US 12,267,361 B2
Conversation-depth social engineering attack detection using attributes from automated dialog engagement
Phillip Porras, Menlo Park, CA (US); Kenneth Nitz, Menlo Park, CA (US); Keith Skinner, Menlo Park, CA (US); and Dayne Freitag, Menlo Park, CA (US)
Assigned to SRI International, Menlo Park, CA (US)
Filed by SRI International, Menlo Park, CA (US)
Filed on Nov. 29, 2022, as Appl. No. 18/059,496.
Claims priority of provisional application 63/265,148, filed on Dec. 8, 2021.
Prior Publication US 2023/0179628 A1, Jun. 8, 2023
Int. Cl. H04L 9/40 (2022.01); G06F 40/30 (2020.01); G06F 40/35 (2020.01)
CPC H04L 63/1483 (2013.01) [G06F 40/30 (2020.01); G06F 40/35 (2020.01)] 21 Claims
OG exemplary drawing
 
1. A computer-implemented method of determining an adversarial attack playbook associated with an adversarial actor, comprising:
receiving, by a computing device, an electronic communication from the adversarial actor, wherein the electronic communication is intended for a target user;
engaging in a deep dialog with the adversarial actor by deploying a synthetic persona dynamically during the electronic communication intended for the target user, wherein the deep dialog comprises two or more rounds of electronic communication exchanges between the adversarial actor and the synthetic persona;
determining a length and type of the deep dialog in order to obtain one or more attributes related to the adversarial actor;
identifying, based on the one or more attributes, a conversational pattern from the deep dialog, wherein the conversational pattern comprises a conversation depth of a given round of the two or more rounds of the deep dialog, and respective class labels corresponding to attributes that appear in the given round;
dynamically producing, based on the identified conversational pattern, the playbook associated with the adversarial actor, wherein the playbook is indicative of a dialog interaction strategy implemented by the adversarial actor; and
providing, by the computing device, the playbook to a social engineering attack (SEA) system in order to detect, avoid and/or mitigate future attacks.