Zaporozhchenko M.M. Methods of predicting social engineering attacks on corporate information systems based on the userʼs security profile. – Qualifying scientific work on manuscript rights.
Dissertation for obtaining the scientific degree of Doctor of Philosophy in specialty 125 “Cybersecurity”. – State University of Information and Communication Technologies, MES of Ukraine, Kyiv, 2024.
Social engineering attacks remain one of the critical threats to organizations due to the exploitation of the human factor as a key vulnerability. An analysis of current approaches to detecting and predicting social engineering attacks has revealed their fragmentation, as most models focus only on certain aspects of protection (technical, organizational) or user indicators (demographic, psychological, behavioral), without taking into account the interconnections and influence of external conditions. This limitation can lead to unreliable forecasts and insufficient effectiveness in countering attacks. In addition, modern methods often require significant resources and large amounts of data, which makes it difficult to implement them in organizations with limited capabilities.
Thus, there is an urgent need to solve an ongoing scientific task, the purpose of which is to develop an integrative method for predicting social engineering attacks on corporate information systems based on a comprehensive model of the user’s security profile.
The purpose of the study is to increase the level of security of corporate information systems against social engineering attacks based on vulnerability prediction by creating a user security profile.
In the process of achieving this purpose and solving the scientific task, the main scientific results were obtained:
for the first time, a comprehensive user security profile model has been developed as a basis for an integrative method for predicting social engineering attacks on corporate information systems, based on the multiplicative convolution of the results of the study of psychological, organizational, technical factors and the factor of information influence in the context of a particular user, which makes it possible to determine the potential vulnerability of users of the organization to social engineering attacks;
the method for assessing the components of the user’s security profile has been improved, which differs from the basic approach based on the hierarchy analysis method by using a dynamically changing set of indicators, which provides a comprehensive and adaptive assessment of the impact of security profile factors on the level of user vulnerability, taking into account changes in their individual characteristics and the specifics of the organizational environment;
the method for identifying the most likely trajectories of social engineering attacks has been improved, which differs from the known approaches by using a graph model of interaction between users of a corporate information system, taking into account the types and intensity of their communication links, which makes it possible to identify the most vulnerable users and determine the critical trajectories of multi-stage social engineering attacks to assess the risks of compromising a corporate information system.
The practical significance of the results obtained is that the developed method for predicting social engineering attacks on corporate information systems makes it possible to assess the probability of user compromise, identify the most vulnerable categories and implement targeted countermeasures, which increases the level of corporate information systems security. Based on the method, criteria for assessing the psychological, organizational, technical, and information influence factors are proposed, which can be used by cybersecurity specialists to develop adaptive strategies to counter social engineering threats. As a result of the implementation of the recommended countermeasures, the level of protection against one-stage social engineering attacks has improved in the range from 10.3% to 42.8% for different categories of users, and the overall reduction in the likelihood of compromise due to multi-stage attacks is an average of 21% (from 19% to 24.3%).
Keywords: social engineering attack, information system, attack prediction, user vulnerability assessment, graph model, information influence, mathematical model, threat actor, multi-stage attack, attack trajectory, cybersecurity, cyberspace, decision making, social networks.
