A Honey-imprint enabled Approach for Resisting Social Engineering Attacks

In the Reconnaissance step of the Cyber Kill Chain (CKC) model, social engineering (SE) techniques are often used to obtain sensitive/private data. This paper proposes a "honey-imprint" enabled approach which takes advantage of Natural Language Processing (NLP) for detecting SE attacks, Generative Adversarial Networks (GAN) for generating decoys from original sensitive information, and steganography for imprinting the honey watermark. The purpose of honey-imprint is to protect the sensitive information in the original file while leaving a covert imprint on the honey file to identify the malicious user. With this, we can further capture malicious interactions (using honey-imprinted data) by the honeypot system. We implement a prototype to verify the design, and the experimental results show that the method is valid and effective.