Optimal Personalized Filtering Against Spear-Phishing Attacks

To penetrate sensitive computer networks, attackers can use spear phishing to sidestep technical security mechanisms by exploiting the privileges of careless users. In order to maximize their success probability, attackers have to target the users that constitute the weakest links of the system. The optimal selection of these target users takes into account both the damage that can be caused by a user and the probability of a malicious e-mail being delivered to and opened by a user. Since attackers select their targets in a strategic way, the optimal mitigation of these attacks requires the defender to also personalize the e-mail filters by taking into account the users’ properties. In this paper, we assume that a learned classifier is given and propose strategic per-user filtering thresholds for mitigating spear-phishing attacks. We formulate the problem of filtering targeted and non-targeted malicious e-mails as a Stackelberg security game. We characterize the optimal filteri...

• Type: Journal
• Year: 2015
• Where: AAAI
• Authors: Aron Laszka, Yevgeniy Vorobeychik, Xenofon D. Koutsoukos
• Keywords: AAAI 2015, Intelligent Agents