Концептуальная модель цикла социоинженерной атаки: современные подходы и архитектура прототипа программного комплекса
Аннотация
Социоинженерные атаки являются одной из ключевых проблем современности. С каждым годом их количество и эффективность сохраняют тенденцию роста. В настоящей работе приводится обзор существующих исследований, посвящённых проблеме защищенности пользователей от социоинженерных атак. На основе сделанного обзора предлагается концептуальная модель цикла социоинженерной атаки и архитектура прототипа программного комплекса, преимуществом которого перед существующими аналогами является учёт профиля злоумышленника и набор существующих инструментов для атаки. Практическая значимость заключается в создании основы для разработки программного решения для моделирования социоинженерной атаки и последующего выявления наиболее уязвимых сотрудников организации к социоинженерным атакам, учитывающее сведения о потенциальном объекте атаки.
Литература
Federal Bureau of Investigation “IC3 Logs 6 Million Complaints. Record Increase in Reporting Brings IC3 to New Milestone,” in fbi.gov, [News], 14 May 2021. [Online]. Available: https://www.fbi.gov/news/stories/ic3-logs-6-million-complaints-051721
D. Snyman and H. Kruger, “External Contextual Factors in Information Security Behaviour,” in Proc. of the 6th Int. Conf. on Information Systems Security and Privacy — ICISSP, Valletta, Malta, 2020, 2020, pp. 185–194; doi: 10.5220/0009142201850194
Z. Wang, L. Sun, and H. Zhu, “Defining social engineering in cybersecurity,” IEEE Access, vol. 8, pp. 85094– 85115, 2002; doi: 10.1109/ACCESS.2020.2992807
F. Salahdine, N. Kaabouch, “Social engineering attacks: A survey,” Future Internet, vol. 11, no. 4, pp. 89, 2019; doi: 10.3390/fi11040089
M. V. Abramov, T. V. Tulupyeva, A. L. Tulupyev, Sotsioinzhenernye ataki: sotsial’nye seti i otsenki zashchishchennosti pol’zovatelei [Social engineering attacks: social networks and user security assessments], St. Petersburg: GUAP, 2018 (in Russian).
The National Cyber Security Centre, “Weekly Threat Report 30th July 2021,” in ncsc.gov.uk, [Report], 30 Jul. 2021. [Online]. Available:https://www.ncsc.gov.uk/report/weekly-threat-report-30th-july-2021
K. Zheng, T. Wu, X. Wang, B. Wu, and C. Wu, “A Session and Dialogue-Based Social Engineering Framework,” IEEE Access, vol. 7, pp. 67781–67794, 2019; doi: 10.1109/ACCESS.2019.2919150
F. Mouton, L. Leenen, and H. S. Venter, “Social engineering attack examples, templates and scenarios,” Computers & Security, vol. 59, pp. 186–209, 2016; doi: 10.1016/j.cose.2016.03.004
M. Hijji and G. Alam, “A Multivocal Literature Review on Growing Social Engineering Based Cyber-Attacks/Threats During the COVID-19 Pandemic: Challenges and Prospective Solutions,” IEEE Access, vol. 9, pp. 7152–7169, 2021; doi: 10.1109/ACCESS.2020.3048839
A. Gryszczynska, “The impact of the COVID-19 pandemic on cybercrime” Bulletin of the Polish Academy of Sciences. Technical Sciences, vol. 69, no. 4, p. e137933, 2021; doi: 10.24425/bpasts.2021.137933
R. Naidoo, “A multi-level influence model of COVID-19 themed cybercrime,” European Journal of Information Systems, vol. 29, no. 3, pp. 306–321, 2020; doi: 10.1080/0960085X.2020.1771222
Z. Wang, H. Zhu, P. Liu, and L. Sun, “Social engineering in cybersecurity: a domain ontology and knowledge graph application examples,” Cybersecurity, vol. 4, no. 1, 2021; doi: 10.1186/s42400-021-00094-6
J.-W. Bullee and M. Junger, “How effective are social engineering interventions? A meta-analysis,” Information & Computer Security, vol. 28, no. 5, pp. 801–830, 2020; doi: 10.1108/ICS-07-2019-0078
K. F. Steinmetz, A. Pimentel, and W. R. Goe, “Performing social engineering: A qualitative study of information security deceptions,” Computers in Human Behavior, vol. 124, p. 106930, 2021; doi: 10.1016/j.chb.2021.106930
Z. Wang, H. Zhu, and L. Sun, “Social Engineering in Cybersecurity: Effect Mechanisms, Human Vulnerabilities and Attack Methods,” IEEE Access, vol. 9, pp. 11895–11910, 2021; doi: 10.1109/ACCESS.2021.3051633
K. D. Mitnick and W. L. Simon, The art of deception: Controlling the human element of security, Indianapolis, IN, USA: John Wiley & Sons, 2003.
A. Yasin, R. Fatima, L. Liu, J. Wang, R. Ali, and Z. Wei, “Understanding and deciphering of social engineering attack scenarios,” Security and Privacy, vol. 4, no. 4, pp. e161, 2021; doi: 10.1002/spy2.161
H. Aldawood and G. Skinner, “An academic review of current industrial and commercial cyber security social engineering solutions,” in Proc. of the 3rd International Conference on Cryptography, Security and Privacy — ICCSP’19, 2019. pp. 110–115; doi: 10.1145/3309074.3309083
M. Lansley, F. Mouton, S. Kapetanakis, and N. Polatidis, “SEADer++: social engineering attack detection in online environments using machine learning,” Journal of Information and Telecommunication, vol. 4, no. 3, pp. 346–362, 2020; doi: 10.1080/24751839.2020.1747001
N. Tsinganos, G. Sakellariou, P. Fouliras, and I. Mavridis, “Towards an Automated Recognition System for Chatbased Social Engineering Attacks in Enterprise Environments,” in Proc. of the 13th International Conference on Availability, Reliability and Security, Aug. 2018, 2018, pp. 1–10; doi: 10.1145/3230833.3233277
S. Barth, M. D. T. de Jong, M. Junger, P. H. Hartel, and J. C. Roppelt, “Putting the privacy paradox to the test: Online privacy and security behaviors among users with technical knowledge, privacy awareness, and financial
resources,” Telematics and Informatics, vol. 41, pp. 55–69, 2019; doi: 10.1016/j.tele.2019.03.003
S. Barth, M. D. T. de Jong, M. Junger, P. H. Hartel, and J. C. Roppelt, “Putting the privacy paradox to the test: Online privacy and security behaviors among users with technical knowledge, privacy awareness, and financial resources,” Telematics and Informatics, vol. 41, pp. 55–69, 2019; doi: 10.3390/electronics9091382
Z. Ye, Y. Guo, A. Ju, F. Wei, R. Zhang, and J. Ma, “A Risk Analysis Framework for Social Engineering Attack Based on User Profiling,” Journal of Organizational and End User Computing, vol. 32, no. 3, pp. 37–49, 2020; doi: 10.4018/JOEUC.2020070104
A. A. Moustafa, A. Bello, and A. Maurushat, “The Role of User Behaviour in Improving Cyber Security Management,” Frontiers in Psychology, vol. 12, article 561011, 2021; doi: 10.3389/fpsyg.2021.561011
S. M. Albladi and G. R. S. Weir, “User characteristics that influence judgment of social engineering attacks in social networks,” Human-centric Computing and Information Sciences, vol. 8, no. 1, pp. 1–24, 2018; doi: 10.1186/s13673-018-0128-7
M. Edwards, R. Larson, B. Green, A. Rashid, and A. Baron, “Panning for gold: Automatically analysing online social engineering attack surfaces,” Computers & Security, vol. 69, pp. 18–34, 2017; doi: 10.1016/j.cose.2016.12.013
A. Toropova and T. Tulupyeva, “Comparison of Behavior Rate Models Based on Bayesian Belief Network,” in Recent Research in Control Engineering and Decision Making. ICIT 2020. Studies in Systems, Decision and Control, vol. 337, pp. 510–521, 2020; doi: 10.1007/978-3-030-65283-8_42
J. Wang, X. Wang, H. Zhang, B. Fang, Y. Yang, and J. Liu, “Information Classification and Extraction on Official Web Pages of Organizations,” Computers, Materials & Continua, vol. 64, no. 3, pp. 2057–2073, 2020; doi: 10.32604/cmc.2020.011158
I. Nurgaliev, Q. Qu, S. M. H. Bamakan, and M. Muzammal, “Matching user identities across social networks with limited profile data,” Frontiers of Computer Science, vol. 14, no. 6, pp. 1–14, 2020; doi: 10.1007/s11704-019-8235-9
D. K. Srivastava and B. Roychoudhury, “Words are important: A textual content based identity resolution scheme across multiple online social networks,” Knowledge-Based Systems, vol. 195, p. 105624, 2020; doi:
1016/j.knosys.2020.105624
L. Wang, K. Hu, Y. Zhang, and S. Cao, “Factor Graph Model Based User Profile Matching Across Social Networks,” IEEE Access, vol. 7, pp. 152429–152442, 2019; doi: 10.1109/ACCESS.2019.2948073
Y. Li, Z. Zhang, Y. Peng, H. Yin, and Q. Xu, “Matching user accounts based on user generated content across social networks,” Future Generation Computer Systems, vol. 83, pp. 104–115, 2018; doi: 10.1016/j.future.2018.01.041
V. D. Oliseenko and T. V. Tulupyeva, “Neural Network Approach in the Task of Multi-label Classification of User Posts in Online Social Networks,” in Proc. of XXIV Int. Conf. on Soft Computing and Measurements (SCM), May 2021, 2021, pp. 46–48; doi: 10.1109/SCM52931.2021.9507148
V. Oliseenko and A. Korepanova, “How old users are? Community analysis,” in CEUR Workshop Proc. RWTH Aahen University, vol. 2782, 2020, pp. 246–251.
Материал публикуется под лицензией:
