Abstract
APT attacks are increasing every year, and these APT attacks begin with social engineering attacks. In order to be effective in blocking APT attacks, blocking social engineering attacks make it possible to prevent APT attacks in advance. In this study, we define human factors which greatly influence social engineering attacks, and make it possible to obtain appropriate security requirements by modeling the relationships among human vulnerability, social engineering attacks and security requirements.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Darren, A., Paul, B., Chui, C.F., Gary S.: WorldWide infrastructure security report, Arbor networks special report vol. XII (2017)
Ponemon Institute: 2011 Cost of Data Breach Study, US (2012)
Mouton, F., Leenen, L., Malan, M.M., Venter, H.S.: Towards an ontological model defining the social engineering domain. In: Kimppa, K., Whitehouse, D., Kuusela, T., Phahlamohlaka, J. (eds.) HCC 2014. IAICT, vol. 431, pp. 266–279. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-44208-1_22
Widdowson, A.J., Goodliff, P.B.: CHEAT, an approach to incorporating human factors in cyber security assessments. In: System Safety and Cyber-Security Conference (2015)
Harley, D.: Re-floating the titanic: Dealing with social engineering attacks. In: European Institute for Computer Antivirus Research (1998)
Laribee, L.: Development of methodical social engineering taxonomy project. Msc, Naval Postgraduate School, Monterey, California, June 2006
Tetri, P., Vuorinen, J.: Dissecting social engineering. Behav. Inform. Technol. 32(10), 1014–1023 (2013)
Mouton, F., Leenen, L., Malan, M.M., Venter, H.S.: Towards an ontological model defining the social engineering domain. In: 11th Human Choice and Computers International Conference, Turku, Finland, July 2014, pp. 266–279 (2014)
Kim, B.J., Lee, S.W.: Analytical study of cognitive layered approach for understanding security requirements using problem domain ontology. In: 23rd Asia-Pacific Software Engineering Conference (APSEC), pp. 1530–1362 (2016)
Common Criteria, Part 1: Introduction and general model in Common Criteria for Information Technology Security Evaluation, Common Criteria, pp. 38–44 (2012)
Lee, S.-W., Gandhi, R., Muthuranjan, D., Yavagal, D., Gail-Joon, A.: Building problem domain ontology from security requirements in regulatory documents. In: Workshop on Software Engineering for Secure Systems, New York (2006)
NIST: Managing Information Security Risk: Organisation, Mission, and Information System View. National Institute of Standards and Technology, March 2011
Beth, E.B., McRee, R., O’Connor, T.J.: Assessing outbound Traffic to Uncover Advanced Persistent Threat. SANS Technology Institute (2011)
Marchetti, M., et al.: Analysis of high volumes of network traffic for Advanced Persistent Threat detection. Comput. Netw. 109, 127–141 (2016)
Niu, W., et al.: Identifying APT Malware Domain Based on Mobile DNS Logging. In: Mathematical Problems in Engineering, vol. 2017 (2017)
Acknowledgement
This research was supported by Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education (NRF- 2017R1D1A1B03034279).
This research was supported by the MIST(Ministry of Science and ICT), Korea, under the National Program for Excellence in SW supervised by the IITP (Institute for Information & communications Technology Promotion) (20150009080031001).
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Kim, SJ., Lee, SW. (2018). Social Engineering Based Security Requirements Elicitation Model for Advanced Persistent Threats. In: Kamalrudin, M., Ahmad, S., Ikram, N. (eds) Requirements Engineering for Internet of Things. APRES 2017. Communications in Computer and Information Science, vol 809. Springer, Singapore. https://doi.org/10.1007/978-981-10-7796-8_3
Download citation
DOI: https://doi.org/10.1007/978-981-10-7796-8_3
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-10-7795-1
Online ISBN: 978-981-10-7796-8
eBook Packages: Computer ScienceComputer Science (R0)