Social Engineering in Cybersecurity: a Domain Ontology and Knowledge Graph Application Examples
Total Page:16
File Type:pdf, Size:1020Kb
Wang et al. This paper was accepted by Cybersecurity (ISSN: 2523-3246) on 2021-4-28. doi:10.1186/s42400-021-00094-6 RESEARCH Social Engineering in Cybersecurity: A Domain Ontology and Knowledge Graph Application Examples Zuoguang Wang1,2*, Hongsong Zhu1,2*,PeipeiLiu1,2 and Limin Sun1,2 Abstract Social engineering has posed a serious threat to cyberspace security. To protect against social engineering attacks, a fundamental work is to know what constitutes social engineering. This paper first develops a domain ontology of social engineering in cybersecurity and conducts ontology evaluation by its knowledge graph application. The domain ontology defines 11 concepts of core entities that significantly constitute or a↵ect social engineering domain, together with 22 kinds of relations describing how these entities related to each other. It provides a formal and explicit knowledge schema to understand, analyze, reuse and share domain knowledge of social engineering. Furthermore, this paper builds a knowledge graph based on 15 social engineering attack incidents and scenarios. 7 knowledge graph application examples (in 6 analysis patterns) demonstrate that the ontology together with knowledge graph is useful to 1) understand and analyze social engineering attack scenario and incident, 2) find the top ranked social engineering threat elements (e.g. the most exploited human vulnerabilities and most used attack mediums), 3) find potential social engineering threats to victims, 4) find potential targets for social engineering attackers, 5) find potential attack paths from specific attacker to specific target, and 6) analyze the same origin attacks. Keywords: Social engineering attack; Cyber security; Ontology; Knowledge graph; Attack scenarios; Threat analysis; Attack path; Attack model; Taxonomy; Composition and structure 1 Introduction brute-force and software vulnerabilities exploit, social In the context of cybersecurity, social engineering de- engineering exploits human vulnerabilities to bypass scribes a type of attack in which the attacker exploit or break through security barriers, without having to human vulnerabilities (by means such as influence, combat with firewall or antivirus software by deep cod- persuasion, deception, manipulation and inducing) to ing. 2) For some attack scenarios, social engineering breach the security goals (such as confidentiality, in- can be as simple as making a phone call and imper- tegrity, availability, controllability and auditability) of sonating an insider to elicit the classified information. cyberspace elements (such as infrastructure, data, re- 3) Especially in past decades when defense mainly fo- source, user and operation). Succinctly, social engi- cus on the digital domain yet overlooks human factors neering is a type of attack wherein the attacker ex- in security. As the development of security technology, ploit human vulnerability through social interaction classical attacks become harder and more and more to breach cyberspace security [1]. Many distinctive attackers turn to social engineering. 4) Human vulner- features make social engineering to be a quite pop- abilities seem inevitable, after all, there is not a cyber ular attack in hacker community and a serious, uni- system doesn’t rely on humans or involve human fac- versal and persistent threat to cyber security. 1) Com- tors on earth and these human factors are vulnerable pared to classical attacks such as password cracking by obviously or can be largely turned into security vulner- abilities by skilled attackers. Moreover, social engineer- *Correspondence: [email protected]; [email protected] ing threat is increasingly serious along with its evolu- 1School of Cyber Security, University of Chinese Academy of Sciences, tion in new technical and cyber environment. Social Beijing, CN engineering gets not only large amounts of sensitive in- 2Beijing Key Laboratory of IoT Information Security Technology, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, CN formation about people, network and devices but also Full list of author information is available at the end of the article more attack channels with the wide applications of So- This article has been accepted for publication in a future issue of Cybersecurity (ISSN: 2523-3246), but has not been fully edited. Content may change prior to final publication. Citation information, DOI: 10.1186/s42400-021-00094-6 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/. Wang et al. This paper was accepted by Cybersecurity (ISSN: 2523-3246) on 28 April. doi:10.1186/s42400-021-00094-6 Page 2 of 20 cial Networking Sites (SNSs), Internet of Things (IoT), knowledge graph. Section 6 is the discussion. Section 7 Industrial Internet, mobile communication and wear- concludes the paper. able devices. And large part of above information is open source, which simplifies the information gather- 2 Methodology to develop domain ing for social engineering. Social engineering becomes ontology more efficient and automated by technology such as There is no single correct way or methodology for de- machine learning and artificial intelligence. As a result, veloping ontologies [2]. Since ontology design is a cre- a large group of targets can be reached and specific vic- ative process and many factors will a↵ect the design tims can be carefully selected to craft more creditable choices, such as the potential applications of the on- attack. The spread of social engineering tools decrease tology, the designer’s understanding and view of the the threat threshold. Loose office policy (bring your domain, di↵erent domain features, anticipations of the own device, remote office, etc.) leads to the weakening ontology to be more intuitive, general, detailed, exten- of area-isolation of di↵erent security levels and cre- sible and / or maintainable. ates more attack opportunities. Targeted, large-scale, In this paper, we design the methodology to develop robotic, automated and advanced social engineering domain ontology of social engineering based on the attack is becoming possible [1]. method reported in work [2] with some modification. To protect against social engineering, the fundamen- Prot´eg´e5.5.0 [3] is used to edit and implement the tal work is to know what social engineering is, what en- ontology. It should be noted that ”entity” in real word tities significantly constitute or a↵ect social engineer- are described as ”concept” in ontology and ”class” in ing and how these entities relate to each other. Study Prot´eg´e; ”relation” is described as ”object property” [1] proposed a definition of social engineering in cyber- in Prot´eg´e. The methodology is described as Figure 1. security based on systematically conceptual evolution analysis. Yet only the definition is not enough to get Determine the Consider reusing insight into all the issue above, and further, to server as domain, purpose existing ontologies a tool for analyzing social engineering attack scenarios and scope or incidents and providing a formal, explicit, reusable knowledge schema of social engineering domain. Enumerate important Ontology is a term comes from philosophy to de- terms in the ontology scribe the existence of beings in the world and adopted in informatics, semantic web, knowledge engineering and Artificial Intelligence (AI) fields, in which an on- Define core concepts, Define relations, concept taxonomy relation description tology is a formal, explicit description of knowledge as and description and characteristic a set of concepts within a domain and the relation- ships among them (i.e. what entities exist in a domain revise and how they related). It defines a common vocab- Define other Result: ontology Validate descriptions e.g. rules, ulary for researchers who need to share information annotations, axioms and includes definitions of basic concepts in the do- main and their relations [2]. In an ontology, semantic Figure 1 Overview of methodology to develop domain ontology information and components such as concept, object, of social engineering relation, attribute, constraints and axiom are encoded or formally specified, by which an ontology is machine- (1) Determine the domain, purpose and scope. readable and has capacity for reasoning. In this way, As described before, the domain of the ontology is ontology not only introduce a formal, explicit, share- social engineering in cybersecurity. The purpose of the able and reusable knowledge representation but also ontology, i) for design is to present what entities signif- can add new knowledge about the domain. icantly constitute or a↵ect social engineering and how Thus, we propose a domain ontology of social engi- these entities relate to each other, ii) and for appli- neering to understand, analyze, reuse and share do- cation is to server as a tool for understanding social main knowledge of social engineering. engineering, analyzing social engineering attack sce- Organization: Section 2 describes the the back- narios or incidents and providing a formal, explicit, ground material and methodology to develop domain reusable knowledge schema of social engineering do- ontology. Section 3 presents the material and ontology main. Thus, social engineering itself as a type of attack, implementation. Section 4 is the result: domain ontol- measures regarding social engineering defense will not ogy of social engineering in cybersecurity. Section 5 be included here although they are important.