We frequently hear news about compromised systems, virus attacks, spam emails, stolen bank account numbers, and loss of money. Safeguarding and protecting digital assets against these and other cyber-attacks are extremely important in our digital connected world today. Many organizations spend substantial amounts of money to protect their digital assets. One type of cyber threat that is rampant these days is social engineering attacks that work on human psychology. These attacks typically persuade, convince, trick and threaten naïve and innocent individuals to divulge sensitive information to the attackers. Consequently, traditional approaches have not been effective or successful in preventing these attack types. In this paper, we propose a machine learning model to detect these types of threats. The model is trained using a large synthetic dataset of 10,000 samples to simulate various types of real-world social engineering threats such as phishing, spear phishing, whaling, vishing, smishing, baiting, and pretexting. Our analysis on attack types, patterns, and characteristics revealed interesting insights. Our model achieved an accuracy of 0.8984 and an F1 score of 0.9253, demonstrating its effectiveness in detecting social engineering attacks. The use of synthetic data overcomes the problem of lack of availability of real-world data due to privacy issues, and is demonstrated in this work to be safe, scalable, ethics friendly and effective.

Social Engineering Threat Analysis Using Large-Scale Synthetic Data