To Get Lost is to Learn the Way: An Analysis of Multi-Step Social Engineering Attacks on the Web

Takashi KOIDE; Daiki CHIBA; Mitsuaki AKIYAMA; Katsunari YOSHIOKA; Tsutomu MATSUMOTO

doi:10.1587/transfun.2020CIP0005

IEICE TRANSACTIONS on Fundamentals

Open Access
To Get Lost is to Learn the Way: An Analysis of Multi-Step Social Engineering Attacks on the Web

Takashi KOIDE, Daiki CHIBA, Mitsuaki AKIYAMA, Katsunari YOSHIOKA, Tsutomu MATSUMOTO

Full Text Views

35

Cite this

Free PDF (2.8MB)

Summary :

Web-based social engineering (SE) attacks manipulate users to perform specific actions, such as downloading malware and exposing personal information. Aiming to effectively lure users, some SE attacks, which we call multi-step SE attacks, constitute a sequence of web pages starting from a landing page and require browser interactions at each web page. Also, different browser interactions executed on a web page often branch to multiple sequences to redirect users to different SE attacks. Although common systems analyze only landing pages or conduct browser interactions limited to a specific attack, little effort has been made to follow such sequences of web pages to collect multi-step SE attacks. We propose STRAYSHEEP, a system to automatically crawl a sequence of web pages and detect diverse multi-step SE attacks. We evaluate the effectiveness of STRAYSHEEP's three modules (landing-page-collection, web-crawling, and SE-detection) in terms of the rate of collected landing pages leading to SE attacks, efficiency of web crawling to reach more SE attacks, and accuracy in detecting the attacks. Our experimental results indicate that STRAYSHEEP can lead to 20% more SE attacks than Alexa top sites and search results of trend words, crawl five times more efficiently than a simple crawling module, and detect SE attacks with 95.5% accuracy. We demonstrate that STRAYSHEEP can collect various SE attacks, not limited to a specific attack. We also clarify attackers' techniques for tricking users and browser interactions, redirecting users to attacks.

Publication: IEICE TRANSACTIONS on Fundamentals Vol.E104-A No.1 pp.162-181

Publication Date: 2021/01/01

Publicized

Online ISSN: 1745-1337

DOI: 10.1587/transfun.2020CIP0005

Type of Manuscript: Special Section PAPER (Special Section on Cryptography and Information Security)

Category

Authors

Takashi KOIDE
  NTT Secure Platform Laboratories,Yokohama National University
Daiki CHIBA
  NTT Secure Platform Laboratories
Mitsuaki AKIYAMA
  NTT Secure Platform Laboratories
Katsunari YOSHIOKA
  Yokohama National University
Tsutomu MATSUMOTO
  Yokohama National University

Keyword

social engineering attacks, browser automation, web crawler

Cite this

Copy

Takashi KOIDE, Daiki CHIBA, Mitsuaki AKIYAMA, Katsunari YOSHIOKA, Tsutomu MATSUMOTO, "To Get Lost is to Learn the Way: An Analysis of Multi-Step Social Engineering Attacks on the Web" in IEICE TRANSACTIONS on Fundamentals, vol. E104-A, no. 1, pp. 162-181, January 2021, doi: 10.1587/transfun.2020CIP0005.
Abstract: Web-based social engineering (SE) attacks manipulate users to perform specific actions, such as downloading malware and exposing personal information. Aiming to effectively lure users, some SE attacks, which we call multi-step SE attacks, constitute a sequence of web pages starting from a landing page and require browser interactions at each web page. Also, different browser interactions executed on a web page often branch to multiple sequences to redirect users to different SE attacks. Although common systems analyze only landing pages or conduct browser interactions limited to a specific attack, little effort has been made to follow such sequences of web pages to collect multi-step SE attacks. We propose STRAYSHEEP, a system to automatically crawl a sequence of web pages and detect diverse multi-step SE attacks. We evaluate the effectiveness of STRAYSHEEP's three modules (landing-page-collection, web-crawling, and SE-detection) in terms of the rate of collected landing pages leading to SE attacks, efficiency of web crawling to reach more SE attacks, and accuracy in detecting the attacks. Our experimental results indicate that STRAYSHEEP can lead to 20% more SE attacks than Alexa top sites and search results of trend words, crawl five times more efficiently than a simple crawling module, and detect SE attacks with 95.5% accuracy. We demonstrate that STRAYSHEEP can collect various SE attacks, not limited to a specific attack. We also clarify attackers' techniques for tricking users and browser interactions, redirecting users to attacks.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1587/transfun.2020CIP0005/_p

Copy

@ARTICLE{e104-a_1_162,
author={Takashi KOIDE, Daiki CHIBA, Mitsuaki AKIYAMA, Katsunari YOSHIOKA, Tsutomu MATSUMOTO, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={To Get Lost is to Learn the Way: An Analysis of Multi-Step Social Engineering Attacks on the Web},
year={2021},
volume={E104-A},
number={1},
pages={162-181},
abstract={Web-based social engineering (SE) attacks manipulate users to perform specific actions, such as downloading malware and exposing personal information. Aiming to effectively lure users, some SE attacks, which we call multi-step SE attacks, constitute a sequence of web pages starting from a landing page and require browser interactions at each web page. Also, different browser interactions executed on a web page often branch to multiple sequences to redirect users to different SE attacks. Although common systems analyze only landing pages or conduct browser interactions limited to a specific attack, little effort has been made to follow such sequences of web pages to collect multi-step SE attacks. We propose STRAYSHEEP, a system to automatically crawl a sequence of web pages and detect diverse multi-step SE attacks. We evaluate the effectiveness of STRAYSHEEP's three modules (landing-page-collection, web-crawling, and SE-detection) in terms of the rate of collected landing pages leading to SE attacks, efficiency of web crawling to reach more SE attacks, and accuracy in detecting the attacks. Our experimental results indicate that STRAYSHEEP can lead to 20% more SE attacks than Alexa top sites and search results of trend words, crawl five times more efficiently than a simple crawling module, and detect SE attacks with 95.5% accuracy. We demonstrate that STRAYSHEEP can collect various SE attacks, not limited to a specific attack. We also clarify attackers' techniques for tricking users and browser interactions, redirecting users to attacks.},
keywords={},
doi={10.1587/transfun.2020CIP0005},
ISSN={1745-1337},
month={January},}

Copy

TY - JOUR
TI - To Get Lost is to Learn the Way: An Analysis of Multi-Step Social Engineering Attacks on the Web
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 162
EP - 181
AU - Takashi KOIDE
AU - Daiki CHIBA
AU - Mitsuaki AKIYAMA
AU - Katsunari YOSHIOKA
AU - Tsutomu MATSUMOTO
PY - 2021
DO - 10.1587/transfun.2020CIP0005
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E104-A
IS - 1
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - January 2021
AB - Web-based social engineering (SE) attacks manipulate users to perform specific actions, such as downloading malware and exposing personal information. Aiming to effectively lure users, some SE attacks, which we call multi-step SE attacks, constitute a sequence of web pages starting from a landing page and require browser interactions at each web page. Also, different browser interactions executed on a web page often branch to multiple sequences to redirect users to different SE attacks. Although common systems analyze only landing pages or conduct browser interactions limited to a specific attack, little effort has been made to follow such sequences of web pages to collect multi-step SE attacks. We propose STRAYSHEEP, a system to automatically crawl a sequence of web pages and detect diverse multi-step SE attacks. We evaluate the effectiveness of STRAYSHEEP's three modules (landing-page-collection, web-crawling, and SE-detection) in terms of the rate of collected landing pages leading to SE attacks, efficiency of web crawling to reach more SE attacks, and accuracy in detecting the attacks. Our experimental results indicate that STRAYSHEEP can lead to 20% more SE attacks than Alexa top sites and search results of trend words, crawl five times more efficiently than a simple crawling module, and detect SE attacks with 95.5% accuracy. We demonstrate that STRAYSHEEP can collect various SE attacks, not limited to a specific attack. We also clarify attackers' techniques for tricking users and browser interactions, redirecting users to attacks.
ER -

IEICE TRANSACTIONS on Fundamentals