Social engineering (SE) aims at deceiving users into performing actions that may compromise their security and privacy. These threats exploit weaknesses in human's decision making processes by using tactics such as pretext, baiting, impersonation, etc. On the web, SE attacks include attack classes such as scareware, tech support scams, survey scams, sweepstakes, etc., which can result in sensitive data leaks, malware infections, and monetary loss. For instance, US consumers lose billions of dollars annually due to various SE attacks. Unfortunately, generic social engineering attacks remain understudied, compared to other important threats, such as software vulnerabilities and exploitation, network intrusions, malicious software, and phishing. The few existing technical studies that focus on social engineering are limited in scope and mostly focus on measurements rather than developing a generic defense. To fill this gap, we present SEShield, a framework for in-browser detection of social engineering attacks. SEShield consists of three main components: (i) a custom security crawler, called SECrawler, that is dedicated to scouting the web to collect examples of in-the-wild SE attacks; (ii) SENet, a deep learning-based image classifier trained on data collected by SECrawler that aims to detect the often glaring visual traits of SE attack pages; and (iii) SEGuard, a proof-of-concept extension that embeds SENet into the web browser and enables real-time SE attack detection. We perform an extensive evaluation of our system and show that SENet is able to detect new instances of SE attacks with a detection rate of up to 99.6% at 1% false positive, thus providing an effective first defense against SE attacks on the web.

翻译：社会工程旨在诱骗用户执行可能危害其安全与隐私的操作。此类威胁通过利用人类决策过程中的弱点，采用借口、诱饵、冒充等策略实施。在网络环境中，社会工程攻击包括恐吓软件、技术支持诈骗、调查问卷诈骗、抽奖诈骗等攻击类型，可能导致敏感数据泄露、恶意软件感染及财产损失。例如，美国消费者每年因各类社会工程攻击损失数十亿美元。遗憾的是，相较于软件漏洞利用、网络入侵、恶意软件、网络钓鱼等其他重大威胁，通用型社会工程攻击仍缺乏充分研究。现有少数聚焦社会工程的技术研究范围有限，且大多侧重于测量分析而非开发通用防御方案。为填补这一空白，我们提出SEShield——一种浏览器内嵌的社会工程攻击检测框架。SEShield包含三个核心组件：(i) 专用安全爬虫SECrawler，致力于扫描网络以收集真实环境中的社会工程攻击实例；(ii) SENet，基于深度学习的图像分类器，利用SECrawler收集的数据进行训练，旨在检测社会工程攻击页面常见的显著视觉特征；(iii) SEGuard，概念验证型浏览器扩展，将SENet嵌入浏览器实现实时攻击检测。通过系统性评估，我们证明SENet在1%误报率下可实现对新型社会工程攻击实例高达99.6%的检测率，为网络环境中的社会工程攻击提供了有效的初级防御。