A situational awareness based social engineering attack detection method

Abstract

The application provides a kind of social engineering attack detection method based on context awareness, to solve the problem that existing technology cannot effectively deal with dynamic changes of social engineering attack. The method continuously monitors the user's emotional state, decision-making mode and daily behavior pattern by building a context-aware system, and combines with the personalized behavior baseline model to analyze and monitor the user's behavior in real time. The system uses composite function and multi-dimensional feature fusion technology to measure the deviation of user behavior and baseline model, and when abnormal behavior is detected, the system automatically triggers security policy adjustment, such as starting multi-factor authentication or limiting high-risk operations. Experimental results show that the application can effectively identify social engineering attacks in complex and variable attack scenarios, significantly improving the accuracy and response speed of detection. The method can be widely applied in the field of network security, especially suitable for environments that require highly customized security protection.

Description

Technical Field

[0001] This invention relates to the field of network security, specifically a context-aware social engineering attack detection method. Background Technology

[0002] Currently, with the rapid development of information technology, social engineering attacks are becoming increasingly complex and covert. Traditional security protection methods mainly rely on the detection and defense of known attack patterns. These methods have significant limitations when facing constantly evolving and escalating social engineering attacks. Especially in complex network environments, attackers can cleverly exploit users' psychological weaknesses and behavioral habits to carry out attacks, making traditional detection methods difficult to effectively identify and prevent.

[0003] Existing cybersecurity systems often lack comprehensive analysis of user context when dealing with social engineering attacks, resulting in an inability to accurately perceive user vulnerabilities in specific situations. This deficiency allows attackers to successfully launch attacks when users are emotionally unstable, have impaired decision-making abilities, or experience changes in behavior, leading to serious security risks. Furthermore, the lack of real-time monitoring and dynamic analysis of user behavior patterns in existing systems results in insufficient accuracy in detecting abnormal behavior, hindering timely responses to potential threats.

[0004] While some security systems have introduced advanced protection measures such as multi-factor authentication, these measures typically only address user identity verification and fail to consider the contextual factors behind user behavior. This often leaves the system in a reactive position when dealing with complex social engineering attacks, unable to provide flexible adjustments to security strategies and effectively prevent attack risks. Summary of the Invention

[0005] This invention is a context-aware social engineering attack detection method that solves the problem of inaccurate social engineering attack identification caused by the inability of traditional detection methods to comprehensively consider user context factors and changes in behavioral patterns.

[0006] A context-aware social engineering attack detection method according to the present invention includes the following steps:

[0007] (1) Contextual data collection: Collecting users’ emotional state data, decision-making pattern data and daily behavior pattern data;

[0008] (2) Data preprocessing: The collected context data is denoised, normalized and standardized to ensure the consistency of context data in different times, devices and environments;

[0009] (3) User Behavior Baseline Construction: Based on preprocessed contextual data and users' historical behavior data, a baseline of normal user behavior patterns is constructed. A nonlinear time-series model is used to model this baseline to obtain a baseline model.

[0010] (4) Abnormal behavior detection: In real-time monitoring, abnormal behavior is identified by comparing the difference between the user's current behavior and the baseline behavior.

[0011] (5) Situational Response and Strategy Adjustment: When abnormal behavior is detected, the system adjusts its response based on the user's current situation.

[0012] Pre-context state adjustment security policies;

[0013] (6) Data storage and logging: Record each anomaly detection result and the adjusted security policy in the log, and store the log in the database for subsequent analysis.

[0014] Furthermore, the emotional state data includes stress level and fatigue level; the decision-making pattern data includes click frequency, page dwell time, and mouse trajectory; the daily behavior pattern data includes frequently used software and file access records; the emotional state data is collected through a skin conductance sensor, heart rate monitor, and eye-tracking device, and the decision-making pattern data is acquired in real time through a user operation habit monitoring module.

[0015] Furthermore, in step (2), the collected contextual data is denoised, normalized, and standardized. Specifically, this includes filtering out high-frequency noise through wavelet transform, completing missing data through interpolation algorithms, and using standardization methods to make data of different dimensions comparable.

[0016] Furthermore, the baseline model expression in step (3) is as follows:

[0017]

[0018] Where B(t) represents the user's baseline behavior value at time point t, and X i (t) represents the value of the i-th dimension of the contextual data at time point t, α i The weight coefficient τ for each dimension i λ represents the time lag of the relevant behavior. i β(s) and δ(s) are the historical behavior functions at time point s, and γ is the adjustment coefficient. The model can take into account the time dependence and decay characteristics of user behavior, making the baseline model more accurate and dynamic.

[0019] Furthermore, the baseline model expression in step (3) is as follows, used to account for nonlinearity and higher-order time correlation:

[0020]

[0021] Where B(t) represents the user's baseline behavior value at time t, and X i (t) represents the value of the i-th dimension of the contextual data at time point t, α i The weight coefficient τ for each dimension i λ represents the time lag of the relevant behavior. i ω is the decay factor, β(s) and δ(s) are the historical behavior functions at time point s, and γ is the adjustment coefficient; i φ i θ i and δ i These are advanced parameters, and ζ(s) is the time decay function, enabling the model to capture more complex behavioral patterns and temporal characteristics.

[0022] Furthermore, in step (4), when identifying anomalous behavior by comparing the difference between the user's current behavior and baseline behavior, the difference measure uses the following expression:

[0023]

[0024] Among them, A j (t) represents the user's actual behavior value in the j-th dimension at time point t, B j (t) represents the baseline behavior value at the corresponding time point t, σ j Let be the standard deviation of behavior in the j-th dimension. The behavioral bias in multiple dimensions is quantified by calculating the Euclidean distance. If Δ(t) exceeds the dynamically adjusted threshold θ(t), it is judged as abnormal behavior.

[0025] Furthermore, the threshold θ(t) is calculated according to the following formula:

[0026]

[0027] Where, μ Δ (t) represents the time average of the user's historical deviation values, σ Δ (t) represents the time standard deviation of the user's historical deviation values, φ is the adjustment coefficient, and H k (t) represents the weight of the k-th influencing factor at time point t, ρ k The corresponding adjustment coefficient allows the threshold to be dynamically adjusted to flexibly respond to potential attacks based on changes in contextual factors.

[0028] Furthermore, in step (5), when abnormal behavior is detected, the system adjusts the security policy according to the user's current context state, specifically determined by the following function:

[0029]

[0030] Where S(t) is the security policy adjusted at time point t, κ is the adjustment coefficient, ∈(t) is the noise term, η is the correction factor, and E(t) is the user's emotional state value; the system adjusts the strictness of security measures according to the severity of behavioral deviations and the user's emotional state, including adding multi-factor authentication, real-time encryption of sensitive data, performing high-priority security scans, and restricting specific operation permissions.

[0031] Furthermore, the log entries in step (6) include a detailed description of the abnormal behavior, the specific context of the detection, the security strategy adopted, and the effectiveness evaluation and feedback of the strategy.

[0032] Furthermore, it also includes:

[0033] (7) System self-learning and optimization: The system continuously updates and optimizes the user's behavior baseline model through long-term monitoring and recording, and gradually adjusts the weight coefficient α through machine learning algorithms. i β(s) and adjustment coefficient γ are used to improve the accuracy of detection and the adaptability of response strategies.

[0034] Furthermore, the data storage and log recording in step (6) adopts a blockchain-based immutable data storage mechanism to ensure the security and integrity of abnormal behavior detection and response records.

[0035] Furthermore, the machine learning algorithm in step (7) uses recurrent neural networks (RNNs) or long short-term memory networks (LSTMs) to process time series data, improving the long-term predictive ability of user behavior patterns and the sensitivity to responses to abnormal behavior.

[0036] The present invention has the following advantages:

[0037] 1. Context-aware analysis: By monitoring users' emotional state, decision-making patterns, and behavioral patterns in real time, the system dynamically perceives the user context, thereby improving the accuracy of social engineering attack detection.

[0038] 2. Dynamic Behavioral Baseline: A dynamic behavioral baseline model is built based on users' historical behavior data, which can promptly identify abnormal behaviors that are significantly different from the baseline behavior, thereby enabling a rapid response to potential threats.

[0039] 3. Intelligent policy adjustment: Based on the user's current situation, the security policy is intelligently adjusted, which realizes the precision and flexibility of security protection and improves the system's resistance to attacks.

[0040] 4. Multi-dimensional data fusion: Employing multi-modal data processing algorithms, it integrates sentiment, decision-making, and behavioral data, improving the relevance and expressiveness of data analysis and enhancing the comprehensiveness of attack detection.

[0041] 5. Self-learning optimization: The system has a self-learning function, which continuously updates and optimizes the behavior baseline model and detection parameters to gradually improve the detection accuracy of abnormal behavior and the adaptability of the system. Attached Figure Description

[0042] Figure 1 This is a flowchart of the context-aware social engineering attack detection method of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] like Figure 1 As shown, this invention proposes a context-aware social engineering attack detection method. This method comprehensively monitors a user's emotional state, decision-making patterns, and daily behavior patterns to perceive the user's current context in real time, thereby identifying malicious program behavior triggered by social engineering techniques. Specifically, this invention collects and analyzes user behavior data in different contexts to construct a baseline model of the user's normal behavior, dynamically identifying abnormal behaviors that significantly differ from this baseline. This method not only detects potential attack behaviors in a timely manner but also intelligently adjusts security strategies based on the user's contextual state, providing more precise and flexible protection measures, effectively improving the system's security and anti-attack capabilities.

[0045] To verify the effectiveness of the context-aware social engineering attack detection method of the present invention, the following experiment was designed and conducted. The experiment involved 12 users, simulating operational behaviors in different contexts, and introduced various social engineering attack scenarios. These attacks were detected using the method of the present invention.

[0046] Experimental environment

[0047] Hardware configuration: Each user uses a high-performance terminal device equipped with a heart rate monitor, skin conductance sensor, eye tracking device, and user operation monitoring module. Data is transmitted to a centralized processing server via a local area network.

[0048] Software configuration: The system runs on the Windows 10 platform and is a context-aware system developed using TensorFlow and PyTorch. Data is stored in a MySQL database, and data stream processing is performed in real time using Apache Kafka.

[0049] Experiment duration: Each user participates in a 4-week behavioral data collection and attack detection experiment.

[0050] Experimental steps

[0051] 1. Data Acquisition and Preprocessing: During the experiment, the system continuously monitored users' emotional data (such as heart rate and skin conductance), decision-making pattern data (such as mouse movement trajectory and click frequency), and daily behavior pattern data (such as file access records and application usage frequency). The data was standardized and denoised before being stored in a MySQL database.

[0052] 2. Behavioral Baseline Model Construction: Based on the collected data, the system constructs a personalized behavioral baseline model for each user. The mathematical expression of the model is:

[0053]

[0054] Among them B u (t) represents the baseline value of user u's behavior at time t, α ui , λ ui δ ui The parameters are obtained through optimization using a genetic algorithm to improve the accuracy and stability of the model.

[0055] 3. Social Engineering Attack Scenario Design: Six social engineering attack scenarios were designed for the experiment, including phishing emails, fake login pages, malicious link clicks, social media spoofing, telephone scams, and fake software updates. These scenarios were randomly triggered when users performed routine operations, aiming to induce users to make incorrect judgments.

[0056] 4. Anomaly Detection and Security Policy Adjustment: The system continuously monitors the difference between the user's real-time behavior and their baseline behavior, and performs anomaly detection using the following formula:

[0057]

[0058] When Δ u (t) exceeds the threshold θ u When (t), the system automatically adjusts the security policy, such as triggering multi-factor authentication or forcibly exiting high-risk operations.

[0059] 5. Experimental Data Analysis: After the experiment, the user behavior data and detection results were analyzed, and the following experimental data were obtained, as shown in Table 1:

[0060] Table 1

[0061]

[0062] Based on the experimental results, the present invention has the following innovative features:

[0063] 1. Context-Aware System: Existing social engineering attack detection methods mainly rely on static rules or feature extraction based on historical data, making it difficult to cope with dynamically changing attack methods and user behaviors. For example, traditional anti-phishing systems detect attacks by matching known malicious URLs or content features; however, these methods are easily bypassed by spoofing or new attack techniques. The context-aware system proposed in this invention dynamically adjusts the detection model by continuously monitoring the user's emotional state (e.g., heart rate, skin conductance), decision-making patterns (e.g., mouse trajectory, click frequency), and daily behavior patterns (e.g., file access history, application usage frequency). This real-time context-based monitoring approach enables the system to identify when users are more vulnerable to social engineering attacks in specific situations, thereby improving the sensitivity and accuracy of detection.

[0064] 2. Personalized Behavioral Baseline Model: Traditional user behavior analysis mostly uses uniform models or predefined behavioral patterns, lacking personalized feature analysis for individual users. Therefore, it is prone to false positives or false negatives when faced with differences in user habits. Existing behavioral baseline construction methods are usually based on average statistical characteristics, ignoring individual differences and dynamic changes in user behavior. This invention constructs a personalized behavioral baseline model to adapt to the specific behavioral patterns of each user. This model utilizes complex mathematical expressions, combined with genetic algorithm optimization, to dynamically adjust model parameters, enabling it to accurately describe the user's actual behavioral patterns. Compared to existing uniform models, the personalized model of this invention can more effectively detect abnormal behaviors that deviate from normal user behavior, significantly reducing the false positive rate.

[0065] 3. Real-time Anomaly Detection and Security Policy Adjustment: Existing anomaly detection methods typically rely on offline analysis of historical data, lacking dynamic monitoring and immediate response capabilities for real-time behavior. For example, some existing technologies require manual intervention or triggering of security measures after detecting abnormal behavior, resulting in delayed responses. The anomaly detection system of this invention calculates the difference between user behavior and baseline behavior in real time, uses a composite function to measure the difference, and automatically triggers security policy adjustments when the difference exceeds a preset threshold. The system can respond immediately upon detecting potential threats, such as initiating multi-factor authentication or restricting high-risk operations, significantly improving defense effectiveness and response speed.

[0066] 4. Social Engineering Attack Scenario Design and Identification: Traditional social engineering attack detection techniques typically rely on known attack characteristics or predefined attack rules, resulting in poor detection performance against unknown or mutated attacks. Furthermore, existing attack scenario designs are often incomplete, failing to cover diverse attack forms. This invention simulates real-world attack environments by designing various social engineering attack scenarios, including phishing emails, fake login pages, malicious link clicks, social media spoofing, telephone fraud, and fake software updates. The system can automatically identify and differentiate attack behaviors in these scenarios and promptly detect and respond using context-aware technology. This diversity in scenario design and system flexibility significantly enhance the ability to identify unknown and mutated attacks.

[0067] 5. Data Analysis and Model Optimization: Existing data analysis methods typically employ linear models or simple machine learning algorithms, which struggle to handle complex behavioral patterns and multi-dimensional data interactions. Model optimization techniques are also often limited to simple parameter tuning, failing to effectively improve detection accuracy. This invention introduces a multi-level data analysis model in the data analysis phase, comprehensively analyzing the complex relationships between user behavior and contextual data through composite functions and multi-dimensional feature fusion. Furthermore, this invention uses a genetic algorithm for model optimization, combining real-time user feedback and historical data to continuously adjust and evolve model parameters, resulting in a significant improvement in detection accuracy and defense effectiveness.

[0068] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A context-aware social engineering attack detection method, characterized in that, Includes the following steps: (1) Contextual data collection: Collect users' emotional state data, decision-making pattern data, and daily behavior pattern data; (2) Data preprocessing: The collected context data is denoised, normalized and standardized to ensure the consistency of context data in different times, devices and environments; (3) User behavior baseline construction: Based on the preprocessed contextual data and the user's historical behavior data, a baseline of the user's normal behavior pattern is constructed. A nonlinear time series model is used to model the baseline of the normal behavior pattern to obtain the baseline model. The expression of the baseline model is as follows: ； in, This represents the user's baseline behavior value at time point t. Let be the value of the i-th dimension of the contextual data at time point t. The weight coefficients for each dimension, Due to the time lag of the relevant actions, As the attenuation factor, and The model is a historical behavior function at time point s, and γ is an adjustment coefficient. The model can take into account the time dependence and decay characteristics of user behavior, making the baseline model more accurate and dynamic. (4) Abnormal behavior detection: In real-time monitoring, abnormal behavior is identified by comparing the difference between the user's current behavior and the baseline behavior; (5) Situation response and strategy adjustment: When abnormal behavior is detected, the system adjusts its response based on the user's current situation. Pre-context state adjustment security policies; (6) Data storage and logging: Record each anomaly detection result and the adjusted security policy in the log, and store the log in the database for subsequent analysis.

2. The method according to claim 1, characterized in that, The emotional state data includes stress level and fatigue level; the decision-making pattern data includes click frequency, page dwell time, and mouse trajectory; the daily behavior pattern data includes frequently used software and file access records; the emotional state data is collected through a skin conductance sensor, heart rate monitor, and eye-tracking device, and the decision-making pattern data is acquired in real time through a user operation habit monitoring module.

3. The method according to claim 1, characterized in that, In step (2), the collected context data is denoised, normalized and standardized. Specifically, this includes: filtering out high-frequency noise through wavelet transform, completing missing data through interpolation algorithm, and using standardization method to make data of different dimensions comparable.

4. The method according to claim 1, characterized in that, The baseline model expression in step (3) is as follows, used to account for nonlinearity and higher-order time correlation: ； Among them, among them, This represents the user's baseline behavior value at time point t. Let be the value of the i-th dimension of the contextual data at time point t. The weight coefficients for each dimension, Due to the time lag of the relevant actions, As the attenuation factor, and Let γ be the historical behavior function at time point s, and let γ be the adjustment coefficient. , , and For advanced parameters, This is a time decay function, enabling the model to capture more complex behavioral patterns and temporal characteristics.

5. The method according to claim 4, characterized in that, When identifying anomalous behavior by comparing the user's current behavior with baseline behavior in step (4), the difference measure is expressed using the following expression: ； in, This represents the user's actual behavior value in the j-th dimension at time point t. This represents the baseline behavior value at the corresponding time point t. Let the standard deviation of behavior in the j-th dimension be quantified by calculating the Euclidean distance to represent behavioral bias across multiple dimensions. Exceeding the dynamically adjusted threshold If so, it is judged as abnormal behavior.

6. The method according to claim 5, characterized in that, threshold Calculate using the following formula: ； in, The time average of the user's historical deviation values. The time standard deviation of the user's historical deviation values. For adjustment coefficients, Let be the weight of the k-th influencing factor at time point t. The corresponding adjustment coefficient allows the threshold to be dynamically adjusted to flexibly respond to potential attacks based on changes in contextual factors.

7. The method according to claim 6, characterized in that, In step (5), when abnormal behavior is detected, the system adjusts the security policy according to the user's current context state, specifically determined by the following function: ； in, The security policy adjusted at time point t. To adjust the coefficient, For noise terms, As a correction factor, This represents the user's emotional state value. The system adjusts the strictness of security measures based on the severity of behavioral deviations and the user's emotional state, including adding multi-factor authentication, real-time encryption of sensitive data, performing high-priority security scans, and restricting specific operation permissions.

8. The method according to claim 1, characterized in that, The log entries in step (6) include a detailed description of the abnormal behavior, the specific context of the detection, the security strategy adopted, and the effectiveness evaluation and feedback of the strategy.

9. The method according to claim 4, characterized in that: Also includes: (7) System self-learning and optimization: The system continuously updates and optimizes the user's behavior baseline model through long-term monitoring and recording, and gradually adjusts the weight coefficients through machine learning algorithms. , And the adjustment coefficient γ, to improve the accuracy of detection and the adaptability of the response strategy.

Images