Identifying and mitigating cyberattacks involving social engineering over the phone is crucial for protecting individuals and organizations from potential threats. The paper presents the new for the identifying cyberattacks based on the use of social engineering over the phone. The core of the method is the usage of the so-called unique linguistic word identifier. Furthermore, the proposes approach deals with the language processing of the potential attackers' conversation and transforming it into the set of unique linguistic wording identifiers. As the mean of object classification, the KNN algorithm was involved. The obtained results demonstrated high efficiency of the attacks identification.
In our interconnected digital age, the prevalence of cyberattacks continues to escalate, posing
significant threats to individuals, businesses, and even nations. Among the myriad tactics
employed by malicious actors, social engineering remains a pervasive and insidious method for
gaining unauthorized access to sensitive information [
Social engineering over the phone involves manipulating individuals into divulging
confidential information, such as passwords, personal details, or sensitive corporate data [
Social engineering over the phone is a deceptive and manipulative technique employed by
cybercriminals to exploit human psychology and extract sensitive information. In this method,
attackers use various psychological tactics to convince individuals to divulge confidential data,
such as passwords, personal details, or financial information, over a phone call. This form of
social engineering leverages the natural inclination of individuals to trust and cooperate with
seemingly legitimate authorities or entities [
Common tactics used in phone-based social engineering include impersonation of trusted entities, such as IT support personnel, bank representatives, or government officials. Attackers may employ sophisticated techniques to manipulate emotions, instill a sense of urgency, or create a false crisis to coerce individuals into providing sensitive information or performing actions that compromise their security.
Several techniques fall under the umbrella of phone-based social engineering, including: impersonation, pretexting, phishing calls, vishing (voice phishing).
Using the impersonation attackers may pose as someone the target knows and trusts, such as a colleague, manager, or IT support personnel, to gain access to sensitive information [!!!]. While pretexting attack attackers involve creating a fabricated scenario or pretext to obtain information. For example, an attacker might pretend to be conducting a survey, needing verification for an account, or seeking assistance with a supposed technical issue.
When attackers execute the phishing calls they may use deceptive tactics to trick individuals into revealing information by pretending to be from a legitimate organization, such as a bank, government agency, or a reputable service provider.
Vishing involves using voice communication to trick individuals into providing confidential information. This could include leaving voicemails with urgent messages, directing individuals to call back a fraudulent number, or manipulating call display information to appear trustworthy.
The success of phone-based social engineering often relies on exploiting human trust, creating a sense of urgency, and using psychological manipulation techniques. As technology evolves, attackers continuously adapt their tactics, making it essential for individuals and organizations to stay vigilant, implement security awareness training, and adopt countermeasures to detect and prevent such attacks. Combining technology, such as voice recognition and call verification, with education and awareness campaigns can enhance defenses against social engineering over the phone.
Let's consider an example of an attack in the form of a phone call from a fictitious international organization.
Hacker: Good afternoon, I am Oleksandr Petrenko, a representative of an international organization that provides assistance to Ukrainians affected by military operations.
Victim: Good afternoon. What questions do you have for me?
Hacker: We are informing you that our international organization intends to make a payment of non-refundable financial assistance to your bank payment card in the amount of 6500 UAH. You urgently need to contact your bank to open a payment card.
Victim: I already have an open payment card at the bank to which I receive my salary.
Hacker: Great. Then, in order to receive financial assistance, please give me your full bank payment card number and the short 3-digit number on the back of the card. We will credit you immediately.
In this situation there is a strong need to proceed the conversation and create the tool to identify the social engineering attack.
The objective of this research is to introduce a comprehensive method for detecting and thwarting cyberattacks orchestrated through social engineering over the phone. By combining technological solutions with behavioral analysis and awareness campaigns, our proposed approach aims to enhance the resilience of individuals and organizations against these deceptive tactics.
This paper begins by providing an overview of the current landscape of cyber threats, emphasizing the increasing prevalence of social engineering attacks. Subsequently, it delves into the specific challenges posed by phone-based social engineering, exploring the psychological and technical aspects that make it a potent tool for cybercriminals.
The core of our proposed method involves a multi-layered defense mechanism that incorporates the k-nearest neighbors algorithm - a non-parametric, supervised learning classifier. It relies on proximity to categorize or forecast the grouping of a specific data point. Although it has applicability to both regression and classification tasks, it is predominantly employed as a classification algorithm based on the premise that points with similarities tend to be in close proximity to each other.
We argue that a holistic approach is necessary to address the multifaceted nature of social engineering attacks, which often exploit both technological vulnerabilities and human psychology.
Furthermore, this paper discusses real-world case studies and scenarios to illustrate the effectiveness of our method in identifying and mitigating phone-based social engineering attacks. By presenting empirical evidence and practical applications, we aim to underscore the feasibility and significance of our proposed approach in the realm of cybersecurity.
This research seeks to contribute to the ongoing discourse on cybersecurity by offering a robust method for identifying and combating cyberattacks facilitated through social engineering over the phone. As the digital landscape continues to evolve, it is crucial to develop proactive strategies that empower individuals and organizations to safeguard their information assets against the ever-present threat of social engineering attacks.
Article [
Paper [
For improved fraud detection in the telecommunications environment of the cloud, the authors establish criteria for identifying identical content within a single phone call and present an "Alert Algorithm" that can be installed on a customer's smartphone. This is an Android software that is downloaded once to the client's smartphone and automatically analyzes the call content to detect fraud when intrusion is detected.
In [
Article [15] provides an overview of artificial intelligence-based techniques for detecting and analyzing fraudulent phone calls. The researchers proposed a new approach to detecting fraudulent calls, which demonstrated high accuracy and precision. The effectiveness of the proposed method is the result of the researchers' use of a dataset containing real cases of fraudulent calls.
In [16], the researchers created a dataset of voice phone calls from YouTube videos, conducted experiments on voice classification using machine learning and MFCC features. A telephone fraud detection system was built that classifies speakers by their voice and uses them as identifiers. The support vector machine is the most accurate among the four machine learning classifiers compared in the study (94.46% accuracy using 68 MFCC features).
In [17], the authors propose a method for detecting telephone fraud based on the content of a spoken utterance. The researchers collected descriptions of telephone fraud from open sources. To generate datasets, this method uses machine learning techniques to analyze data and select high-quality descriptions from previously collected knowledge. Natural language processing is used to extract characteristics from textual data. For additional detection of phone fraud, criteria for identifying identical material within a single phone call are formed. The researchers proposed an Android application that can be installed on a user's smartphone; this software analyzes the content of an incoming call to detect potential fraud.
In [18], researchers used machine learning techniques as an effective method for detecting fraudsters in mobile communications. The fraud datasets are taken from the real environment of a telecommunications operator. The authors conducted various experiments with several popular machine learning classification algorithms to evaluate the effectiveness of this model.
In [19], the authors developed a methodology for semi-automated analysis of fraudulent calls and the extraction of information about fraudsters. The researchers used the community of "fraud catchers" on YouTube (people who deliberately interact with telephone fraudsters and publish their conversations). Of course, these conversations cannot be considered real fraudulent calls, but they provide a valuable opportunity to study fraudsters' scenarios and techniques, as fraudsters do not realize that they are not communicating with a potential victim of fraud. The researchers modeled the topics and time series along with identifying emotions to the fraudsters' statements, and identified social engineering techniques associated with the identified stages of the scenario, including the visible use of emotions as a social engineering tool. This work is an important step towards understanding telephone fraud techniques, which forms the basis for more effective mechanisms for detecting and preventing telephone fraud.
In article [20], the authors present a method for detecting telephone fraud using a large language model (LLM). This is a type of artificial intelligence model that is trained on huge amounts of text data to understand and generate human-like text. These models are designed to process and generate natural language texts, so they are capable of performing tasks such as text generation, text classification, language translation, answering questions, and more. Large speech models are versatile and can be adapted to perform various natural language processing tasks with a minimum amount of task-specific training data.
In article [21], researchers proposed a solution that uses machine and deep learning methods to identify fake voices, based on artificial intelligence technology - Google Audio LM. This software can accurately reproduce intonation, accents, and other unique features by imitating the human voice. At the stage of feature extraction, the software uses the Mel Frequency Cepstral Coefficients (MFCC). These features are then classified using models based on machine and deep learning, and according to the results obtained, it is determined whether the voice is real or fake.
Paper [22] describes a method of using artificial intelligence to detect fraudulent phone calls based on a speech artificial intelligence model. With the user's permission, when the user receives a call from an unknown number, the call content is automatically transcribed and analyzed in real time to determine the likelihood of the call being suspicious. When such a call is found to be fraudulent, the user is notified accordingly. If the user grants permission, artificial intelligence based on a speech AI model can answer the call and have a conversation with the caller without user intervention. Speech AI can be trained to adapt to new strategies used by fraudsters.
Study [23] presents an approach to detecting fraudulent calls based on natural language processing (NLP). The aim of the study is to discover and explore new methods of combating social engineering attacks, as well as new methods of detecting and mitigating these attacks.
While there are existing methods for identifying cyberattacks based on the use of social engineering over the phone, these methods have certain drawbacks that highlight the need and motivation for creating new, more effective approaches. Existing methods may struggle to adapt to rapidly evolving social engineering tactics. Cyber attackers frequently modify their strategies, making it challenging for static identification methods to keep up with emerging threats. Another problem is the rate of false positives and false negatives. Some methods produce false positives, incorrectly identifying legitimate calls as potential threats, or false negatives, failing to detect actual social engineering attacks. These inaccuracies can lead to inefficient use of resources or missed opportunities to prevent cyber threats.
Social engineering attacks often involve voice spoofing, where attackers mimic trusted individuals or organizations. Existing methods may not effectively differentiate between genuine and spoofed voices, making it difficult to identify such attacks.
Traditional methods may lack context awareness, meaning they might not consider the broader context of a conversation or the relationship between individuals. This limitation can lead to misinterpretation of communication dynamics and hinder accurate threat detection.
Some current methods do not leverage advanced technologies, such as natural language processing, machine learning, or voice biometrics, which can enhance the accuracy and efficiency of social engineering attack identification.
Social engineering attacks exploit human psychology, and existing methods may not sufficiently incorporate behavioral analysis to detect subtle cues indicative of manipulation. Understanding and analyzing human behavior in the context of phone conversations is crucial for effective identification.
Some methods rely heavily on known patterns of social engineering attacks, which may not cover the full spectrum of tactics used by attackers. A new method should be designed to recognize both familiar and novel techniques employed by cybercriminals.
While threat intelligence is crucial for identifying emerging threats, existing methods may not fully integrate with comprehensive threat intelligence platforms. This can hinder the ability to detect and respond to the latest social engineering attack trends.
Thus, a new method for identifying cyberattacks based on the use of social engineering over the phone are to be developed to provide a more robust, accurate, and adaptive solution to enhance overall cybersecurity resilience.
In order to increase the efficiency of the identifying cyberattacks based on the use of social engineering over the phone a new method was produced.
This paper proposes a method that makes it possible to detect attacks over the phone based on the use of a unique linguistic word identifier. This identifier is similar to the signature method of detecting computer viruses.
The method is based on the use of language processing by breaking down sentences and words and forming a unique linguistic wording identifier.
The proposed approach operates with methods of natural language processing, in particular, the representation of textual information in the form of an n-dimensional vector.
One of the important aspects of the method for identifying cyberattacks based on the use of social engineering over the phone is the identification of a set of words used in the relevant attack. The specified set of words is characterized by a certain set of features and properties, which, when placed in vectors with their semantic proximity, are located next to each other.
Similarly, it is possible to build a set of sentences (phrases) used in the implementation of attacks, and with the help of which it is possible to identify the attack.
Method operates with the notion of the unique linguistic wording identifier – a specific verbal statement made by an attacker that not only conveys information but also encourages a certain action.
For example, the statement "I would like to have some tea, can you make some tea?" is a speech statement, as it instructs the listener to make tea.
We characterize the unique linguistic wording identifier (ULVI) as a set of verbal utterances that perform speech statement that are directly relate to the social engineering attacks over the phone. Just as a unique universal identifier for viruses identifies a specific type of virus, a fraud's ULVI clearly defines a class of social engineering attacks. identifier. will be blocked”; back of the card”; fund”;
… us”.
Let us denote the unique linguistic wording identifiers set as 1 = j=1 – a set of ULVI the describe the attackers’ conversation, where N is the number of unique linguistic wording The examples of samples for the ULVI construction can be as follows: 1 = “National Bank Security Service, we would like to inform you that your payment card 2 = “You have been credited with non-refundable financial assistance from an international 3 = “Tell us the full number of your payment card, PIN code, CVV code indicated on the 4 = “You need to go to the nearest ATM to enter a special combination of numbers”; j = “Now you will receive a secret SMS code to your number, which you need to tell only to
K-Nearest Neighbors (K-NN) was applied to unique linguistic wording identifier classification tasks, where the goal is to categorize ULVI into different classes based on set of certain features. K-Nearest Neighbors is a viable approach for ULVI classification, particularly when dealing with datasets where the decision boundaries are complex and not easily captured by traditional models [24]. It is fine-tuning parameters and thoughtful feature selection are essential for achieving optimal results.
In order to implement the approach, the steps are to be executed: Data representation; Execute the training phase; Execute classification phase (attack identification).
Data representation includes the feature extraction and the feature vector construction procedures.
In order to build the unique linguistic wording identifier a set of relevant features are to be extracted. These features include aspects like stroke patterns, curvature, size, aspect ratio, and other characteristics that are distinctive for ULVI analysis.
The next step is the feature vector construction. Each ULVI’s set of extracted features are to be presented as the feature vector. Each ULVI’s feature vector represents its position in a
Execution of the training phase includes the obtaining of the labeled dataset and feature multidimensional feature space. scaling. calculation. majority voting procedures.
The next step is to prepare the labeled dataset where each unique linguistic wording identifier is associated with its corresponding class – malicious or benign phone call.
After that we are to perform the feature scaling procedure. This process consists of normalization of the feature values to ensure that all features contribute equally to the distance Classification Phase includes the distance calculation, the neighbor selection, and the During the classification phase it is important to evaluate the distance, that is when we are classifying a new ULVI, we have to calculate the distances between its feature vector and the feature vectors of all ULVIs in the training set. To do this in the research the distance metric, Euclidean distance was involved: ( , ) =
( − )2.
After the distance evaluation the neighbor selection procedure is to be performed, where we are to select the K-nearest neighbors based on the calculated distances.
Ent the last step is to apply a majority voting scheme to determine the class of the new ULVI. The class that occurs most frequently among the K-nearest neighbors is assigned to the specified ULVI.
The pseudocode of the K-Nearest Neighbor is presented in Figure 1.
In order to conduct experiments with the developed method for identifying cyberattacks based on the use of social engineering over the phone, the adapted dataset based on the CallHome, which is the part of the TalkBank project [26, 27]. It is a specific dataset or collection of data related to telephone conversations. The TalkBank project is a research initiative that focuses on collecting, analyzing, and sharing spoken language data for the purpose of studying various aspects of human communication and language development [27].
CallHome datasets typically involve recordings of telephone conversations in different languages and from various cultural contexts. These datasets are valuable resources for researchers in linguistics, communication studies, and related fields to investigate topics such as conversation analysis, sociolinguistics, and the development of language in naturalistic settings [26]. Another source cyberattacks based on the use of social engineering over the phone was the bank security service of the biggest bank of Ukraine. Modified dataset included 1300 unique linguistic wording identifiers. For system test the 30 conversations were generated that included properties of the cyberattacks based on the use of social engineering over the phone.
To assess the efficiency of the method for identifying cyberattacks based on the use of social engineering over the phone the metrics were involved: TPR – True Positive Rate, FPR – False Positive Rate, Precision, Recall, F1-score, and MCC were involved [25]:
, , ∗
+ 1 = 2 ∗
+ ∗ − ∗
, = ( + )( + )( + )( + ) , (2) (3) (4) (5) (6) (7) (8) where MCC - Matthews Correlation Coefficient is a metric used to assess the quality of binary classification models, particularly when dealing with imbalanced datasets. It takes into account true positive, true negative, false positive, and false negative predictions, providing a balanced measure that considers all four outcomes. The MCC value ranges from -1 to +1, with +1 indicating perfect prediction, 0 indicating no better than random, and -1 suggesting total disagreement between predictions and actual outcomes. The results of the binary classification of the malicious and benign phone conversation for 30 experiments are presented in Table 1.
The results of the proposed approach are highly promising but it has to be mentioned that the developed system is sensitive to the settings of the KNN algorithm parameters. Experiment with different values of K to find the optimal one for your dataset.
Cross-validation can help in this process. Select a distance metric that aligns with the characteristics of the signature features. Consider experimenting with different distance metrics to find the most suitable one. Properly preprocess the data, handle outliers, and select relevant features for signature classification.
Identifying and mitigating cyberattacks involving social engineering over the phone is crucial for protecting individuals and organizations from potential threats.
The paper presents the new for the identifying cyberattacks based on the use of social engineering over the phone. The core of the method is the usage of the so-called unique linguistic word identifier. Furthermore, the proposes approach deals with the language processing of the potential attackers’ conversation and transforming it into the set of unique linguistic wording identifiers. As the mean of object classification, the KNN algorithm was involved. The results demonstrated high efficiency of the attacks identification up to 97%. Nevertheless, the future work has to implementing another machine learning models to improve the detection efficiency in order to analyze voice patterns, sentiment, or speech characteristics during phone conversations. The future method might involve training models to distinguish between normal and suspicious communication based on learned features. Communication Networks, Lecture Notes in Networks and Systems, volume 394, Springer, Singapore, 2022, doi.org/10.1007/978-981-19-0604-6_47. [15] S. Malhotra, G. Arora, R. Bathla, Detection and Analysis of Fraud Phone Calls using Artificial Intelligence, in: 2023 International Conference on Recent Advances in Electrical, Electronics & Digital Healthcare Technologies (REEDCON), 01-03 May, 2023, IEEE Xplore ISBN:978-1-6654-9382-6, doi:10.1109/REEDCON57544.2023.10150631. [16] Y.M. Rahman; Y. Bandung, Phone Call Speaker Classification using Machine Learning on MFCC Features for Scam Detection, in: 2022 6th International Conference on Information Technology, Information Systems and Electrical Engineering (ICITISEE), 2023, doi:10.1109/ICITISEE57756.2022.10057625. [17] D. Naidu, Voice analysis system for detection of vishing using deep learning, International
Journal of Health Sciences. 6 (2022), 10457-10466. [18] Krasić, S. Čelar, Telecom Fraud Detection with Machine Learning on Imbalanced Dataset, in:2022 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia, 2022, pp. 1-6, doi: 10.23919/SoftCOM55329.2022.9911518. [19] I. Wood, M. Kepkowski, L. Zinatullin, T. Darnley, M. A. Kaafar, An analysis of scam baiting calls: Identifying and extracting scam stages and scripts. (2023) Subjects:Cryptography and Security. arXiv preprint arXiv:2307.01965. [20] J. Liming, Detecting Scams Using Large Language Models. arXiv preprint arXiv:2402.03147, 2024. [21] H. H. Kilinc, F. Kaledibi, Audio Deepfake Detection by using Machine and Deep Learning, 2023 10th International Conference on Wireless Networks and Mobile Communications (WINCOM), Istanbul, Turkiye, 2023, pp. 1-5, doi: 10.1109/WINCOM59760.2023.10323004. [22] Rao, K. Mallikarjuna, P. Bhavikkumar, Suspicious Call Detection and Mitigation Using
Conversational AI, Technical Disclosure Commons. 04 (2023). [23] C. J. Shalke, R. Achary, Social Engineering Attack and Scam Detection using Advanced Natural Langugae Processing Algorithm, in: 2022 6th International Conference on Trends in Electronics and Informatics (ICOEI), Tirunelveli, India, 2022, pp. 1749-1754, doi: 10.1109/ICOEI53556.2022.9776697. [24] N. Hasan, N. Ahmed, S. M. Ali, Improving sporadic demand forecasting using a modified k-nearest neighbor framework. Engineering Applications of Artificial Intelligence. 2024.
Vol. 129, 107633. [25] D. Chicco, G. Jurman, The Matthews correlation coefficient (MCC) should replace the ROC AUC as the standard metric for assessing binary classification. BioData Mining. 2023. Vol. 16 (1). Pp.1-23. [26] B. Macwhinney, D. Fromm, Language Sample Analysis With TalkBank: An Update and
Review, Frontiers in Communication. (2022) 7: 865498. [27] Linguistic Data Consortium. University of Pennsylvania. CALLHOME American English
Speech. URL: https://catalog.ldc.upenn.edu/LDC97S42. [28] K.Bobrovnikova, M. Kapustian, D.Denysiuk, Research of machine learning based methods for cyberattacks detection in the internet of things infrastructure. Computer Systems and Information Technologies,. 3 (2022), pp.110–115. https://doi.org/10.31891/CSIT-2021-5-15.