An Effective Double-layer Detection System Against Social Engineering Attacks

Authors

Daojing He, School of Information Engineering, Jiangxi University of Science and Technology, Ganzhou, P.R. China & School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, P.R. China
Xin Lv, School of Information Engineering, Jiangxi University of Science and Technology, P.R. China
Xueqian Xu, Software Engineering Institute, East China Normal University, Shanghai, P.R. China
Shui Yu, School of Software, University of Technology Sydney, Australia
Dawei Li, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, P.R. China
Sammy Chan, Department of Electrical Engineering, City University of Hong Kong, Kowloon, Hong Kong
Mohsen Guizani, Mohamed bin Zayed University of Artificial IntelligenceFollow

Document Type

Article

Publication Title

IEEE Network

Abstract

In recent years, social engineering attacks that use phishing emails as the medium and target specific groups of people have occurred frequently. Current enterprise systems are vulnerable to detect social engineering attacks. In addition, existing detection methods are relatively ineffective. Therefore, we propose a double-layer detection framework based on deep learning technology. First, a phishing email detection model based on Long Short-Term Memory (LSTM) and extreme gradient boosting tree (XGBoost) is designed from the perspective of individual security. Then, an insider threat detection model based on Bidirectional LSTM and Attention mechanism is designed from the perspective of group security. Finally, combined with the social engineering network attack simulation theory, a social engineering attack and defense simulation platform is established. In the double-layer framework, we use Bi-LSTM to obtain long-range dependent features of email body and user sequence information. Then XGBoost and Attention mechanism are used to further strengthen the network structure and improve the classification accuracy. Compared with traditional methods, our model does not require manual feature extraction, and can accurately identify phishing emails and insider threats. Finally, our proposed social engineering simulation platform verifies the effectiveness of the two-layer model. The experimental results show that our proposed framework has the characteristics of timely detection and after-the-fact investigation, which can effectively detect phishing attacks and insider threats faced by enterprise systems. IEEE

First Page

1

Last Page

7

DOI

10.1109/MNET.105.2100425

Publication Date

8-1-2022

Keywords

Data mining, Deep learning, Electronic mail, Feature extraction, Hidden Markov models, Phishing, Psychology, Computer crime, Data mining, E-learning, Electronic mail, Extraction, Feature extraction, Long short-term memory, Simulation platform

Comments

IR Deposit conditions:

OA version (pathway a) Accepted version

No embargo

When accepted for publication, set statement to accompany deposit (see policy)

Must link to publisher version with DOI

Publisher copyright and source must be acknowledged

Recommended Citation

D. He et al., "An Effective Double-layer Detection System Against Social Engineering Attacks," in IEEE Network, doi: 10.1109/MNET.105.2100425.