Contemplating social engineering studies and attack scenarios: A review study

Abstract

The previous year has seen an enormous increase in the studies related to social engineering. This increase is partly due to increasing number of social engineering attacks and partly due to people's inability to identify the attack. Thus, it is of great importance to find solutions which are helpful for human to understand the social engineering attacks and scenarios. To address this, we have performed a literature review of studies (on social engineering) in top-notch journals and conferences. In this paper, we have enlisted the types of attacks, and the persuasion techniques used by social engineers as listed in the literature. We also combined different theories which researchers tried to use to explain various activities of social engineers. Furthermore, we have mentioned that a better understanding of the social engineering attack scenarios can be done using thematic and game-based analysis techniques.Preliminary empirical evaluation of the proposed game based method shows overall neutral results. Future extension and evaluation is needed for the proposed methods. K E Y W O R D Scybercrime, cyber-security, human factors, human-centered, information security, review, social engineering

A comprehensive survey of AI-enabled phishing attacks detection techniques

“…They performed a detailed survey of existing techniques such as Machine Learning (ML) based approaches, Non-machine Learning-based approaches, Neural Network-based approaches, and Behavior-based detection approaches for phishing attack detection. Authors in Yasin et al [ 64 ] consolidated various studies that researchers have used to clarify different exercises of social specialists. Moreover, they proposed that a higher comprehension of the social engineering attack scenarios would be possible utilizing topical and game-based investigation techniques.…”

An Advanced Taxonomy for Social Engineering Attacks

“…This type of in person interaction involves the representation and faking others' personalities and identities. In order to gain information, social engineers showcase themselves as some other people and then get access to secured, confidential, and private information [1][2][3][4][5][6][7][8]. A common case of impersonation is at the helpdesk level [9].…”

“…Attackers gain access to information by targeting individuals, but in most cases the intended target is their organizations. Some of the organizations that have witnessed social engineering attacks recently include RSA SecurID, Associated Press, Bit9, Target Network, the United States Department of Labor, Sony Pictures, Yahoo, Ubiquiti Network, Democratic National Convention, and the United States Department of Justice [4].…”

Internet of things (IoT): a technology review, security issues, threats, and open challenges

“…• Spear-Phishing Attack. It is a type of attack that belong to email spoofing, in which the victim is attracted to opening the email that can be used to use the credentials of the particular victim and after that will pretense to gain access for more sensitive information [11,56,57].…”