TRIDENT: Towards Detecting and Mitigating Web-based Social Engineering Attacks
TRIDENT: Towards Detecting and Mitigating Web-based Social Engineering Attacks
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Zheng Yang;Joey Allen;Matthew Landen;R. Perdisci;Wenke Lee
中科院分区：
文献类型：
--
作者：
Zheng Yang;Joey Allen;Matthew Landen;R. Perdisci;Wenke Lee
作为网络安全中最薄弱的环节，人类已成为利用复杂的基于网络的社会工程技术的攻击者的主要目标。这些攻击者利用低层广告网络将社会工程组件注入网页，引诱用户进入攻击者控制的网站，以便进一步利用。这些攻击大多是基于Web的社会工程攻击（WSEAs），例如奖励和彩票诈骗。虽然研究人员已经提出了检测一些WSEA的系统和工具，但这些方法非常适合特定的诈骗技术（即，技术支持诈骗，调查诈骗）。它们的设计目的不是为了有效地对抗广泛的攻击技术。随着任何用户都可能遇到的WSEAs的不断增加的多样性和复杂性，迫切需要能够准确检测通用WSEAs的新的和更有效的浏览器内系统。为了满足这一需求，我们提出了T RIDENT，一种新的防御系统，旨在实时检测和阻止通用WSEA。T RIDENT通过检测社会工程广告（SE-ads）来阻止WSEAs，社会工程广告是由低层广告网络大规模分发的一般网络社会工程攻击的入口点。我们的广泛评估表明，T RIDENT可以检测到SE广告，准确率为92.63%，假阳性率为2.57%，并且对逃避尝试具有鲁棒性。我们还根据最先进的广告拦截工具对T RIDENT进行了评估。结果表明，T RIDENT的性能优于这些工具，精度提高了10%。此外，T RIDENT仅产生2.13%的运行时开销（中位数），这对于在生产环境中部署来说足够小。
As the weakest link in cybersecurity, humans have become the main target of attackers who take advantage of sophisticated web-based social engineering techniques. These attackers leverage low-tier ad networks to inject social engineering components onto web pages to lure users into websites that the attackers control for further exploitation. Most of these exploitations are Web-based Social Engineering Attacks (WSEAs), such as reward and lottery scams. Although researchers have proposed systems and tools to detect some WSEAs, these approaches are very tailored to specific scam techniques (i.e., tech support scams, survey scams) only. They were not designed to be effective against a broad set of attack techniques. With the ever-increasing diversity and sophistication of WSEAs that any user can encounter, there is an urgent need for new and more effective in-browser systems that can accurately detect generic WSEAs. To address this need, we propose T RIDENT , a novel defense system that aims to detect and block generic WSEAs in real-time. T RIDENT stops WSEAs by detecting Social Engineering Ads (SE-ads), the entry point of general web social engineering attacks distributed by low-tier ad networks at scale. Our extensive evaluation shows that T RIDENT can detect SE-ads with an accuracy of 92.63% and a false positive rate of 2.57% and is robust against evasion attempts. We also evaluated T RIDENT against the state-of-the-art ad-blocking tools. The results show that T RIDENT outperforms these tools with a 10% increase in accuracy. Additionally, T RIDENT only incurs 2.13% runtime overhead as a median rate, which is small enough to deploy in production.