Social engineering in cybersecurity: a domain ontology and knowledge graph application examples

Abstract

Social engineering has posed a serious threat to cyberspace security. To protect against social engineering attacks, a fundamental work is to know what constitutes social engineering. This paper first develops a domain ontology of social engineering in cybersecurity and conducts ontology evaluation by its knowledge graph application. The domain ontology defines 11 concepts of core entities that significantly constitute or affect social engineering domain, together with 22 kinds of relations describing how these entities related to each other. It provides a formal and explicit knowledge schema to understand, analyze, reuse and share domain knowledge of social engineering. Furthermore, this paper builds a knowledge graph based on 15 social engineering attack incidents and scenarios. 7 knowledge graph application examples (in 6 analysis patterns) demonstrate that the ontology together with knowledge graph is useful to 1) understand and analyze social engineering attack scenario and incident, 2) find the top ranked social engineering threat elements (e.g. the most exploited human vulnerabilities and most used attack mediums), 3) find potential social engineering threats to victims, 4) find potential targets for social engineering attackers, 5) find potential attack paths from specific attacker to specific target, and 6) analyze the same origin attacks.

Social Engineering Attacks Prevention: A Systematic Literature Review

“…Collaboration between ontology and knowledge graphs can find potential attackers, targets and attack paths, and social engineering threat elements such as human vulnerabilities and attack media. Research Wang et al [68] needs to be validated in actual cases to strengthen the study results further.…”

“…Wang et al [68] built a social engineering ontology domain in the cybersecurity field, then evaluated the domain. It also builds a knowledge graph based on 15 incidents and social engineering attack scenarios.…”

Critical Relation Path Aggregation-Based Industrial Control Component Exploitable Vulnerability Reasoning

“…Various security ontological models are expanded with conceptualizations of diverse information. For example, Wang et al developed an ontology regarding social engineering attacks, including eleven core entity types and twenty-two relevant relations [11]. For the same purpose of automatically identifying security risks in the ICS, an ontology presented by Eckhart et al combined with a transformation from the Automation Markup Language (Automation-ML) to Web Ontology Language (OWL) [5], and a hybrid ontology proposed by Alanen et al harmonized concepts among safety, security, and dependability on the basis of current industry standards to assist in the threat analysis [12].…”

“…Input: target entity e t , maximum path length max_p_len, query relation vector q_r_vec Output: critical path set cri_p_set (1) function DFS_SIM (cur_rela, cur_ent, cur_p_rela, cur_p_ent, cur_p_vec, last_sim, last_len, e t , max_p_len, q_r_vec, cri_p_set) (2) append current relation cur_rela to the list of current path relation cur_p_rela (3) append current entity cur_ent to the list of current path entity list cur_p_ent (4) get the vector of cur_rela and record it as cur_rela_vec (5) cur_p_vec ← cur_p_vec + cur_rela_vec (6) calculate the length of cur_p_vec and record it as cur_len (7) calculate the similarity cur_sim between cur_p_vec and q_r_vec as described in Eq. ( 3) (8) if cur_ent is e t then (9) add cur_p_rela into cri_p_set (10) remove the last elements from cur_p_rela and cur_p_ent (11) end if (12) if cur_len := max_p_len and cur_ent is not e t then (13) remove the last elements from cur_p_rela and cur_p_ent (14) end if (15) if cur_sim > last_sim and cur_len > last_len then (Continued)…”

A Study on the Psychology of Social Engineering-Based Cyberattacks and Existing Countermeasures

“…Moral influence/social responsibility [41] SE attacks use moral influence or social responsibility in two ways. One way is that the foe exploits the victim's helpful nature to extract information or to gain favor to facilitate the attack.…”