Social engineering attack risk assessment method based on state transition model
Through a state migration model-based method, the social engineering attack process is modeled and evaluated, which solves the problem of difficult to effectively evaluate the risk of social engineering attacks in the existing technology, and achieves more efficient and comprehensive risk prediction and defense.
Patent Information
- Application Number
- CN202411917925.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-24
- Publication Date
- 2025-04-15
AI Technical Summary
The difficulty in effectively assessing and identifying the risks of social engineering attacks, especially when considering the dynamics and complexity of human behavior, leads to a lack of systematicity and comprehensiveness of security assessments.
Using a state migration model method, a human state model is established by modeling the social engineering attack process, including dimensions such as information, authority, relationship, trust and mood, a mapping of the impact of attacker operations on victims' emotions is established, and a probability model detection method is used to quantitatively evaluate the risks of social engineering attacks.
It improves the ability to predict the risks of social engineering attacks, can evaluate human behavior in different states more dynamically and comprehensively, and enhances the defense ability of social engineering attacks.
Smart Images
Figure CN119831340A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security analysis of computer software engineering, and proposes a social engineering attack risk assessment method based on a state transition model. The method involves modeling technology for the process of social engineering attacks and the migration of attack states, and assesses the risk of social engineering by calculating the success probability of each attack step in the model. Background Art
[0002] Social engineering attacks are attacks that manipulate human psychology and behavior, taking advantage of an individual's trust and goodwill to obtain sensitive information. The danger of this type of attack is that its success rate is usually higher than that of technical attacks. Attackers often disguise themselves as trustworthy characters, such as colleagues or customers, to induce victims to disclose information.
[0003] This type of attack can not only lead to direct financial losses, but may also lead to reputational damage and legal liability. Due to the concealment of social engineering attacks, victims are often attacked without knowing it, making it difficult to hold them accountable afterwards. In addition, social engineering attacks are combined with network attacks to form a multi-level attack strategy, which further increases the difficulty of defense.
[0004] Therefore, it is particularly important to assess the risk of social engineering attacks. At present, security needs assessment for social engineering attacks mainly relies on subjective methods such as manual brainstorming. Although this method can provide some insights, it lacks systematicity and comprehensiveness, resulting in the failure to effectively identify and resolve potential risks in the security assessment process.
[0005] Existing assessment models and frameworks often ignore the dynamics of people when trying to introduce quantitative assessments. Human behavior is highly complex and changeable, and the states of attackers and victims are constantly adjusting as the environment, situation, and interaction change. For example, in certain situations, such as being interrupted, victims may show high vigilance, while in other situations, such as being approached by someone disguised as a new employee, they may relax their vigilance due to trust or curiosity. This change in state directly affects the success rate of social engineering attacks.
[0006] In order to reduce the harm of social engineering attacks and assess the risks of social engineering attacks, it is necessary to invent a more dynamic assessment method that can analyze people who change in different states, thereby improving the ability to predict the risks of social engineering attacks.
[0007] In response to this situation, the present invention proposes a social engineering attack risk assessment method based on a state transition model. By modeling the state transition process of a person, a person's state is established, which includes factors such as the person's mood, and a mapping of the impact of the attacker's operation on the victim's emotions is established. A probability model detection method is introduced to quantitatively assess the risk of social engineering attacks. Summary of the invention
[0008] Aiming at the method of social engineering attack risk assessment in the field of social engineering, in order to solve the above-mentioned problems existing in the prior art, the present invention provides a social engineering attack risk assessment method based on a state transition model, which is suitable for complex and multi-stage social engineering attack risk assessment.
[0009] The present invention comprises the following steps:
[0010] Step (1) Modeling the social engineering attack process:
[0011] Modeling the five sub-steps of social engineering attacks: target setting and information collection, establishing contacts and developing relationships, establishing trust, developing trust, and taking action. Each step includes several atomic operations. In this step, the process of the social engineering attack to be evaluated needs to be modeled according to these five steps and the atomic operations therein.
[0012] Step (2) forms a state transition model:
[0013] Based on the social engineering attack process model in step (1), the human state is modeled based on attributes, six states are generated, and the probability of transition between states is calculated. This step can be decomposed into the following three sub-steps.
[0014] Step (2.1) models the initial state of the person:
[0015] The initial state of people in the process of social engineering attacks is modeled based on 12 attributes from five important dimensions: information, authority, relationship, trust, and mood.
[0016] Step (2.2) build status:
[0017] According to the social engineering attack process model in step 1 and the initial state of the task in step 2.1, construct the character state in a complete social engineering attack process (a new state will be generated after each sub-step attack operation).
[0018] Step (2.3) calculates the probability of state transition:
[0019] Based on the attack sub-steps in the social engineering attack process model in step 1, the state transition function is derived, and then combined with the character's personality characteristics and security awareness, a probability assignment function is formed to calculate the state transition probability.
[0020] Step (3) Assess the risk of social engineering attacks:
[0021] The state generated in step 2.1 and the state transition probability calculated in step 2.2 are input into the probability model detection tool PRISM in the form of a discrete-time Markov chain to automatically calculate the probability of success of the entire attack process, that is, the probability of risk occurrence. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Figure 1 It is a social engineering attack risk assessment flow chart of the present invention.
[0023] Figure 2 It is a general social engineering attack model diagram of the present invention.
[0024] Figure 3 It is a schematic diagram of the impact of the attacker's operation on the victim's emotions of the present invention.
[0025] Figure 4 It is a correspondence diagram between the social engineering technology of the present invention and the personality characteristics of people. DETAILED DESCRIPTION
[0026] A brief overview of the present invention is provided below in order to provide a basic understanding of certain aspects of the present invention. It should be understood that this overview is not an exhaustive overview of the present invention. It is not intended to identify key or important parts of the present invention, nor is it intended to limit the scope of the present invention. Its purpose is merely to present certain concepts in a simplified form as a prelude to a more detailed description discussed later.
[0027] The flowchart of the social engineering attack risk assessment method based on the state transition model proposed by the present invention is as follows: Figure 1 As shown, it can be seen that the method of the present invention can be divided into three main steps: step (1) modeling the social engineering attack process, step (2) forming a state transition model, and step (3) evaluating the social engineering attack risk.
[0028] Step (1) Modeling the social engineering attack process:
[0029] Social engineering attack is a complex process, which includes multiple progressive attack steps, each of which contains several atomic social engineering attack methods. In this step, the patented method decomposes the social engineering attack case into five sub-processes and models them.
[0030] Step (1.1) Modeling goal setting and information collection process:
[0031] The attacker determines the assets and people to be attacked, and collects information based on these targets. The modeling results of this step include three possible atomic operations: network search, social investigation, and information obtained from the previous attack (applicable to multi-stage attacks).
[0032] Step (1.2) models the process of establishing connections and developing relationships:
[0033] The attacker will make full use of the collected information to establish contact with the victim through different media and pretend to be a role related to the victim. The modeling results of this step include three common communication methods: sending emails, making phone calls, and face-to-face communication, as well as four possible relationships: colleagues, superiors, external partners, and authorities.
[0034] Step (1.3) models the trust building process:
[0035] The attacker uses role relationships to fabricate false situations to deceive the victim in order to gain initial trust. The modeling results of this step include six atomic operations: using role authority, taking advantage of responsibility, taking advantage of authority or superior-subordinate relationships, providing help, providing rewards, and distracting attention.
[0036] Step (1.4) Model the process of developing trust:
[0037] The attacker continues to deceive the victim, interact with the target, develop trust in the process, and bring the victim into the desired emotional state. The atomic attack operations that may be included in the modeling results of this step are urgency, expectation, conviction, punishment, curiosity, fear, reward, request for help, time saving, and sympathy.
[0038] Step (1.5) models the process of taking action:
[0039] The attacker will take advantage of the victim's emotional state and the trust they have established to make a request or take direct action to the victim, depending on the goal of the attack. After this step, the attacker's malicious goal has been achieved and the attack is over. The modeling result of this step is making a request or taking an action.
[0040] The results of modeling the above five social engineering attack steps are as follows: Figure 2 shown.
[0041] Step (2) forms a state transition model:
[0042] After modeling the five social engineering attack processes in step (1), the patented method forms a state transition model based on this.
[0043] The state transition model has two important elements, one is the state, and the other is the probability of transition. Based on the social engineering attack model obtained in step 1, the patented method further models people and establishes a connection between the human state model and the atomic operations in the social engineering attack process model to form a state transition model. This step can be decomposed into the following three sub-steps:
[0044] Step (2.1) models the initial state of the person:
[0045] This patented method models the initial state of a person during a social engineering attack based on 12 attributes in five important dimensions: information, authority, relationship, trust, and mood. The specific attributes are shown in the following table.
[0046] Table 1 Attributes in the state
[0047]
[0048] Among them: The information dimension is mainly added to the attacker's state, including the attacker's collection status of target asset information and the collection status of target person information. The value of 0-3 is used to represent the degree of information collection. The higher the value, the more complete the information collected. The authority dimension includes authority and ownership. Authority needs to be considered in both the attacker and victim states. The three states of authority are: authorized, unauthorized, and uncertain authority, represented by the letters Y, N, and U. Ownership mainly models the victim. The two states of ownership are: owned and unowned, represented by the letters Y and N. The relationship dimension mainly represents what role the attacker plays for the victim. S, C, E, and A are used to represent the relationship between the attacker and the victim, namely, superiors and subordinates, colleagues, external cooperation, and supervision. N is used to indicate that no relationship has been established. The trust dimension mainly represents the degree of trust established between the attacker and the victim. The value of 0-3 is used to represent the degree of trust. The larger the value, the greater the trust value, and the higher the probability of successful attack. The emotional dimension is reflected in the victim's state. This patent modeling adds six emotional states to this dimension and uses values 0-6 to represent the fullness of the emotion. The higher the value, the fuller the emotion.
[0049] Step (2.2) build status:
[0050] Each attack operation in the social engineering attack process model will have an impact on the attributes in the human state. As shown in the example given in Table 2, the atomic operation of the attack will cause two attributes under the information dimension in the state to change. Figure 3 The schematic diagram of the impact of the attacker's operation on the victim's emotions shows that the atomic operation of the attack will cause changes in the six attributes under the emotional dimension of the state.
[0051] Table 2 Examples of the impact of attack operations on attributes in the state
[0052]
[0053] A new state can be generated after each attack operation. In this step of the patent, each state from the initial to the final state needs to be constructed. As shown in the example of the disguise attack process given in Table 3, S0 is the initial state, AS represents the attacker state, and VS represents the victim state. After the five sub-steps of social engineering attack given in step 1, the S0 state changes to the S1-S4 state, and finally migrates to S5 success or S6 failure.
[0054] Table 3 Status of the masquerade attack process
[0055]
[0056]
[0057] Step (2.3) calculates the probability of state transition:
[0058] Determine the relationship between social engineering attack techniques and people's personality characteristics, comprehensively consider people's security awareness, form a probability assignment function, and then derive a state transition function. Use the state transition function to calculate the probability of state transition and form a state transition model. As shown in Table 4 below, there are three variables involved in the probability assignment function. The first is the transition function δ, which is determined by the state S in step 2.2 and the atomic operation O in step 1; the second is the personality characteristic p. The corresponding relationship between the personality characteristics p that can be used by different attack techniques is as follows: Figure 4 As shown; the third one is the safety awareness registration, which is divided into three levels: low, medium and high.
[0059] Table 4 State transition function
[0060]
[0061] The probability of state transition is calculated based on the above function.
[0062] Step (3) Assess the risk of social engineering attacks:
[0063] The state generated in step 2.1 and the state transition probability calculated in step 2.2 are input into the probability model detection tool PRISM in the form of a discrete-time Markov chain to automatically calculate the probability of success of the entire attack process, that is, the probability of risk occurrence.
[0064] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A social engineering attack risk assessment method based on a state transition model, characterized in that: The following steps are involved: Step (1) Modeling the social engineering attack process: Modeling the five sub-steps of social engineering attacks: target setting and information collection, establishing contacts and developing relationships, establishing trust, developing trust, and taking action; each step includes several atomic operations; in this step, the process of the social engineering attack to be evaluated is modeled according to these five steps and the atomic operations therein; Step (2) forms a state transition model: Based on the social engineering attack process model in step (1), the human state is modeled based on attributes, six states are generated, and the probability of transition between states is calculated; It is broken down into the following three sub-steps: Step (2.1) models the initial state of the person: Model the initial state of people in the social engineering attack process from 12 attributes in five important dimensions: information, authority, relationship, trust, and mood; Step (2.2) build status: Based on the social engineering attack process model in step 1 and the initial state of the task in step 2.1, construct the character state in a complete social engineering attack process. A new state will be generated after each sub-step attack operation; Step (2.3) calculates the probability of state transition: Based on the attack sub-steps in the social engineering attack process model in step 1, the state transition function is obtained, and then combined with the character's personality characteristics and security awareness, a probability assignment function is formed to calculate the state transition probability; Step (3) Assess the risk of social engineering attacks: The state generated in step 2.1 and the state transition probability calculated in step 2.2 are input into the probability model detection tool PRISM in the form of a discrete-time Markov chain to automatically calculate the probability of success of the entire attack process, that is, the probability of risk occurrence.
2. The social engineering attack risk assessment method based on the state transition model according to claim 1 is characterized in that: Step 1 includes, Step (1.1) Modeling goal setting and information collection process: The attacker determines the assets and people to be attacked, and collects information based on these targets. The modeling results include three possible atomic operations: network search, social investigation, and information obtained from the previous attack. Step (1.2) models the process of establishing connections and developing relationships: The attacker will make full use of the collected information to establish contact with the victim through different media and pretend to be a character related to the victim. The modeling results include three communication methods: sending emails, making phone calls, and face-to-face communication, as well as four possible relationships: colleagues, superiors, external partners, and authorities. Step (1.3) models the trust building process: The attacker uses role relationships to fabricate false situations to deceive the victim in order to gain initial trust. The modeling results of this step include six atomic operations: using role authority, taking advantage of responsibility, taking advantage of authority or superior-subordinate relationships, providing help, providing rewards, and distracting attention. Step (1.4) Model the process of developing trust: The attacker continues to deceive the victim, interact with the target, develop trust in the process, and bring the victim into the desired emotional state; the atomic attack operations that may be included in the modeling results include urgency, expectation, conviction, punishment, curiosity, fear, reward, request for help, time saving, and sympathy; Step (1.5) models the process of taking action: The attacker will take advantage of the victim's emotional state and the trust established to make requests to the victim or take direct actions based on the attack goal; after this step, the attacker's malicious goal has been achieved and the attack is over; the modeling result of this step is making a request or taking action.
3. The social engineering attack risk assessment method based on the state transition model according to claim 1 is characterized in that: After modeling the five social engineering attack steps step by step, step (2) forms a state transition model: After modeling the five social engineering attack processes in step (1), a state transition model is formed based on this; The state transition model has two important elements: one is the state, and the other is the probability of transition. Based on the social engineering attack model obtained in step 1, the human is further modeled, and the human state model is linked to the atomic operations in the social engineering attack process model to form a state transition model. It is decomposed into the following three sub-steps: Step (2.1) models the initial state of the person: The initial state of people in the social engineering attack process is modeled from 12 attributes in five important dimensions: information, authority, relationship, trust, and mood. The specific attributes are shown in the following table; Table 1 Attributes in the state Among them: the information dimension is added to the attacker's state, including the attacker's collection status of target asset information and the collection status of target person information; the value 0-3 is used to represent the degree of information collection, the higher the value, the more complete the information collected; the authority dimension includes authority and ownership; authority needs to be considered in both the attacker and victim states, and the three states of authority are: authorized, unauthorized and uncertain authority, represented by the letters Y, N, and U; ownership models the victim, and the two states of ownership are: owned and unowned, represented by the letters Y and N; S, C, E, and A are used to represent the relationship between the attacker and the victim as superiors and subordinates, colleagues, external cooperation, and supervision respectively; N is used to indicate that no relationship has been established; the trust dimension represents the degree of trust between the attacker and the victim; the value of 0-3 is used to represent the degree of trust, the larger the value, the greater the trust value, and the higher the probability of successful attack; the emotional dimension is reflected in the victim's state; six emotional states are added, and the values 0-6 are used to represent the fullness of emotions, the higher the value, the fuller the emotions; Step (2.2) build status: Each attack operation in the social engineering attack process model will have an impact on the attributes in the human state. As shown in the example given in Table 2, the atomic operation of the attack will cause two attributes under the information dimension of the state to change; the atomic operation of the attack will cause six attributes under the emotion dimension of the state to change; Table 2 Examples of the impact of attack operations on attributes in the state After each attack operation, a new state can be generated. In this step of the present invention, each state from the initial state to the final state needs to be constructed. As shown in the example of the camouflage attack process given in Table 3, S0 is the initial state, AS represents the attacker state, and VS represents the victim state. After the five sub-steps given in step 1, After a social engineering attack, the S0 state changes to S1-S4, and finally migrates to S5 success or S6 failure; Table 3 Status of the masquerade attack process Step (2.3) calculates the probability of state transition: Determine the relationship between social engineering attack techniques and people's personality characteristics, comprehensively consider people's security awareness, form a probability assignment function, and then derive a state transition function; use the state transition function to calculate the probability of state transition and form a state transition model; as shown in Table 4, there are three variables involved in the probability assignment function. The first is the transition function δ, which is jointly determined by the state S in step 2.2 and the atomic operation O in step 1; the second is the personality characteristic p, and the corresponding relationship between the personality characteristics p that can be used by different attack techniques; the third is the security awareness registration, which is divided into three levels: low, medium, and high; Table 4 State transition function The probability of state transition is calculated based on the above function.