Teaching Methodology for Virtual Reality Practical Course in Engineering Education
DOI:
https://doi.org/10.46243/jst.2022.v7.i10.pp125-135Keywords:
Social Engineering, Speech Act, DeceptionAbstract
Increase in usage of electronic communication tools (email, IM, Skype, etc.) in enterprise environments has created new attack vectors for social engineers. Billions of people are now using elec- tronic equipment in their everyday workflow which means billions of potential victims of Social Engineering (SE) attacks. Human is considered the weakest link in cybersecurity chain and breaking this defense is nowadays the most accessible route for malicious internal and external users. While several methods of protection have already been proposed and applied, none of these focuses on chat-based SE attacks while at the same time automation in the field is still missing. Social engineering is a complex phenomenon that requires interdisciplinary research combining technology, psy- chology, and linguistics. Attackers treat human personality traits as vulnerabilities and use the language as their weapon to deceive, persuade and finally manipulate the victims as they wish. Hence, a holistic approach is required to build a reliable SE attack recogni- tion system. In this paper we present the current state-of-the-art on SE attack recognition systems, we dissect a SE attack to rec- ognize the different stages, forms, and attributes and isolate the critical enablers that can influence a SE attack to work. Finally, wepresent our approach for an automated recognition system for chat-based SE attacks that is based on Personality Recognition, Influence Recognition, Deception Recognition, Speech Act and Chat History.
References
2018. Information Technology-Information Security-Information Assurance | ISACA. (2018). https://www.isaca.org/pages/default.aspx Guozhen An. 2015. Literature review for Deception detection. Dr. Diss. City Univ. New York (2015)
Monique Bezuidenhout, Francois Mouton, and Hein S Venter. 2010. Social engi- neering attack detection model: Seadm. In Information Security for South Africa (ISSA), 2010. IEEE, 1–8
Ram Bhakta and Ian G Harris. 2015. Semantic analysis of dialogs to detect social engineering attacks. In Proc. 2015 IEEE 9th Int. Conf. Semant. Comput. IEEE ICSC 2015. IEEE, 424–427. https://doi.org/10.1109/ICOSC.2015.7050843
Ali Darwish, Ahmed El Zarka, and Fadi Aloul. 2012. Towards Understanding Phishing Victims’ Profile. In 2012 Int. Conf. Comput. Syst. Ind. Informatics. IEEE, 13–17
Marie-Catherine De Marneffe, Bill MacCartney, Christopher D Manning, and Others. 2006. Generating typed dependency parses from phrase structure parses. In Proceedings of LREC, Vol. 6. Genoa Italy, 449–454
Song Feng, Ritwik Banerjee, and Yejin Choi. 2012. Syntactic stylometry for de- ception detection. In Proceedings of the 50th Annual Meeting of the Association for Computational Linguistics: Short Papers-Volume 2. Association for Computational Linguistics, 171–175
David Gragg. 2003. A Multi-Level Defense Against Social Engineering Social
SANS Inst. (2003), 21. https://doi.org/10.9780/22307850
Francois Mairesse and Marilyn Walker. 2000. Words Mark the Nerds: Computa- tional Models of Personality Recognition through Language. In 28th Annu. Conf. Cogn. Sci. Soc., Vol. 28. 543–548
Navonil Majumder, Soujanya Poria, Alexander Gelbukh, and Erik Cambria. 2017. Deep learning-based document modeling for personality detection from text. IEEE Intelligent Systems 32, 2 (2017), 74–79
Maranda McBride, Lemuria Carter, and Merrill Warkentin. 2012. Exploring the role of individual employee characteristics and personality Page | 134 on employee compliance with cybersecurity policies. 2011 Dewald Roode Work. Inf. Syst. Secur. Res. (2012), 1–13. Kevin D Mitnick and William L Simon. 2011. The art of deception: Controlling the human element of security. John Wiley & Sons
Francois Mouton, Louise Leenen, and H S Venter. 2015. Social Engineering Attack Detection Model: SEADMv2. In 2015 Int. Conf. Cyberworlds. IEEE, 216–223. https://doi.org/10.1109/CW.2015.52 Marcus Nohlberg. 2008. Securing Information Assets: Understanding, Measuring and Protecting against Social Engineering Attacks. Ph.D. Dissertation. Department of Computer and Systems Sciences (together with KTH), Stockholm University, Kista
Yuki Sawa, Ram Bhakta, Ian G Harris, and Christopher Hadnagy. 2016. Detec- tion of Social Engineering Attacks Through Natural Language Processing of Conversations. In 2016 IEEE Tenth Int. Conf. Semant. Comput. IEEE, 262–265. https://doi.org/10.1109/ICSC.2016.95 Jamison W Scheeres. 2008. Establishing the Human Firewall: Reducing an In- dividual’S Vulnerability To Social Engineering Attacks
Technical Report. DTIC Document. 49 pages. Bernadette H Schell and Clemens Martin. 2006. Webster’s New World Hacker Dictionary. Wiley Pub, Indianapolis, IN. 387 pages. John R Searle, Ferenc Kiefer, Manfred Bierwisch, and Others. 1980. Speech act theory and pragmatics. Vol. 10. Springer
Charles Donald Spielberger. 2004. Encyclopedia of applied psychology. Elsevier Academic Press
Miron Zuckerman, Bella M Depaulo, and Robert Rosenthal. 1981. Verbal and nonverbal communication of deception. Adv. Exp. Soc. Psychol. 14, C (1981), 1–59. https://doi.org/10.1016/S0065-2601(08)60369-X arXiv:2066187
