Computer Science
Computer Science-2021.gz:143476
Computer Science
8bb7fd8a39abb7e55a14f5e84438399defef56c8
How vulnerable are you? A Novel Computational Psycholinguistic Analysis for Phishing Influence Detection

This document contains our work and progress regarding phishing detection by searching for proper influential sentences. Currently, the world is becoming smart, as a result most of the transactions and posting offers happen online. So, human beings have become the most vulnerable to security breach or hacking through phishing attacks, or being persuaded through influential texts in social media sites. We have analyzed influential and non-influential sentences and populated our dataset with those. We have proposed a computational model for implementing Cialdini and we got state of the art accuracy with our model. Our approach is language independent and domain independent and it is applicable to any problem where persuation detection is important. Our dataset and proposed computational psycholinguistic approach will motivate researchers to work more in the area of persuasion detection.


Introduction
In some ways we humans are incredibly durable, and in others we are incredibly fragile. Most of the humans can be easily swayed by beautiful rewards. We are the most vulnerable to phishing attacks and such rackets. Some people take these opportunities to persuade people to click some bad links through some deceitful messages.
Depending on a person's behaviour we can influence him/her using different types of methods. Robert Cialdini did research on all those methods and ways and published his famous principles. We created a classifier to detect types of influence by fine-tuning a pre-trained BERT model.
In this paper our major contributions are: i. Our research on phishing detection was using computational psycholinguistic approach.
Here we have modeled the Cialdini principles on influence analysis.
ii. We have prepared our dataset using influential texts, such as advertisements, Twitter posts etc.
iii. We experimented with pre-trained BERT models by adding extra layers and changing the learning rate.
The rest of the paper is organised as follows. Section 2 discusses about the related works and how those are different. Section 3 discusses about Cialdini principles and how we applied them in our work. Section 4 describes how we made our own dataset and related literature survey. Section 5 provides an insight into the pre-trained model and why we used it. Section 6 discusses about our experiment with different methods and tools to reach higher accuracy. Section 7 provides a detail about our result and section 8 concludes the paper.

Related Work
The closest research to our work is on sentiment analysis and persuasion detection based on Cialdini principles. Kiemute Oyibo and JulitaVassileva (2018) focused on how culture and gender influence the effectiveness of Cialdini's principles of persuasion. They investigated on how the culture, gender and age differences affect individual's susceptibility to Cialdini's persuasive strategies. But their work centred on the people of Nigeria. Sridhar Ramaswamy (2018) used unstructured data available for survey voice recording of customer interactions and chat transcripts and explored different technologies of Deep Learning (Goodfellow et al., 2016) and Natural Language Processing (NLP) that would help better analyze the contextual information to capture customer feedback. Christopher Hidey (2018) worked with detection of persuasion in online discussion or in some argument. Merton Lansley (2019) developed a method that detects social engineering attacks that are based on NLP and Artificial Neural Networks. Ifeoma Adaji and JulitaVassileva (2020) proposed the use of shoppers' online shopping motivation in tailoring six commonly used influence strategies: scarcity, authority, consensus, liking, reciprocity, and commitment and they identified how these influence strategies can be tailored or personalized to e-commerce shoppers based on the online customers' motivation when shopping. Shilpa P C (2021) used deep learning techniques to classify the sentiments of an expression into positive or negative emotions which were further classified into more atomic emotions. Vansh Gupta (2021) worked with persuasion detection but their work was based on biased or misleading information or propaganda classification.
Some researchers have also worked on sentiment analysis and persuasion detection based on Twitter data. OlhaKaminska and Hoste (2021) developed an approach for the SemEval-2018 emotion detection task, based on the Fuzzy Rough Nearest Neighbor (FRNN) classifier enhanced with Ordered Weighted Average (OWA) operators. Neha Jadav and Khamparia (2018) focused more on improvement of accuracy of sentiment system 1 to 5 star, 1 being the most negative. So many works on persuasion detection have been done over the years. Everyone has focused on some particular domain, either customer feedbacks, online shopping sites, or some particular culture or area. Our goal was to identify phishing attacks through influential texts. Therefore we used persuasion detection and Cialdini principles and we tried to be more general in determining effects of these influences. So, we collected example sentences from as many diverse places as possible.

Our Technique
While searching for the ways by which people can be persuaded or phishing attacks can be detected we came across Cialdini's principles. 1 So we used mainly those principles in our classifier. Before going further let's first discuss about Cialdini principles.

Cialdini's Principles
Robert Cialdini published his book "Influence: The Psychology of Persuasion" 2 in 1984. In this book he explored some factors that affect the decisions that people make. Cialdini identified six core principles that affect this decision making process.
Reciprocity -People always tend to help those from whom they have got help before as a form of gratitude. So business companies make the advertisements in a way to provide their customers extra benefits, discounts, offers in order to prompt them to buy products from that company.
Scarcity -It is a fact that the less something there is, the more people will tend to want it. Many companies use this human behaviour to put some products in limited edition sale.
Authority -Individuals who are authoritative, credible, expert in their fields are more influential and persuasive than those who are not. People prefer to go for those company products that are promoted by authoritative figures.
Commitment and Consistency -People like them who are committed to their words, and they also like to be consistent with their identity. So many advertisements tend to make people believe something and make them do according to that. People also like to use the products which are committed to their usefulness.
Liking -People tend to follow those whom they love, that could be an authoritative person, a player, a singer. So some companies give such famous persons money to use their products and show to people.
Consensus -People love opinion of the majority. When they find something is used by most of the people they tend to use it too.

How we applied Cialdini theory
We used this Cialdini Persuasion theory in order to find the influence working behind a text, be it an advertisement or a text message. We made each category a class and thus we applied Cialdini's Principles as a multiclass Machine Learning (Mitchell, 1997) classification problem.
We chose Cialdini's principles to divide texts in multiple classes. We marked those classes as 1) Reciprocity, 2) Scarcity, 3) Authority, 4) Commitment, 5) Liking, 6) Consensus and we created a 7th class as not showing any influence, for normal sentences.
We collected email texts from different senders and went through different ads and categorized them according to the levels of persuasion.
Phishing attacks target vulnerabilities that exist in systems due to the human factor (Khonji et al., 2013). Many cyber attacks are spread via mechanisms that exploit weaknesses found in end-users, which makes users the weakest element in the security chain. The phishing problem is broad and no single silver-bullet solution exists to mitigate all the vulnerabilities effectively, thus multiple techniques are often implemented to mitigate specific attacks. One of these techniques is persuasion analysis.

Making Dataset
We studied Cialdini's theory to understand how a person can be influenced in order to detect phishing attacks. We did not find any dataset regarding our research, so we had to make our own dataset and categorize the texts by ourselves. We used some pre-defined definitions in order to sort those sentences out. For identifying the six influence classes, we followed the following conventions -• Give away or giving something without any charge on some occasion, such messages show reciprocity type of influence.
• Messages alerting customers regarding limited offer show scarcity type of influence.
• Messages or ads regarding sponsorship or doing partnerships show authority type of influence.
• Messages committing about well being or best performance of a product show commitment type of influence.
• Messages telling what one's favourite person uses or does, provoking him/her to use that product show liking type of influence.
• Messages showing survey results show consensus type of influence.
We collected as many influential texts as possible from advertisements from different companies and grouped them in those classes. We gathered about 100 texts from each class and made a dataset with 735 texts. We created a model using this dataset. 3 Still the variety in our dataset was very small. Big companies like these are also perfect for finding examples on authority and consensus. These sentences helped us understand how social sites can persuade people through influential advertisements and messages. After collecting these sentences on various domains we used our temporary model to make predictions. Then we rechecked, verified and corrected the predictions that were made above 95% and discarded others. Finally we appended those texts with our original dataset (please see table 1) and made its size 2379.

Transformers vs RNNs
Transformers (Ashish Vaswani and IlliaPolosukhin, 2017) are semi-supervised machine learning models that were primarily used with text data and have also replaced Recurrent Neural Networks (RNNs) (Danilo P. Mandic, 2001) in Natural Language Processing (NLP) (Jurafsky and Martin, 2009) tasks. We chose Transformers for our problem because it beats RNN in time complexity.
Transformers use self-attention mechanism that allows the decoder to look back at the entire sentence and selectively extract the information it needs during decoding. This mechanism helps to know the context better. With RNN, one has to go word by word to access the cell of the last word. This becomes a major problem for GPUs,

BERT vs Others
More than one architectures are being used in NLP tasks, such as ELMo, GPT, BERT.(Jacob Devlin, 2019) ELMo follows a more traditional design and uses LSTM to compute vocabulary when it comes to art. BERT uses transformers in two approaches for language improvement. ELMo uses two layers each to include forward and backward passages to calculate the middle word vectors. This helps ELMo to achieve high efficiency compared to other traditional language models.(Ezen-Can, 2020) Though transformer uses a decoder and an encoder, BERT only uses an encoder and it does bidirectional context search, whereas GPT does it in one direction. BERT can also be used for multimasked sentences, and next sentence prediction, and bi-directional search really makes it more reliable. Moreover, BERT model reads at most 512 words in one iteration. GPT-3 has almost 175B parameters and T5 has 11B parameters, whereas BERT has only 110M parameters in its base model and 340M parameters in its large model. Based on our subject we did not require so many parameters as GPT and T5 provide, that is why we preferred BERT over other models.
We picked BERT-base-uncased over cased as influence detection should not be sensitive to cases.

Experiments with different methods
We trained a wide range of different models for the task. As discussed in sections 3 and 4 we made our own dataset and used them to train the models. As we discussed in section 5, we used BERT model from transformers rather than RNN.
After making the train and validation datasets we applied different pre-trained models, fine-tuned them and used the best one to make our final model.
We fine tuned BERT-base-uncased with our Neural Network which is taking input from the fine tuned BERT layer and processing it in this extra 9 layers out of which first 7 layers are simple dense layers with the unit numbers of 1024, 512, 256, 128, 128, 64, 32, a dropout layer with 0.3 dropout rate and lastly an output dense layer with unit number of 7.
We fine tuned another BERT-base-uncased model with previous configurations but this time without the dropout layer. We wanted to check how it behaves after removing the dropout layer.
Then we also fine tuned a BERT-base-cased model with a total of 9 layers among which 7 layers are simple dense layers with unit numbers 1024,512,256,128,128,64,32, an output dense layer with unit number of 7 and one dropout layer with rate 0.3. We checked by removing the dropout layer also for this model.
Then we also fine tuned a Distilled version of BERT model or DistilBERT.
Our Deep Neural Network model used a vocabulary size of 10,000, a batch size of 32 and was trained over 10 epochs. The system consisted of two input layers, one main BERT layer, six dense layers with varying sizes decreasing from 1024 to 32, one dropout layer with regularization of 0.3 and one output layer.
We used Rectified Linear Unit (ReLU) 4 activation function for dense layers and Softmax function for the output layer. The main advantage of using 4 https://bit.ly/32YjPlx ReLU over other activation functions is that it does not activate all the neurons at the same time. This means that the neurons will only be deactivated if the output of the linear transformation is less than 0.
We experimented with all these models using different learning rates, because not only the method, but how fast the model is learning, is also very crucial in gaining more accuracy. We started with 0.01 and decreased the rate each time until we got the maximum accuracy. Then we collected the learning rate and accuracy for each model. Among all these models, we got the best result in BERT-baseuncased without dropout layer model with learning rate of 0.0001 or 1e-4. 5

Result and discussion
There are many datasets on whether a sentence is ham or spam 67 and datasets on detecting phishing sites 8 (Justinas Rastenis, 2021; Patrick Lawson, 2020;Kiemute Oyibo and JulitaVassileva, 2018). But there is no dataset on influence analysis using Cialdini principles, so we had to make our dataset. Then we experimented with different Deep Neural Network models and found BERT-base-uncased to overwhelm others and be suited for our work. DistillBERT, BERT-base-cased and uncased both of them with or without dropout. Among them we got the best result in BERT-base-uncased without dropout layer, we can clearly see in the graph above that the violet line is exceeding other lines in almost every epoch.  Figure 2 shows epoch count versus loss for different models. As we got the best accuracy in accuracy graph for BERT-base-uncased without dropout, similarly we got the least loss in case of this model.
We used Bert-base-uncased model of Transformer to make our model with a learning rate of 0.0001 as it reached the highest accuracy. We achieved 97.46% accuracy with our small dataset. After appending it with more example texts, we got 93.76% from our model using the new dataset. 9 We have also kept a sub-part 10 of the dataset, as our test data, and used that to evaluate our model. It turned out to be 87.5%.
Our model does not show which type of influence is being used, but rather it shows each type of influence along with their probabilities of being present in the given text. Figure 3 shows the prediction of our proposed model by displaying the probabilities of each influence category in a given sentence.
To check this model is predicting well in the dataset, we used confusion matrix (See figure 4).  Total number of true positive in 7 classes is 2176 out of 2379. We can see that we have the most information on Reciprocity type of influence and the least on Authority and Social Proof. As we have scraped business data, Reciprocity is the most dominant one there, and then comes Commitment.
To make the understanding better we use F1-score which depends on both recall and precision.
In Table 2, we can check the F1-scores for different models on each class. We checked running all the models for 50 epochs. We can see that how we are getting the highest accuracy of 78% with the BERT-base-uncased model without a dropout layer.

Conclusion
Influence detection is a multi-level classification problem. Many works have been done on this topic and on persuasion detection, but they have worked on a particular domain, area, or caste. We focused more on finding the example texts not only from   We focused on detecting phishing and other social media attacks, because these are something to which people are the most vulnerable nowadays. We made our own dataset and we have not predicted only the type of influence; we have given all the probabilities for each type of influence. Even for a human, we cannot predict exactly what type of influence is working in a sentence. Sometimes, a sentence can be formed using more than one influence categories. Advertisements include multiple influences in one sentence, so that becomes very difficult for anyone to determine the most effective type of the sentence. So, we have shown the probabilities as a pie chart (please see figure 3) and also mentioned the type of influence that is most probably working.
Where from Here i. At first we did not find any suitable dataset for our work, so we collected data from different advertisements and sentences from Twitter and we made our model. The final dataset that we have made is still not sufficient, so our model may be overfitted. We plan to increase the data more in the future using Bootstrap mechanism. Then by human intervention we will verify and rectify the predictions made by our model and train it with new data.
ii. We have fine tuned cased and uncased versions of pre-trained BERT model and we have also used DistilBERT. As our future work, we want to do more research using recent pretrained models for better results.
iii. We have applied phishing detection using influence analysis in English language only. However, our proposed approach is domain and language independent. Therefore we are planning to apply our model for other Indian Languages starting from Bangla. We are also planning to see how it will work for fake news detection problem where influence detection is also important.
iv. Limited priorwork has been done on phishing detection using persuasion techniques. We did not have the opportunity to compare with those datasets. As a future work, we are planning to compare our dataset with different datasets and different methodologies.