Ryan Heartfield|George Loukas|Diane Gan
You Are Probably Not the Weakest Link: Towards Practical Prediction of Susceptibility to Semantic Social Engineering Attacks
ORCID|University of Greenwich|University of Greenwich|University of Greenwich
semantic social engineering attacks pervasive threat computer communication systems employing deception rather exploiting technical vulnerabilities spearphishing obfuscated urls driveby downloads spoofed websites scareware attacks able circumvent traditional technical security controls target user directly aim explore feasibility predicting user susceptibility deceptionbased attacks attributes measured preferably realtime automated manner toward goal conducted two experiments first 4333 users recruited internet allowing us identify useful highlevel features association rule mining second smaller group 315 users allowing us study features detail experiments participants presented attack nonattack exhibits tested terms ability distinguish two using data collected determined practical predictors users susceptibility semantic attacks produce evaluate logistic regression random forest prediction model accuracy rates 68 71 respectively observed security training makes noticeable difference users ability detect deception attempts one important features time since last selfstudy formal security education lectures appears much less useful predictor important features computer literacy familiarity frequency access specific platform depending organisations preferences models learned configured minimise false positives false negatives maximise accuracy based probability threshold models threshold choice 055 would keep false positives false negatives 02