用图神经网络和BERT结合检测邮件社交工程攻击
Filter-then-Verify: A Multiphase GNN and ModernBERT Framework for Social Engineering Detection in Email Networks
- 先用GNN识别异常发送关系，再用BERT分析内容验证
- 结构过滤召回率达86%，内容验证后精确度超92%
- 适合安全团队部署，可应对内外部攻击
社交工程攻击利用人性弱点而非软件漏洞，难以通过传统过滤手段检测。本文提出一种两阶段的filter-then-verify框架，结合归纳式图神经网络（GNN）进行结构异常检测，与共注意力机制的ModernBERT模型进行内容验证。GNN识别异常的发件人-收件人模式，BERT分析消息上下文以降低误报。基于增强真实模拟攻击场景的Enron数据集，实验显示该框架在结构过滤中实现86%召回率，经BERT优化后精确度超过92%，有效识别外部攻击与内部威胁。结果表明，结合结构与内容分析可实现对多阶段社交工程攻击的实用化、可扩展检测。
原文摘要 · Abstract (English)
Social engineering attacks exploit human trust rather than software vulnerabilities, making them difficult to detect using conventional filters. We propose a two-stage filter-then-verify framework combining inductive Graph Neural Networks (GNNs) for structural anomaly detection with a co-attention ModernBERT model for content verification. The GNN identifies anomalous sender-receiver patterns, while BERT analyzes message context to reduce false positives. Using the Enron dataset augmented with realistic synthetic campaigns, we show that the framework achieves 86% recall in structural filtering and over 92% precision after BERT refinement, effectively detecting both external attacks and insider threats. Our results demonstrate that combining structural and content analysis allows practical, scalable detection of multi-stage social engineering attacks in email networks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。