Optimal Personalized Filtering Against Spear-Phishing Attacks

Authors

  • Aron Laszka Vanderbilt University
  • Yevgeniy Vorobeychik Vanderbilt University
  • Xenofon Koutsoukos Vanderbilt University

DOI:

https://doi.org/10.1609/aaai.v29i1.9327

Keywords:

game theory, spear-phishing, machine learning, e-mail filtering, targeted attacks

Abstract

To penetrate sensitive computer networks, attackers can use spear phishing to sidestep technical security mechanisms by exploiting the privileges of careless users. In order to maximize their success probability, attackers have to target the users that constitute the weakest links of the system. The optimal selection of these target users takes into account both the damage that can be caused by a user and the probability of a malicious e-mail being delivered to and opened by a user. Since attackers select their targets in a strategic way, the optimal mitigation of these attacks requires the defender to also personalize the e-mail filters by taking into account the users' properties. In this paper, we assume that a learned classifier is given and propose strategic per-user filtering thresholds for mitigating spear-phishing attacks. We formulate the problem of filtering targeted and non-targeted malicious e-mails as a Stackelberg security game. We characterize the optimal filtering strategies and show how to compute them in practice. Finally, we evaluate our results using two real-world datasets and demonstrate that the proposed thresholds lead to lower losses than non-strategic thresholds.

Downloads

Published

2015-02-16

How to Cite

Laszka, A., Vorobeychik, Y., & Koutsoukos, X. (2015). Optimal Personalized Filtering Against Spear-Phishing Attacks. Proceedings of the AAAI Conference on Artificial Intelligence, 29(1). https://doi.org/10.1609/aaai.v29i1.9327

Issue

Section

AAAI Technical Track: Game Theory and Economic Paradigms