer (CRINL-R), personality traits recognizer (PERST-R), dialogue acts recognizer (DIACT-R), persuasion recognizer (PERSU-R), persistence recognizer (PERSI-R). The system harnesses weighted linear aggregation and employs simulated annealing with 10-fold cross-validation, ensuring optimal model performance. CSE-ARS is trained on the CSE-ARS Corpus, a carefully curated dataset tailored to the intricacies of CSE attacks. Extensive evaluation reveals that CSE-ARS achieves satisfactory results in identifying and neutralizing CSE threats, enhancing user security in online interactions.

show abstract

Social Engineering: Application of Psychology to Information Security

Cited by 7 publications

References 10 publications

Psychological profiling of hackers via machine learning toward sustainable cybersecurity

Psychological profiling of hackers via machine learning toward sustainable cybersecurity

Handling User-Oriented Cyber-Attacks: STRIM, a User-Based Security Training Model

CSE-ARS: Deep Learning-Based Late Fusion of Multimodal Information for Chat-Based Social Engineering Attack Recognition

Contact Info

Product

Resources

About