Quantifying Psychological Sophistication of Malicious Emails

TL;DR

This paper introduces a novel framework to quantify the psychological sophistication of malicious emails, revealing their complex techniques and tactics, which can inform better defense strategies against cyber social engineering attacks.

Contribution

The paper proposes a new framework with metrics and grading rules to assess the psychological sophistication of malicious emails, including a case study with expert assessments.

Findings

Malicious emails are highly psychologically sophisticated.

Common patterns include Attention Grabbing and Impersonation.

Social events are frequently exploited by attackers.

Abstract

Malicious emails including Phishing, Spam, and Scam are one significant class of cyber social engineering attacks. Despite numerous defenses to counter them, the problem remains largely open. The ineffectiveness of current defenses can be attributed to our superficial understanding of the psychological properties that make these attacks successful. This problem motivates us to investigate the psychological sophistication, or sophistication for short, of malicious emails. We propose an innovative framework that accommodates two important and complementary aspects of sophistication, dubbed Psychological Techniques, PTechs, and Psychological Tactics, PTacs. We propose metrics and grading rules for human experts to assess the sophistication of malicious emails via the lens of these PTechs and PTacs. To demonstrate the usefulness of the framework, we conduct a case study based on 1,036 malicious emails assessed by four independent graders. Our results show that malicious emails are psychologically sophisticated, while exhibiting both commonalities and different patterns in terms of their PTechs and PTacs. Results also show that previous studies might have focused on dealing with the less proliferated PTechs such as Persuasion and PTacs such as Reward, rather than the most proliferated PTechs such as Attention Grabbing and Impersonation, and PTacs such as Fit and Form and Familiarity that are identified in this study. We also found among others that social events are widely exploited by attackers in contextualizing their malicious emails. These findings could be leveraged to guide the design of effective defenses against malicious emails.