Visible to the public Optimal Personalized Filtering Against Spear-phishing AttacksConflict Detection Enabled

TitleOptimal Personalized Filtering Against Spear-phishing Attacks
Publication TypeConference Paper
Year of Publication2015
AuthorsLaszka, Aron, Vorobeychik, Yevgeniy, Koutsoukos, Xenofon
Conference NameProceedings of the Twenty-Ninth AAAI Conference on Artificial Intelligence
PublisherAAAI Press
Conference LocationAustin, Texas
ISBN Number0-262-51129-0
Keywordsgame theory; spear-phishing; machine learning; e-mail filtering; targeted attacks, Resilient Systems, science of security, SURE Project

To penetrate sensitive computer networks, attackers can use spear phishing to sidestep technical security mechanisms by exploiting the privileges of careless users. In order to maximize their success probability, attackers have to target the users that constitute the weakest links of the system. The optimal selection of these target users takes into account both the damage that can be caused by a user and the probability of a malicious e-mail being delivered to and opened by a user. Since attackers select their targets in a strategic way, the optimal mitigation of these attacks requires the defender to also personalize the e-mail filters by taking into account the users' properties.

In this paper, we assume that a learned classifier is given and propose strategic per-user filtering thresholds for mitigating spear-phishing attacks. We formulate the problem of filtering targeted and non-targeted malicious e-mails as a Stackelberg security game. We characterize the optimal filtering strategies and show how to compute them in practice. Finally, we evaluate our results using two real-world datasets and demonstrate that the proposed thresholds lead to lower losses than nonstrategic thresholds.

Citation KeyLaszka:2015:OPF:2887007.2887140