A Study on the Psychology of Social Engineering-Based Cyberattacks and Existing Countermeasures

Abstract

As cybersecurity strategies become more robust and challenging, cybercriminals are mutating cyberattacks to be more evasive. Recent studies have highlighted the use of social engineering by criminals to exploit the human factor in an organization’s security architecture. Social engineering attacks exploit specific human attributes and psychology to bypass technical security measures for malicious acts. Social engineering is becoming a pervasive approach used for compromising individuals and organizations (is relatively more convenient to compromise a human compared to discovering a vulnerability in the security system). Social engineering-based cyberattacks are extremely difficult to counter as they do not follow specific patterns or approaches for conducting an attack, making them highly effective, efficient, easy, and obscure approaches for compromising any organization. To counter such attacks, a better understanding of the attack tactics is highly essential. Hence, this paper provides an in-depth analysis of the approaches used to conduct social engineering-based cyberattacks. This study discusses human vulnerabilities employed by criminals in recent security breaches. Further, the paper highlights the existing approaches, including machine learning-based methods, to counter social engineering-based cyberattacks.

Are You a Soft Target for Cyber Attack? Drivers of Susceptibility to Social Engineering-Based Cyber Attack (SECA): A Case Study of Mobile Messaging Application

“…The results highlighted the important implications of increasing literacy in relation to cyber security. Siddiqi et al [40] suggested methods to counter SECA and concluded that training and educating individuals about cybersecurity measures and SECA is the top priority. With greater knowledge of the risk of attacks, a person can be more alert to SECAs.…”

Tier-Based Optimization for Synthesized Network Intrusion Detection System

“…Yeo-Johnson [38] can be denoted as (5). Where 'j' represents feature attributes, 'λ' can be a R, and λ =1 gives the identity conversion.…”

“…As per recent surveys, the reported cyberattacks in 2021 were approximately 5.1 billion [3] [4]. The reports also indicate a surge in sophisticated and high-impact cyberattacks on critical infrastructure globally [4] [5]. Understandably, such a high number of cyberattacks indicate the need for enhancement in network security approaches.…”

Utilizing Convolutional Neural Networks and Word Embeddings for Early-Stage Recognition of Persuasion in Chat-Based Social Engineering Attacks

“…The authors in [8] used a modern approach to classify social engineering attacks based on the technique and the influence tactic that was employed. Furthermore, the authors mapped several types of attacks to various human vulnerabilities.…”

“…The difference between them lies in the fact that in compliance, a direct request is used to force a change in someone's behavior while in 'persuasion,' we are sending a message to force someone to change his/her behavior because of the message reception. Additionally, in [8], the authors further elaborate on influence methodologies, where they present the following categories: social influence, persuasion, attitude and behavior, trust and deception, language, and reasoning, countering social engineering-based cyberattacks, and machine learning-based countermeasures. Moreover, they classified the persuasion method into distinct types of persuasion: similarity, distraction, curiosity, and persuasion using authority.…”