Towards an Automated Recognition System for Chat-based Social Engineering Attacks in Enterprise Environments

Abstract

Increase in usage of electronic communication tools (email, IM, Skype, etc.) in enterprise environments has created new attack vectors for social engineers. Billions of people are now using electronic equipment in their everyday workflow which means billions of potential victims of Social Engineering (SE) attacks. Human is considered the weakest link in cybersecurity chain and breaking this defense is nowadays the most accessible route for malicious internal and external users. While several methods of protection have already been proposed and applied, none of these focuses on chat-based SE attacks while at the same time automation in the field is still missing. Social engineering is a complex phenomenon that requires interdisciplinary research combining technology, psychology, and linguistics. Attackers treat human personality traits as vulnerabilities and use the language as their weapon to deceive, persuade and finally manipulate the victims as they wish. Hence, a holistic approach is required to build a reliable SE attack recognition system. In this paper we present the current state-of-the-art on SE attack recognition systems, we dissect a SE attack to recognize the different stages, forms, and attributes and isolate the critical enablers that can influence a SE attack to work. Finally, we present our approach for an automated recognition system for chatbased SE attacks that is based on Personality Recognition, Influence Recognition, Deception Recognition, Speech Act and Chat History. CCS CONCEPTS • Security and privacy → Phishing; • Computing methodologies → Supervised learning;

User, Usage and Usability: Redefining Human Centric Cyber Security

“…By focusing on three unique components, this review aims to incorporate the concept of invisible security, that it, the automation of selective cyber security tasks, whilst maintaining the ability of the human user to remain in the loop and utilise collaborative intelligence between the human and the technology to further the cyber security domain. Historically, users are considered as the weakest link within cyber security ( Tsinganos et al, 2018 ), although they are not always to blame for security compromises ( Adams and Sasse, 1999 ). The effectiveness of too many cyber security measures are questioned in the wake of hard hitting security events, and there is a definite stigma attached to users in cyber space, particularly as a result of numerous cyber security events and breaches following on poor cyber behaviors of users.…”

SEADer++ v2: Detecting Social Engineering Attacks using Natural Language Processing and Machine Learning

“…Other proposed solutions such as [1] and [9] use complex state machines to map pathways that can be followed in order to mitigate an attack. The work in [3] is good in terms of a small survey on social engineering attacks by providing a relatively comprehensive background on them and on potential solutions. In [10] the authors provide an approach based on semantics of dialogues to detect social engineering attacks.…”

“…That's the main reason why these types of attacks are highly employed and are attractive to applied to others. In the past there were various approaches arguing theoretically that social engineering detection is important [1][2][3][4]. Apart from those there are some practical works based on natural language processing (NLP) and machine learning, including neural networks [5][6].…”

Vulnerabilities detection using attack recognition technique in multi-factor authentication

“…For example, a new set of attack instances are identified to allow IDS able to detect possible new type of intrusion. In decision making system, attack recognition is used to analyze user action in order to determine their goal or result [18][19][20]. Based on the output, an appropriate response is proposed to the user.…”