Social engineering attack detection method based on context awareness

Abstract

The invention provides a social engineering attack detection method based on context awareness, and aims to solve the problem that dynamically changing social engineering attacks cannot be effectively handled in the prior art. According to the method, the emotional state, the decision-making mode and the daily behavior mode of a user are continuously monitored by constructing a context awareness system, and user behaviors are analyzed and monitored in real time in combination with a personalized behavior baseline model. The system measures the deviation between the user behavior and the baseline model by using a composite function and a multi-dimensional feature fusion technology, and when an abnormal behavior is detected, the system automatically triggers security policy adjustment, such as starting multi-factor authentication or limiting high-risk operation. Experimental results show that social engineering attacks can be effectively recognized in complex and changeable attack scenes, and the detection accuracy and response speed are remarkably improved. The method can be widely applied to the field of network security, and is especially suitable for an environment requiring highly customized security protection.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a social engineering attack detection method based on situational awareness. Background Art

[0002] Currently, with the rapid development of information technology, the means of social engineering attacks are becoming more and more complex and covert. Traditional security protection methods mainly rely on the detection and defense of known attack patterns. These methods have significant limitations when facing the ever-changing and escalating social engineering attacks. Especially in complex network environments, attackers can cleverly use users' psychological weaknesses and behavioral habits to launch attacks, making it difficult for traditional detection methods to effectively identify and prevent them.

[0003] Existing network security systems often lack comprehensive analysis of user contexts when responding to social engineering attacks, resulting in the system being unable to accurately perceive the user's vulnerability in a specific context. This deficiency allows attackers to successfully launch attacks when users are emotionally unstable, have reduced decision-making abilities, or have changed behavior habits, thereby causing serious security risks. In addition, the existing system lacks real-time monitoring and dynamic analysis of user behavior patterns, resulting in insufficient accuracy in detecting abnormal behavior and being unable to respond to potential threats in a timely manner.

[0004] Although some security systems have introduced advanced protection measures such as multi-factor authentication, these measures usually only focus on confirming the identity of the user, but fail to take into account the contextual factors behind the user's behavior. This makes the system often passive when dealing with complex social engineering attacks, unable to provide flexible security policy adjustments, and difficult to effectively prevent attack risks. Summary of the invention

[0005] The present invention is a social engineering attack detection method based on context awareness, which solves the problem of inaccurate social engineering attack identification caused by the inability of traditional detection means to comprehensively consider user context factors and behavior pattern changes.

[0006] A social engineering attack detection method based on context awareness provided by the present invention comprises the following steps:

[0007] (1) Situational data collection: collecting users’ emotional state data, decision-making pattern data, and daily behavior pattern data;

[0008] (2) Data preprocessing: De-noising, normalization, and standardization of the collected context data to ensure the consistency of the context data across different times, devices, and environments;

[0009] (3) User behavior baseline construction: Based on the preprocessed context data and the user's historical behavior data, the user's normal behavior pattern baseline is constructed. The normal behavior pattern baseline is modeled using a nonlinear time series model to obtain a baseline model.

[0010] (4) Behavior anomaly detection: In real-time monitoring, abnormal behavior is identified by comparing the user's current behavior with the baseline behavior;

[0011] (5) Situational response and policy adjustment: When abnormal behavior is detected, the system responds according to the user’s current

[0012] Adjust security policies based on previous situational status;

[0013] (6) Data storage and logging: Each anomaly detection result and the adjusted security policy are recorded in the log, and the log records are stored in the database for subsequent analysis.

[0014] Furthermore, the emotional state data includes stress level and fatigue; the decision-making pattern data includes click frequency, page dwell time, and mouse trajectory; the daily behavior pattern data includes commonly used software and file access records; the emotional state data is collected through skin electrical response sensors, heart rate monitors, and eye tracking devices, and the decision-making pattern data is acquired in real time through a user operation habit monitoring module.

[0015] Furthermore, in step (2), the collected situational data is subjected to denoising, normalization and standardization, specifically including: filtering out high-frequency noise through wavelet transform, filling in missing data through interpolation algorithm, and using standardization method to make data of different dimensions comparable.

[0016] Furthermore, the baseline model expression in step (3) is as follows:

[0017]

[0018] Among them, B(t) represents the baseline behavior value of the user at time point t, X i (t) is the value of the i-th dimension of the context data at time point t, α i is the weight coefficient for each dimension, τ i is the time lag of the relevant behavior, λ i is the decay factor, β(s) and δ(s) are the historical behavior functions at time point s, and γ is the adjustment coefficient. The model can consider the time dependence and decay characteristics of user behavior, making the baseline model more accurate and dynamic.

[0019] Furthermore, the baseline model in step (3) is expressed as follows to take into account nonlinearity and high-order temporal correlation:

[0020]

[0021] Among them, B(t) represents the baseline behavior value of the user at time point t, X i (t) is the value of the i-th dimension of the context data at time point t, α i is the weight coefficient for each dimension, τ i is the time lag of the relevant behavior, λ i is the attenuation factor, β(s) and δ(s) are the historical behavior functions at time point s, and γ is the adjustment coefficient; ω i ,φ i ,θ i and δ i is an advanced parameter and ζ(s) is the time decay function, which enables the model to capture more complex behavior patterns and time characteristics.

[0022] Furthermore, in step (4), abnormal behavior is identified by comparing the difference between the user's current behavior and the baseline behavior, where the difference metric is expressed as follows:

[0023]

[0024] Among them, A j (t) is the actual behavior value of the user in the jth dimension at time point t, B j (t) is the baseline behavior value corresponding to time point t, σ j is the standard deviation of the behavior in the jth dimension. The behavioral deviation in multiple dimensions is quantified by calculating the Euclidean distance. If Δ(t) exceeds the dynamically adjusted threshold θ(t), it is judged as abnormal behavior.

[0025] Furthermore, the threshold θ(t) is calculated according to the following formula:

[0026]

[0027] Among them, μ Δ (t) is the time average of the user's historical deviation value, σ Δ (t) is the time standard deviation of the user's historical deviation value, φ is the adjustment coefficient, H k (t) is the weight of the kth influencing factor at time point t, ρ k As the corresponding adjustment coefficient, the threshold dynamic adjustment mechanism can flexibly respond to potential attacks according to changes in situational factors.

[0028] Furthermore, in step (5), when abnormal behavior is detected, the system adjusts the security policy according to the user's current situational state, which is specifically determined by the following function:

[0029]

[0030] Among them, S(t) is the security policy adjusted at time point t, κ is the adjustment coefficient, ∈(t) is the noise term, η is the correction factor, and E(t) is the user's emotional state value; the system adjusts the strictness of security measures according to the severity of behavioral deviations and the user's emotional state, including adding multi-factor authentication, real-time encryption of sensitive data, performing high-priority security scans, and restricting specific operation permissions.

[0031] Furthermore, the log record of step (6) includes a detailed description of the abnormal behavior, the specific situation during detection, the security strategy adopted, and the effectiveness evaluation and feedback of the strategy.

[0032] Furthermore, it also includes:

[0033] (7) System self-learning and optimization: The system continuously updates and optimizes the user's behavior baseline model through long-term monitoring and recording, and gradually adjusts the weight coefficient α through machine learning algorithms. i , β(s) and the adjustment coefficient γ are used to improve the accuracy of detection and the adaptability of the response strategy.

[0034] Furthermore, the data storage and log recording in step (6) adopts a tamper-proof data storage mechanism based on blockchain to ensure the security and integrity of abnormal behavior detection and response records.

[0035] Furthermore, the machine learning algorithm in step (7) uses a recurrent neural network (RNN) or a long short-term memory network (LSTM) to process time series data to improve the long-term prediction capability of user behavior patterns and the response sensitivity to abnormal behaviors.

[0036] The present invention has the following advantages:

[0037] 1. Context-aware analysis: By real-time monitoring of users’ emotional states, decision-making patterns, and behavioral patterns, the system dynamically perceives user contexts and improves the accuracy of social engineering attack detection.

[0038] 2. Dynamic behavior baseline: A dynamic behavior baseline model is built based on user historical behavior data, which can promptly identify abnormal behaviors that are significantly different from the baseline behavior, thereby quickly responding to potential threats.

[0039] 3. Intelligent policy adjustment: Intelligently adjust security policies according to the user's current situation status, realize precise and flexible security protection, and enhance the system's anti-attack capabilities.

[0040] 4. Multi-dimensional data fusion: Adopting multimodal data processing algorithms to integrate emotion, decision-making and behavioral data, it improves the relevance and expressiveness of data analysis and enhances the comprehensiveness of attack detection.

[0041] 5. Self-learning optimization: The system has a self-learning function, which gradually improves the detection accuracy of abnormal behaviors and the adaptability of the system by continuously updating and optimizing the behavioral baseline model and detection parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of the social engineering attack detection method based on context awareness of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] like Figure 1 As shown, an embodiment of the present invention proposes a social engineering attack detection method based on contextual awareness. The method perceives the user's current context in real time by comprehensively monitoring the user's emotional state, decision-making pattern, and daily behavior pattern, thereby identifying malicious program behaviors caused by social engineering means. Specifically, the present invention constructs a normal behavior baseline model of the user by collecting and analyzing the user's behavior data in different contexts, and can dynamically identify abnormal behaviors that are significantly different from the baseline behavior. This method can not only detect potential attack behaviors in a timely manner, but also intelligently adjust security policies according to the user's contextual status, provide more accurate and flexible protection measures, and effectively improve the security and anti-attack capabilities of the system.

[0045] In order to verify the effectiveness of the context-aware social engineering attack detection method of the present invention, the following experiment was designed and conducted. The experiment involved 12 users, simulated operation behaviors in different scenarios, and introduced a variety of social engineering attack scenarios, and detected these attacks using the method of the present invention.

[0046] Experimental environment

[0047] Hardware configuration: Each user uses a high-performance terminal device equipped with a heart rate monitor, galvanic skin response sensor, eye tracking device and user operation monitoring module. The data is transmitted to the centralized processing server via the local area network.

[0048] Software configuration: The system runs on Windows 10 platform and uses a context-aware system developed using TensorFlow and PyTorch. Data is stored in a MySQL database, and data stream processing is performed in real time through Apache Kafka.

[0049] Experimental period: Each user participates in a 4-week behavioral data collection and attack detection experiment.

[0050] Experimental procedures

[0051] 1. Data collection and preprocessing: During the experiment, the system continuously monitors the user's emotional data (such as heart rate, skin galvanic response), decision-making pattern data (such as mouse movement trajectory, click frequency), and daily behavior pattern data (such as file access records, application usage frequency). The data is stored in a MySQL database after standardization and denoising.

[0052] 2. Construction of behavioral baseline model: Based on the collected data, the system builds a personalized behavioral baseline model for each user. The mathematical expression of the model is:

[0053]

[0054] Among them B u (t) is the behavior baseline value of user u at time point t, α ui , ui , δ ui Parameters such as α and β are optimized by genetic algorithm to improve the accuracy and stability of the model.

[0055] 3. Social engineering attack scenario design: Six social engineering attack scenarios were designed in the experiment, including phishing emails, fake login pages, malicious link clicks, social media deception, telephone fraud, and fake software updates. These scenarios are randomly triggered when users perform routine operations, aiming to induce users to make wrong judgments.

[0056] 4. Behavior anomaly detection and security policy adjustment: The system continuously monitors the difference between the user's real-time behavior and his baseline behavior, and performs anomaly detection through the following formula:

[0057]

[0058] When Δ u (t) exceeds the threshold value θ u (t), the system automatically adjusts security policies, such as triggering multi-factor authentication or forcing exit from high-risk operations.

[0059] 5. Experimental data analysis: After the experiment, the user behavior data and test results were analyzed to obtain the following experimental data, as shown in Table 1:

[0060] Table 1

[0061]

[0062] According to the experimental results, the present invention has the following innovations:

[0063] 1. Context-aware system: Existing social engineering attack detection methods mainly rely on static rules or feature extraction based on historical data, which makes it difficult to cope with dynamically changing attack methods and user behaviors. For example, traditional anti-phishing systems detect by matching known malicious URLs or content features, but these methods are easily bypassed by disguised or new attack methods. The context-aware system proposed in the present invention dynamically adjusts the detection model by continuously monitoring the user's emotional state (such as heart rate, skin electrical response), decision-making patterns (such as mouse trajectory, click frequency) and daily behavior patterns (such as file access records, application usage frequency). This real-time context-based monitoring method enables the system to identify the moments when users are more vulnerable to social engineering attacks in specific situations, thereby improving the sensitivity and accuracy of detection.

[0064] 2. Personalized behavior baseline model: Traditional user behavior analysis mostly adopts a unified model or predefined behavior pattern, lacking personalized feature analysis for individual users, and is therefore prone to false positives or omissions when faced with differences in user habits. The behavior baseline construction method in the prior art is usually based on average statistical characteristics, ignoring the individual differences and dynamic changes in user behavior. The present invention adapts to the specific behavior pattern of each user by constructing a personalized behavior baseline model. The model uses complex mathematical expressions, combined with genetic algorithm optimization, to dynamically adjust model parameters so that it can accurately describe the user's actual behavior pattern. Compared with the existing unified model, the personalized model of the present invention can more effectively detect abnormal behaviors that deviate from the user's normal behavior, significantly reducing the false alarm rate.

[0065] 3. Real-time anomaly detection and security policy adjustment: Existing anomaly detection methods are usually based on offline analysis of historical data, lacking the ability to dynamically monitor real-time behavior and respond immediately. For example, some existing technologies require manual intervention or manual triggering of security measures after detecting abnormal behavior, resulting in untimely response. The anomaly detection system of the present invention calculates the difference between user behavior and baseline behavior in real time, measures the difference using a composite function, and automatically triggers security policy adjustments when the preset threshold is exceeded. The system is able to respond immediately when potential threats are detected, such as initiating multi-factor authentication or restricting high-risk operations, significantly improving defense effectiveness and response speed.

[0066] 4. Social engineering attack scenario design and identification: Traditional social engineering attack detection technology usually relies on known attack features or predefined attack rules, and the detection effect is poor when facing unknown or variant attacks. In addition, the existing attack scenario designs are often not comprehensive enough and it is difficult to cover various forms of attacks. The present invention simulates a real attack environment by designing a variety of social engineering attack scenarios, including phishing emails, fake login pages, malicious link clicks, social media deception, telephone fraud, and false software updates. The system can automatically identify and distinguish attack behaviors in these scenarios, and detect and respond in a timely manner through situational awareness technology. The diversity of this scenario design and the flexibility of the system significantly improve the ability to identify unknown and variant attacks.

[0067] 5. Data analysis and model optimization: Existing data analysis methods usually use linear models or simple machine learning algorithms, which are difficult to handle complex behavior patterns and multi-dimensional data interactions. Model optimization methods are also mostly limited to simple parameter tuning, which makes it difficult to effectively improve detection accuracy. The present invention introduces a multi-level data analysis model in the data analysis stage, which comprehensively analyzes the complex relationship between user behavior and contextual data through composite functions and multi-dimensional feature fusion. In addition, the present invention uses genetic algorithms for model optimization, combines real-time feedback from users and historical data, and continuously adjusts and evolves model parameters, which greatly improves detection accuracy and defense effectiveness.

[0068] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A social engineering attack detection method based on context awareness, characterized in that: The following steps are involved: (1) Situational data collection: collecting users’ emotional state data, decision-making pattern data, and daily behavior pattern data; (2) Data preprocessing: De-noising, normalization, and standardization of the collected context data to ensure the consistency of the context data across different times, devices, and environments; (3) User behavior baseline construction: Based on the preprocessed context data and the user's historical behavior data, the user's normal behavior pattern baseline is constructed. The normal behavior pattern baseline is modeled using a nonlinear time series model to obtain a baseline model. (4) Behavior anomaly detection: In real-time monitoring, abnormal behavior is identified by comparing the user's current behavior with the baseline behavior; (5) Situational response and policy adjustment: When abnormal behavior is detected, the system adjusts the security policy based on the user's current situational status; (6) Data storage and logging: Each anomaly detection result and the adjusted security policy are recorded in the log, and the log records are stored in the database for subsequent analysis.

2. The method according to claim 1, characterized in that The emotional state data includes stress level and fatigue; the decision-making pattern data includes click frequency, page dwell time, and mouse trajectory; the daily behavior pattern data includes commonly used software and file access records; the emotional state data is collected through skin electrical response sensors, heart rate monitors, and eye tracking devices, and the decision-making pattern data is acquired in real time through a user operation habit monitoring module.

3. The method according to claim 1, characterized in that In step (2), the collected situational data is subjected to denoising, normalization and standardization, specifically including: filtering out high-frequency noise through wavelet transform, filling in missing data through interpolation algorithm, and using standardization method to make data of different dimensions comparable.

4. The method according to claim 1, characterized in that: The baseline model expression in step (3) is as follows: Among them, B(t) represents the baseline behavior value of the user at time point t, X i (t) is the value of the i-th dimension of the context data at time point t, α i is the weight coefficient for each dimension, τ i is the time lag of the relevant behavior, λ i is the decay factor, β(s) and δ(s) are the historical behavior functions at time point s, and γ is the adjustment coefficient. The model can consider the time dependence and decay characteristics of user behavior, making the baseline model more accurate and dynamic.

5. The method according to claim 1, characterized in that The baseline model expression in step (3) is as follows, which is used to take into account nonlinearity and high-order time correlation: Among them, B(t) represents the baseline behavior value of the user at time point t, X i (t) is the value of the i-th dimension of the context data at time point t, α i is the weight coefficient for each dimension, τ i is the time lag of the relevant behavior, λ i is the attenuation factor, β(s) and δ(s) are the historical behavior functions at time point s, and γ is the adjustment coefficient; ω i ,φ i ,θ i and δ i is an advanced parameter and ζ(s) is the time decay function, which enables the model to capture more complex behavior patterns and time characteristics.

6. The method according to claim 4 or 5, characterized in that: Step (4) identifies abnormal behavior by comparing the difference between the user's current behavior and the baseline behavior, where the difference metric uses the following expression: Among them, A j (t) is the actual behavior value of the user in the jth dimension at time point t, B j (t) is the baseline behavior value corresponding to time point t, σ j is the standard deviation of the behavior in the jth dimension. The behavioral deviation in multiple dimensions is quantified by calculating the Euclidean distance. If Δ(t) exceeds the dynamically adjusted threshold θ(t), it is judged as abnormal behavior.

7. The method according to claim 6, characterized in that The threshold θ(t) is calculated according to the following formula: Among them, μΔ(t) is the time average of the user's historical deviation value, σΔ(t) is the time standard deviation of the user's historical deviation value, φ is the adjustment coefficient, and H k (t) is the weight of the kth influencing factor at time point t, ρ k As the corresponding adjustment coefficient, the threshold dynamic adjustment mechanism can flexibly respond to potential attacks according to changes in situational factors.

8. The method according to claim 7, characterized in that In step (5), when abnormal behavior is detected, the system adjusts the security policy according to the user's current situational state, which is specifically determined by the following function: Among them, S(t) is the security policy adjusted at time point t, κ is the adjustment coefficient, ∈(t) is the noise term, η is the correction factor, and E(t) is the user's emotional state value; the system adjusts the strictness of security measures according to the severity of behavioral deviations and the user's emotional state, including adding multi-factor authentication, real-time encryption of sensitive data, performing high-priority security scans, and restricting specific operation permissions.

9. The method according to claim 1, characterized in that: The log record of step (6) includes a detailed description of the abnormal behavior, the specific situation during detection, the security strategy adopted, and the effectiveness evaluation and feedback of the strategy.

10. The method according to claim 4 or 5, characterized in that: Also includes: (7) System self-learning and optimization: The system continuously updates and optimizes the user's behavior baseline model through long-term monitoring and recording, and gradually adjusts the weight coefficient α through machine learning algorithms. i , β(s) and the adjustment coefficient γ are used to improve the accuracy of detection and the adaptability of the response strategy.

Images