Matei
Ripeanu,
Department
of
Electrical
and
Computer
Engineering
University
of
British
Columbia
Attacks on large socio-technical systems (e.g., e-mail, online social networks, complex ecosystems of online services like those offered by Google) are increasing in frequency, scale, and complexity. One of the key vectors in such attacks is automated social engineering. This relies on unsafe decisions by individual users, e.g., following a phishing link, opening a malicious attachment, or accepting a friendship request from a social-bot. As a case in point, one such attack, phishing, is currently the fastest growing online crime and caused over $1.6B of financial yearly losses worldwide.
The orthodox paradigm to defend against automated social-engineering attacks is reactive and victim-agnostic: defenses generally focus on identifying the attacks/attackers (e.g., the phishing emails, social-bot infiltrations, or the malware offered for download) to block the attack.
Our project rests on two hypotheses: First, we postulate that it is possible to identify, even if imperfectly, the vulnerable user population, that is, the users that are likely to fall victim to such attacks. Second, we postulate that once identified, information about the vulnerable population can be used in multiple ways to improve system resilience: (i) establish more comprehensive system-wide defences; (ii) influence users towards making better decisions (e.g., through user education and/or personalized interfaces), and (iii) achieve faster and more accurate detection of compromised assets, leading to more effective remediation of large-scale attacks. This talk will present our progress testing these two hypotheses.
Bio: Matei Ripeanu is a Professor at the University of British Columbia where he works together with a fantastic group of students. Read more about his current projects.