A dual integrated dynamic intrusion detection system (DID-IDS) for protection against network and social engineering attacks

As machines are becoming more connected (e.g., due to advances in automation and the Internet of Things), cyberattacks are expected to be increasing. Cyberattacks can impact smart power grids (Hong et al., 2017; Ten et al., 2011), secure water treatment plants (Adepu et al., 2019), medical devices (Beavers & Pournouri, 2019), computer networks, and smart homes (Arabo, 2015), among many others. For example, more than 10 billion dollars were lost due to malware in 2007, and it is increasing over time (Teoh et al., 2018). According to Kim et al. (2018), social engineering attacks are the least detected today, although they account for over a quarter of cyberattacks (Bowen, Devarajan, & Stolfo, 2014). Accordingly, the field of cyber security should develop more sophisticated intrusion detection methods to help secure the overly connected world of machines. For simplicity, in this article, we divide cyberattacks into two types: (a) standard attacks on computer systems, which, for example, involve using brute-force methods to find a system password that may work, IP address spoofing, or traffic interception and (b) social engineering methods, such as phishing, which involves attacking a system user’s mind to give away important information, such as passwords (Lohani, 2019). The difference between the two kinds is that the first can be done without directly interacting with computer system users, while the second involves interaction with system users. In social engineering attacks, for example, Mbaziira and Jones (2016) found that cybercriminals often rely on linguistic skills to deceive computer system users. While there have been research studies on the prevalence of social engineering hacking methods, there are only a few studies on detecting social engineering attacks (Hoeschele, 2006), which we discuss below. These two types of cyberattacks rely on using different techniques. Standard computer system attacks often involve brute-force search methods, while social engineering often involves the use of psychological techniques and linguistic skills to convince computer system users to give away secure information.