文献类型：期刊文献

中文题名：社交网络中社会工程学威胁定量评估

英文题名：Quantitative assessment of social engineering threat in social network

作者：张雪芹[1];张立[1];顾春华[1]

机构：[1]华东理工大学信息科学与工程学院,上海200237

年份：2019

卷号：53

期号：5

起止页码：837

中文期刊名：浙江大学学报（工学版）

外文期刊名：Journal of Zhejiang University：Engineering Science

收录：CSTPCD;;EI(收录号：20193207281683);Scopus;北大核心:【北大核心2017】；CSCD:【CSCD2019_2020】；

基金：国家自然科学基金资助项目(61472139)

语种：中文

中文关键词：威胁评估;社会工程学攻击;脆弱性语义;攻击图;贝叶斯网络

外文关键词：threat assessment;social engineering attack;semantics of vulnerability;attack graph;Bayesian network

摘要：针对社交网络中社会工程学威胁难以定量评估的问题,提出基于属性攻击图和贝叶斯网络的社会工程学威胁评估方法.基于社交网络社会工程学攻击过程,定义社会工程学的可利用的脆弱性语义和攻击节点语义,提出相应的脆弱性可利用概率计算方法.通过分析社交网络中社会工程学攻击模式,模拟钓鱼攻击和跨站身份克隆攻击,根据属性攻击图生成算法构建社会工程学攻击图,采用贝叶斯网络模型对每种攻击路径造成的社会工程学威胁进行量化评估,得到社交网络中个人账号的隐私威胁风险.通过在Facebook数据集上的实验验证所提出方法的有效性.
An assessment method for social engineering threat based on attribute attack graph and Bayesian network was proposed, aiming at the problem that social engineering threats in social networks were difficult to evaluate quantitatively. The semantics of vulnerability and attack node in social engineering were defined, and the corresponding method for calculating available probability of vulnerability was proposed, according to the process of social engineering attack in social network. Phishing attacks and cross-station identity cloning attacks were simulated by analyzing the attack patterns of social engineering in social network. Social engineering attack maps were constructed based on the attribute attack graph generation algorithm. Bayesian network model was applied to assess quantitatively the social engineering threats caused by each attack path, and the privacy threat risk value of personal account in social network was obtained. Experiments on the Facebook dataset verified the effectiveness of the proposed method.