Prof Marthie Grobler
email: mgrobler1@csir.co.za

Ignus Swart
email: iswart@csir.co.za

On the Probability of Predicting and Mapping Traditional Warfare Measurements to the Cyber Warfare Domain

Keywords: cyber warfare, metrics, prediction, probability, traditional warfare 1

Cyber warfare is a contentious topic, with no agreement on whether this is a real possibility or an unrealistic extension of the physical battlefield. This article will not debate the validity and legality of the concept of cyber warfare, but will assume its existence based on prior research. To that end the article will examine research available on traditional warfare causes, elements and measurement techniques. This is done to examine the possibility of mapping traditional warfare measurements to cyber warfare. This article aims to provide evidence towards the probability of predicting and mapping traditional warfare measurements to the cyber warfare domain. Currently the only way of cyber warfare measurement is located in traditional information security techniques, but these measurements often do not adequately describe the extent of the cyber domain. Therefore, this paper aims to identify a set of criteria to aid in the prediction of cyber warfare probability.

Introduction

This article will not debate the validity and legality of the concept of cyber warfare, but will assume its existence based on prior research performed by Heickerö [START_REF] Heickerö | Some aspects on cyber war faring in information arena and cognitive domain[END_REF] and Liles, Rogers, Dietz and Larson [START_REF] Liles | Applying traditional military principles to cyber warfare[END_REF]. To that end this article will examine the history of research available on traditional warfare pre-requisites and measurement techniques. This is done to examine the possibility of mapping traditional warfare measurements to cyber warfare.

Currently the only way of measurement is located in traditional information security techniques. While applicable, the measurements do not adequately describe loss, posture or any of the pre-requisites found in traditional warfare. This article aims to provide evidence towards the probability of predicting and mapping traditional warfare measurements to the cyber warfare domain.

Predicting Traditional Warfare

There have been many attempts to predict and prevent traditional warfare. Unfortunately, many of the causes identified as precursors for warfare cannot be manipulated towards predicting warfare [START_REF] Van Evera | Causes of war: Power and the roots of conflict[END_REF]. This section looks at the accepted causes of traditional warfare and builds on these causes as metrics for traditional warfare.

Causes of Traditional Warfare

Research by Van Evera [START_REF] Van Evera | Causes of war: Power and the roots of conflict[END_REF] and Schelling (in [START_REF] Van Evera | Causes of war: Power and the roots of conflict[END_REF]) focus on the causes of war that relates to the character and distribution of national power. The hypotheses of these works are that warfare is more likely when:

1. Nation states fall prey to false optimism about the outcome of war. This occurs when nation states exaggerate their own chances of winning crises and wars, or when they underestimate the cost of war. For example, when nation states are so sure that their military force is stronger than an opponent, they may be less risk averse and take bigger risks. 2. The advantage lies with the first side to mobilise the attack. This occurs when nation states launch pre-emptive attacks to prevent their opponents from attacking first. This has a negative impact on diplomacy, since nation states tend to conceal their capabilities and grievances for fear that open displays of strength or grievance could trigger another nation states' pre-emptive attack. For example, Hitler's 1940 attack on Norway was purely a move to advance the Germans' position in the war. 3. The power of nation states fluctuates sharply, with large windows of opportunity and vulnerability. Fluctuations in power tempt nation states to launch preventive attacks and rush into war sooner if they predict their own vulnerability to grow in the future. In some cases diplomacy becomes hurried in an attempt to resolve disputes before power wanes, often resulting in less valuable diplomatic agreements or a complete loss of diplomacy. For example, in the 16 th century the weaker Dutch nation revolted against the Spanish due to their imminent subjugation to Spanish rule. 4. Resources are cumulative. This occurs when the control of resources enables a nation state to protect or acquire other resources that can be readily used to seize more resources. It is found that cumulative resources often predict further gains or losses. Therefore, the greater the cumulativity of conquerable resources, the greater the risk of war. This was illustrated as far back as the Roman wars that forced tax collection from conquered nations to continue the war effort. 5. Conquest is easy. Easy conquest is a master cause of other potent causes of war, raising all the risks they pose. This was clearly demonstrated when China and the League of Nations did nothing to stop the invasion of Manchuria by Japan in 1932.

These causes of war will form the foundation of this research study, and will serve as the main metrics to measure damage and potential loss due to warfare.

Traditional Warfare Elements

For the purpose of this paper, war can be defined as a state of armed conflict between different countries or different groups within an environment. There are a number of theories about the elements that comprise traditional warfare. For the purpose of this research study, the thinking of Clausewitz will be followed. Although not exhaustive, the authors felt that Clausewitz's thinking is most representative and applicable to the cyber domain. Clausewitz (in [START_REF] Rid | Cyber war will not take place[END_REF]) believed that an offensive act has to meet certain criteria in order to qualify as an act of war:

 It has to have the potential to be lethal. If an act cannot be considered as potentially violent, it is not an act of war. A real act of war is always lethal, for at least some participants on at least one side. Although none of the hypotheses listed in Section 1.1 mentions violence, this element links to all the causes of warfare in that the offending nation state aims to gain control over the defending nation state, thereby debilitating the defending nation states. This debilitation can take the form of death of soldiers or the destruction of the defending nation state's resources.  It has to be instrumental. The act of war has to have a means and an end. Generally, physical violence or the threat of force is the means. The end is to force the enemy to accept the offender's will, or to render one opponent defenceless. In terms of the hypotheses listed in Section 1.1, causes 2, 3 and 4 addresses the means of war, whilst cause 1 and 5 addresses the end of war.  It has to be political. While the motivation for war might include a variety of factors, ultimately it has to be government sanctioned and can thus be considered as political. Therefore, war's larger purpose is always political in nature. It transcends the use of force and is never an isolated act. Therefore, a political entity or a representative of a political entity has to have an articulated intention that has to be transmitted to the adversary at some point during the confrontation. In terms of the hypotheses listed as causes for traditional warfare, cause 3 relates to politics.

Metrics for Traditional Warfare

The hypotheses in Section 1.1 and the supporting elements in Section 1.2 can be concatenated into five factors, considered as metrics for predicting traditional warfare. These five factors are presented as the following formula for predicting the possibility of traditional warfare: In order to predict the possibility of traditional warfare, three conditions need to be met. These conditions are:

 Condition 1: The offending nation state needs to have political power fluctuations present, including a political purpose and non-isolated events.

 Condition 2: The potential for lethality needs to be present.  Condition 3: This condition is complex with three sub conditions (either the first two sub conditions need to be true, or the third sub condition needs to be true):

─ Sub condition 1: The offending nation state needs to have false optimism regarding its own capability. ─ Sub condition 2: The offending nation state needs to believe that their actions will lead to an advantageous position, often due to cumulative resources. ─ Sub condition 3: The offending nation state needs to believe that the war will be an easy conquest, referring to the target's capability.

The next section aims to apply the formula for predicting the possibility of traditional warfare to cyber warfare, in an attempt to identify a set of criteria specific to the cyber domain to aid in the prediction of cyber warfare probability.

Defining Cyber Warfare

Cyber warfare is a contentious topic, with no agreement on whether this is a real possibility or an unrealistic extension of the physical battlefield. Regardless of this ongoing debate, however, the cyber domain is playing a definite role in warfare. Whether it is a full blown Denial of Service attack, hacking attempt or the use of secured online communication to discuss strategy and tactics, technology has a definite place in the warfare domain. Accordingly, cyber warfare can be seen as both offensive and defensive operations against information resources, conducted because of the potential value that information resources have to people [START_REF] Van Niekerk | The Information Warfare Life Cycle Model[END_REF]. This section will look at the definition of cyber warfare, before mapping the formula for predicting the possibility of traditional warfare to cyber warfare. Legally, there is no concept such as cyber war. The United Nations Charter specifies when a nation state can use force in self-defence against an act of aggression, but this refers only to armed conflict [START_REF] Carr | Inside Cyber Warfare[END_REF], see Condition 1. To complicate this further, there is no such thing as a digital only war. It is therefore not accurate to assume that cyber war is a war fought only in the cyber domain, only between cyber elements [START_REF] Filiol | Operational aspects of cyberwarfare or cyberterrorist attacks: What a truly devastating attack could do[END_REF]. "Although cyberspace is a man-made domain, it has become just as critical to military operations as land, sea, air and space" [START_REF] Rid | Cyber war will not take place[END_REF]. Therefore, it is understandable that some entities claim that cyber war is the fifth domain of warfare (after land, sea, air and space) [22]. For the purpose of this paper, the Oxford Dictionaries [START_REF]Cyberwar[END_REF] definition of cyber war is adopted:

The use of computer technology to disrupt the activities of a state or organisation, especially the deliberate attacking of communication systems by another state or organisation.

The impact that cyber warfare has, however, is indisputable. Already in 1995 the following statement were made by Chinese Major General Wang Pufeng: "In the near future, information warfare will control the form and future of war. We recognize this developmental trend of information warfare and see it as a driving force in the modernization of China's military and combat readiness. This trend will be highly critical to achieving victory in future wars." [START_REF] Knapp | Cyber-Warfare Threatens Corporations: Expansion into Commercial Environments[END_REF].

2.1

Acts of Cyber aAggression

As in traditional warfare, each war consists of several battles, i.e. no attack is isolated (refer to Condition 1). In the cyber domain, these battles are referred to as acts of cyber aggression. Currently, there is no international treaty in place that establishes a legal definition for an act of cyber aggression. However, research by Carr [START_REF] Carr | Inside Cyber Warfare[END_REF] reasons that these acts include:

 Cyber attacks against government or critical civilian websites or network without accompanying military force.  Cyber attacks against government or critical civilian websites or network with accompanying military force.  Cyber attacks against internal political opponents.  Cyber intrusions intro critical infrastructure and networks.  Acts of cyber espionage.

While a variety of factors can be added to the list, it can be argued that the categories listed by Carr is fairly comprehensive. For example, the global worker is irrelevant since any action from the worker would fall into the categories defined by Carr.

According to research done by Filiol [START_REF] Filiol | Operational aspects of cyberwarfare or cyberterrorist attacks: What a truly devastating attack could do[END_REF], acts of cyber aggression have five definite characteristics. Although these characteristics are generic enough to be applicable to any cyber related act, these characteristics form the foundation of the discussion of cyber aggression..  Dematerialisation. Anonymity is a key factor in cyber war since true anonymity is a sought after skill in itself. By achieving anonymity, the attackers actually showcase how easily they can perform an action without detection. Therefore, the true origin of the attack must remain hidden, and it must be possible to wrongly frame an innocent party as the perpetrator of the attack. Although the potential level of anonymity may give attacking nations the courage to take appropriate risk in an attack, the anonymity will not get the message of superior cyber-warfare capability across. Therefore, from a military perspective, the main interest is to avoid or delay the target reaction by misleading it (refer to Sub conditions 2 and 3).  Cancelling time and space limits. By extending the war domain, this serves as a strong barrier for the attacker. All traditional restrictions are removed from the planned attack, making the potential scope for attack much bigger. Network connections will make it possible to have immediate access from anywhere and at any time (refer to Sub condition 2).  Gaining control over time and space, over physical resources. The aim of war is to gain such control over the physical world in order to use these resources to the maximum benefit of the cyber war's intended outcome (refer to Condition 2 and Sub condition 2).  Exploit the complexity, interdependencies of modern systems. The attacking nation does not have to directly attack the target, but rather attack unsecured targets which have some kind of interdependencies on the actual target. E.g. by attacking transportation facilities, critical infrastructure, etc. not only the government but also the civilians are inconvenienced. The affected civilians will, in turn, put in-creasing pressure on the originally intended target, the government (refer to Sub condition 3).  Exploit generalised intelligence. The aim is to openly collect a large amount of possible useless or common data and compile in order to have significant and deep knowledge of a given target (refer to Condition 1 and Sub condition 3).

The Status of Current Information Security Metrics

To measure information security a holistic approach needs to be followed. In an attempt to organise and structure information security measurements, the MITRE Corporation has defined several key areas that are affected by any measurement in cyber security readiness. Therefore, all the categories in Error! Reference source not found. need to be taken into account due to the complexity of information interaction points. As such, it becomes a complicated process to measure all these categories accurately. This often results in false optimism (Sub condition 1) about the status of information security management within a nation state, and the ability of a nation state to protect against potential cyber attacks. In addition, this false optimism can also lead to an easy conquest (Sub condition 3), if a nation state overestimates its own cyber abilities (refer to Section 1.3).

Fig. 1. Categories affecting information security [16]

Metrics for information security currently fall into two areas: high level metrics that assess what a nation is investing in via policy and response teams, and on a more technical side, measurements for the vulnerability of software/devices/services. Both types of metrics can be measured: the high level metrics through research such as the Cyber Readiness Index (CRI) and technical metrics through applying standards such as Common Vulnerability and Exposures (CVEs) to applications/devices/services. Technical difficulties in the measurement of either exist that does not just affect individual nations but is a global area of concern. It is therefore important to distinguish between the two areas of measurement and factor in both, since taking either into account in isolation can lead to incorrect assumptions regarding the state of a nation state's information security posture.

Cyber Readiness Index

The CRI examined 35 countries that have embraced ICT and the Internet to evaluate each country's maturity and commitment to cyber security across five essential elements. These elements were identified based on where cyber security can be used to protect the value and integrity of previous ICT investments and enable the Internet economy [START_REF] Hathaway | Cyber readiness index 1.0[END_REF]. The five essential elements are:

 Articulation and publication of a National Cyber Security Strategy. The country has to have articulated and published a National Cyber Security Strategy that describes the threats to the country and outlines the necessary steps, programmes and initiatives that must be undertaken to address the threat. In fulfilling this element, the country has to address the percentage of Gross Domestic Product (GDP) embraced by the plan, identify commercial-sector entities affected by and responsible for implementation of the plan as well as critical services, and establish continuity of service agreements for each critical service [START_REF] Hathaway | Cyber readiness index 1.0[END_REF]. This element links to Sub conditions 1 and 2.  Operational Computer Emergency Response Team (CERT) or Computer Security Incident Response Team (CSIRT). To facilitate national incident response in the event of natural disasters or man-made disasters that affect critical services and information infrastructures, a CERT/CSIRT should be in place. In fulfilling this element, the country has to publish an incident response plan for emergencies and crises, put in place incident management, resiliency and recovery capabilities for critical services and information infrastructures, and have a network of national contact points for governmental and regulatory bodies [START_REF] Hathaway | Cyber readiness index 1.0[END_REF]. This element links to Sub condition 2.  Demonstrate commitment to protect against cyber crime. The country's involvement with international treaty agreements is assessed by means of treaty ratification. By ratifying a treaty, a country has an obligation and right under international law to uphold its political commitment. In fulfilling this element, the country needs to determine what percentage of GDP is affected by cyber crime, prepare an annual threat assessment to government and critical infrastructure networks, establish criminal offenses under its domestic law for cyber actions against computer systems, networks and computer data, and review existing laws and regulatory governance mechanisms applicable to cyber crime [START_REF] Hathaway | Cyber readiness index 1.0[END_REF]. This element links to Condition 1 and Sub condition 2.  Information sharing mechanism. An information sharing mechanism needs to be in place to enable the exchange of actionable intelligence/information between government and industry. In fulfilling this element, the country needs to have mechanisms in place for cross-sector incident-information sharing, have a rapid assistance mechanism and have the ability to declassify intelligence information and share it with rest of government and critical industries [START_REF] Hathaway | Cyber readiness index 1.0[END_REF]. This element links to Condition 1.  Investment in cyber security research and funding of cyber security initiatives. The country needs to invest in cyber security basic and applied research (innovation) and be funding cyber security initiatives broadly. In fulfilling this element, the country needs to dedicate a specified percentage of GDP (or government budget) to cyber security research and development, determine the research/production conversion and commercial adoption rate of research programmes, have universities offer a degree program in cyber security, have a commitment to interoperable and secure technical standards, determined by internationally recognized standards bodies, as well as a commitment to protect intellectual property, including commercial trade secrets, from theft [START_REF] Hathaway | Cyber readiness index 1.0[END_REF]. This element links to Sub condition 1.

While the CRI provides guidelines on how to assess the state of a nation's cyber security readiness, it remains a complex and daunting task. Defining a single metric to quantify the impact that people, software and systems have on cyber security is also highly improbable due to the number of factors involved in the process [START_REF] Boehme | On metrics and measurements in Dependability metrics: Advanced lectures[END_REF]. As a result of the mentioned uncertain nature and the varying fields affected by cyber security, a proliferation of adopted measurements has emerged (refer to Error! Reference source not found.). It is thus clear that some form of formalised structure is emerging in the information security community to standardise the way information security is measured and represented. This is a crucial step towards effectively measuring the security posture of an organisation and even on a larger scale a country.

Common Vulnerability and Exposures

One of the most frequently used metrics is the CVE metric as depicted in Error! Reference source not found.Error! Reference source not found.. CVEs are used to assess the security of software on a computer/device by disclosing specific vulnerabilities discovered in a structured format. While the metric is useful in describing a potential vulnerability that exists for a given software system, several shortcomings exist. While CVEs have a clearly defined structure making it useful to communicate to various individuals, the data entered into the respective fields are still very subjective and controlled by the creator of the specific CVE [START_REF] Allodi | How CVSS is DOSsing your patching policy and wasting your money[END_REF]. This opens up the potential for wrongful classification of a severity that could indicate that a device has a critical vulnerability when in fact the device is safe. This links to Sub condition 1.

Fig. 2. CVE example

The uncertainty regarding the CVE critical score is but one of the problems with current measurements available. Several other factors such as the vulnerability recorded might simply be the by-product of an even bigger vulnerability that the researcher have missed. A further factor is that no single organisation controls the complete set of all available CVEs [START_REF] Christey | Buying into the bias: Why vulnerability statistics suck[END_REF] and more importantly, the individual CVEs are contributed by the security community. This leads to duplication, differences in measurements and the possibility of software with severe vulnerabilities being completely missed. This links to Condition 1. Even if all of the inconsistencies and inaccuracies are ignored and trust is placed in a reputable vendor, further technical challenges await. Work conducted by Espinahara and Eduardo [START_REF] Espinahara | Lost in translation[END_REF] highlight just how inaccurate even the most sophisticated current information security assessment software can be. While the software works fine when the language is set to English, a simple change of system language can render the vulnerability scanner nearly useless. In essence this means that any measurement currently performed on non English computer systems has the potential to be grossly inaccurate. Furthermore, vulnerability scanners can mostly only identify vulnerabilities related to software while previously it was made clear that information security spans a whole range of categories that need to be taken into account.

While the use of CVEs proves to be useful in measuring some information security aspects, this method does not guarantee complete information security protection. There are many factors that can result in negative or skewed metric results. As a result, CVEs is not a fool proof method of measurement.

Mapping Traditional Warfare Metrics to Cyber Warfare

This section maps the traditional warfare factors identified in Section 1.3 to the cyber domain. This mapping is done in aid of developing a cyber military doctrine and establishing metrics to measure information security damage and potentially measure of loss due to cyber warfare. The aim is to prove the validity of the formula presented in Section 1.3 within the cyber domain. In proving this validity, each of the tradition-al warfare conditions needs to be discussed in terms of the cyber (information security) domain. It should be noted that this mapping process is not straightforward since the Internet and cyber domain is largely intangible and therefore difficult to map to the real world traditional warfare domain.

Condition 1: Political Power Fluctuations

The offending nation state needs to have political power fluctuations present. For this condition to be true, the cyber actions should contribute to the nation state's political power fluctuations to some degree.

Especially since 2010's start of the Arab Spring, digital tools such as YouTube, Twitter and Facebook have defined many social movements by giving rise to a new generation of activism. In many of these uprisings, the Internet, mobile phones and social media played a pivotal role in the organising of protests by activists. Public information supplied by social networking websites has played an important role during modern-day activism, especially since it is employed as a key tool in expressing thoughts concerning unjust acts committed by the government [START_REF] Kassim | Twitter revolution: How the Arab Spring was helped by social media[END_REF]. In addition, "digital media has been used by many protestors to exercise freedom of speech and as a space for civic engagement" [START_REF] Pewresearch | The role of social media in the Arab uprisings[END_REF]. In this sense, freedom of speech can be classified as the political right to communicate one's opinions and ideas using one's body and property to anyone who is willing to receive them.

In addition, work done by Collier and Hoeffler, Collier et al. and Arnson (in [START_REF] Baten | Does inequality lead to civil wars? A global long-term study using anthropometrics indicators (1816-1999)[END_REF]) have identified a link between civil wars and grievances such as inequality or a lack of political rights. It is believed that, although resources are central to the duration and intensity of war, the roots and objectives of war are often founded in politics. In the cyber domain, the high availability of Internet-based, low-cost cyber-weapons that can target civilian information assets has become a growing threat to the economic and political stability of modern societies that depend on today's information infrastructures [START_REF] Knapp | Cyber-Warfare Threatens Corporations: Expansion into Commercial Environments[END_REF]. In the cyber domain, political power fluctuations are extremely prevalent since the Internet is an artificial environment that can be shaped in part according to national security and political requirements. In addition, cyber attacks are flexible enough to be effective for information warfare and propaganda, espionage, and the destruction of critical infrastructure [START_REF] Schreier | On cyberwarfare[END_REF].

Condition 2: Potential for Lethality

For this condition to be true, the cyber actions should have the potential for lethality for at least one of the acts of cyber aggression. By extension of the definition for aggression (feelings of anger or antipathy resulting in hostile or violent behaviour, readiness to attack or confront), any act of cyber aggression can be regarded as having the potential for lethality. The acts of cyber aggression as identified by Carr [START_REF] Carr | Inside Cyber Warfare[END_REF], can be explained in the cyber domain as follows:

 Cyber attacks against government or critical civilian websites or network without accompanying military force. The recent breach of the South African Police's (SAPS) whistle-blowers' web portal is an example of a major cyber attack against a government. The dumped data contained numerous personally identifia-ble records that could lead to the identification of people who have provided information to the SAPS in confidence.  Cyber attacks against government or critical civilian websites or network with accompanying military force. Many high-profile cyber-attacks initially targeted the military. For example, the 1986 Cuckoo's Egg incident had Clifford Stoll tracking German hackers who were scouring American military systems. In 1994, hackers infiltrated Griffis Air Force Base computers to launch attacks at other military, civilian and government organisations [START_REF] Knapp | Cyber-Warfare Threatens Corporations: Expansion into Commercial Environments[END_REF].  Cyber attacks against internal political opponents. If technology is utilised in internal political agendas, it is a real possibility that digital acts can result in physical violence. For example, the Tunisian part of Arab Spring saw Internet censorship, data harvesting by the government, laws restricting online freedom of expression and hactivism (as performed by Anonymous' Operation Tunisia). These online actions had a very tangible violent outset.  Cyber intrusions into critical infrastructure and networks. Critical infrastructure protection is a crucial part of cyber protection, as was illustrated by the Stuxnet attack. If a nation state's national critical infrastructure is attacked, it can have a devastating impact on most aspects of civilians' lives, including transport, communication, water and sanitation, etc. For example, if the transport sector is affected, it would have an impact on all emergency services, since no fire brigade or ambulance would be able to perform their duties. If the communication sector is affected, it could potentially lead to large scale hysterics, since people will be unable to contact their friends and families. These scenarios have the potential for lethality.  Acts of cyber espionage. Few nations can claim to not have been affected by some form of cyber espionage, either by participation or by victimisation [START_REF]The 2013 Data Breach Investigations Report[END_REF]. Documents that were released by whistle-blower Edward Snowden have revealed just how prevalent cyber espionage is. These documents claim that the United States' PRISM program is capable of indiscriminately intercepting and analysing information received from email, phone and video. Similarly, the United Kingdom has admitted to spying on delegates for the G20 international summit in London 2009 [21]. In the APT1 report, the Mandiant group documents their search for a Chinese hacker group that has launched a massive espionage network affecting nations on all continents [START_REF] Mandiant | Exposing One of China's Cyber Espionage Units[END_REF]. Figures from the report reveal that as much as four Terabytes of data has been exfiltrated from a single company; this is reckoned as the longest active backdoor found: four years and three months.

Condition 3: Needs of the Offending Nation State

For this condition to be true, either both the first two sub conditions, or the third sub condition needs to be true.

Sub Condition 1: False Optimism

The offending nation state needs to have false optimism regarding the outcome of the war. This condition is two-fold. Many cyber incidents receive little or no public acknowledgment [START_REF] Knapp | Cyber-Warfare Threatens Corporations: Expansion into Commercial Environments[END_REF]. As such, people are often not informed about the actual extent and implications of cyber attacks. For example, at the time of writing, very little statistics are available for cyber crime in South Africa. This is largely due to the fact that no legislation is in place that obliges victims to report the crimes. There are a number of initiatives that allows for the reporting of crime in South Africa, but few of these cater for the reporting of cyber related crimes. As such, many crimes go unreported and the resultant available statistics are often skewed.

In addition, the enormous proliferation of technology and hacker tools makes it impossible to be familiar with all of the technology advances. Software updates and network reconfigurations also increase the unpredictability of the battlespace of cyber conflict with little or no warning [START_REF] Schreier | On cyberwarfare[END_REF]. As such, it becomes easy to have false confidence in one's cyber abilities, and accordingly, the outcome of a cyber war (refer to Section 3).

Sub Condition 2: Actions Lead to an Advantageous Position

The offending nation state needs to believe that their actions will lead to an advantageous position. Towards this end, the Internet has a number of salient characteristics that makes it a powerful tool in achieving this perceived advantage [START_REF] Delany | Online Politics: The Tools and Tactics of Digital Political Advocacy[END_REF]. These are:

 Reach. The Internet has a global reach, with 2,405,518,376 Internet users in more than 233 countries worldwide [START_REF]Internet usage statistics -The internet big picture[END_REF]. This greatly enhances the potential for cumulative resources.  Ease. Anyone with an Internet connection can become a cyber warrior or unwittingly allow their computer to be used as part of a zombie network.  Anonymity. The Internet allows users to be completely anonymous, often giving people more confidence to say or do what they want online.

Sub Condition 3: Easy Conquest

In order for an offending nation state to believe that the war will be an easy conquest, the CRI can be used as measurement tool of cyber power on a governance level (refer to Section 3). Not only can the CRI be used to assess a nation state's own cyber capability to perform a cyber attack, but the target nation state's CRI can be assessed to predict the ease with which such a cyber attack will be performed and the technical skills with which the target will receive the attack and retaliate. In contrast with the process for traditional warfare, the proximity of adversaries is determined by connectivity and bandwidth, not terrestrial geography [START_REF] Schreier | On cyberwarfare[END_REF] 5

Testing the Formula for Predicting Cyber Warfare

In order to test the applicability of the formula for predicting warfare in the cyber domain, the validity of the conditions will be tested for the Israeli-Palestinian cyber conflict that took place between July 1999 and April 2002. A similar test was done to test the formula on the Estonia cyber conflict. However, due to limited space, the rationale was not included in the article.

Condition 1: Political Power Fluctuations

In September 2000, Israeli teenage hackers created a website to jam Hezbollah and Hamas websites in Lebanon. The teenagers launched a sustained Distributed Denial of Service attack that effectively jammed six websites of the Hezbollah and Hamas organisations and the Palestinian National Authority. In response, Palestinian and other supporting Islamic organisations called for a cyber Holy War. Hackers struck three high-profile Israeli websites belonging to the Israeli Parliament, the Ministry of Foreign Affairs, and the Israeli Defence Force information site. They also targeted the Israeli Prime Minister's Office, the Bank of Israel and the Tel Aviv Stock Exchange [START_REF] Schreier | On cyberwarfare[END_REF]. By targeting political entities and by calling this war a cyber Holy War, the first condition of political power fluctuations can be considered as true, since there is a political undertone and a number of non-isolated acts occurred.

Condition 2: Potential for Lethality

As illustrated in Section 4.2, any attack on critical infrastructure has the potential for lethality. During the Israeli-Palestinian cyber conflict, attacks were made against companies providing telecommunications infrastructure [START_REF] Schreier | On cyberwarfare[END_REF]. Therefore, the condition of lethality potential can be considered as true.

Condition 3: Needs of the Offending Nation State

For this condition to be true, either both the first two sub conditions, or the third sub condition needs to be true.

Sub Condition 1: False Optimism

By January 2001, the Israeli-Palestinian cyber conflict had struck more than 160 Israeli and 35 Palestinian websites; 548 Israeli domain websites were defaced [START_REF] Schreier | On cyberwarfare[END_REF]. These conquests could potentially give both sides false optimism in terms of their chances of victory, rendering the first sub condition true.

Sub Condition 2: Actions Lead to an Advantageous Position

Palestinian hackers defaced an Internet Service Provider and left a message claiming that they could shut down the Israeli ISP NetVision, which hosts almost 70 percent of all the country's Internet traffic [START_REF] Schreier | On cyberwarfare[END_REF]. By disabling the opponent's Internet access, the Palestine side rendered the sub condition of performing actions to lead to an advantageous position true.

Sub Condition 3: Easy Conquest

In 2013, Israel's networked readiness index is ranked 15th up from rank 20 in 2012, whilst Palestine does not feature on the index. This year's index coverage includes a 144 economies, accounting for over 98 percent of global GDP. This presents an interesting point to consider that it could be possible for countries to not participate in such rankings and effectively allow potential aggressor nation states to believe that they are easy prey, whilst obfuscating their offensive cyber capabilities until it was too late.

Formula for Predicting Cyber Warfare

Based on the discussions above, the following conditions for predicting the possibility of cyber warfare are met: From this case study, it can be argued that the Israeli-Palestinian cyber conflict adheres to all the requirements to enable the early prediction of this cyber war.

Conclusion

Currently the only concrete way of measuring the status of the cyber domain is located in traditional information security techniques whether it be on a technical or policy level. While applicable, the measurements do not adequately describe loss, posture or any of the pre-requisites found in traditional warfare. Although it is possible to perform an analysis of characteristics of the ICT society with regard to domination threats, economic sustainability, etc., these measurements have not yet been employed according to the literature survey performed by the authors. Accordingly, this article aimed to provide evidence towards the probability of predicting and mapping traditional warfare measurements to the cyber warfare domain. As such, this article worked to find an alternative way of predicting the possibility of cyber warfare, since traditional information security measurements are not adequate.

The article looked at current information security metrics, the CRI and CVEs, and provided an alternative method of predicting the probability of cyber warfare. A formula predicting the possibility of traditional warfare was articulated based on existing literature. The conditions for this formula were mapped to cyber warfare theory to prove the validity of this formula in the cyber domain. In addition, this formula was tested by applying it to the Israeli-Palestinian cyber conflict. This conflict is generally accepted as a cyber warfare incident. As such, the conditions are met by the acts of cyber aggression to affirm that cyber warfare took place. This article showed that the formula can be applied to the cyber domain. The value of this formula lies in the potential for pre-emptively identifying potential cyber war incidents. By pro-actively analysing global news and especially citizen journal journalism through social media platforms for indicators of the elements of the formula for predicting the possibility of cyber warfare, it may be possible to predict to occurrence of potential cyber war incidents, and as such, limit the potential damage caused, if the incidents cannot be prevented in totality. This extraction of collective intelligence falls beyond the scope of this article, but can be considered for future work in extending the formulate for predicting the possibility of cyber warfare.

  Possibility of cyber warfare = Nation state political power fluctuations AND Potential for lethality AND ((False optimism AND Offending nation state advantage)


Francois Mouton
email: moutonf@gmail.com

Louise Leenen
email: lleenen@csir.co.za

Mercia M Malan
email: malan747@gmail.com

H S Venter
email: hventer@cs.up.ac.za

Towards an Ontological Model Defining the Social Engineering Domain

Keywords: Bidirectional Communication, Compliance Principles, Indirect Communication, Ontology, Social Engineering Attack, Social Engineering Attack Ontology, Social Engineering Definitions, Social Engineering History, Taxonomy, Unidirectional Communication

The human is often the weak link in the attainment of Information Security due to their susceptibility to deception and manipulation. Social Engineering refers to the exploitation of humans in order to gain unauthorised access to sensitive information. Although Social Engineering is an important branch of Information Security, the discipline is not well defined; a number of different definitions appear in the literature. Several concepts in the domain of Social Engineering are defined in this paper. This paper also presents an ontological model for Social Engineering attack based on the analysis of existing definitions and taxonomies. An ontology enables the explicit, formal representation of the entities and their inter-relationships within a domain. The aim is both to contribute towards commonly accepted domain definitions, and to develop a representative model for a Social Engineering attack. In summary, this paper provides concrete definitions for Social Engineering, Social Engineering attack and social engineer.

Introduction

Social Engineering (SE) is focused on the exploitation of a human in order to gain unauthorised access to information and falls under the umbrella of the Information Security spectrum. Humans are the focal point of most organisations but they also pose a risk to their organisations. An organisation's sensitive information places them at risk if it falls in the wrong hands. Examples of sensitive information are the secret recipe that gives the Kentucky Fried Chicken meals their distinctive flavour or the personal banking information of clients.

Although organisations usually employ advanced technical security measures to minimise opportunities for unauthorised individuals to gain access to that information, it is vital that they consider the risk of their staff members falling victim to SE attacks. Humans often react emotionally and thus may be more vulnerable than machines at times. An organisation with sensitive information's biggest threat is not the technical protection, but the people who form the core of the organisation. Attackers have realised that it is easier to gain unauthorised access to the information and communications technology infrastructure of an organisation through an individual, rather than trying to penetrate a security system.

In a 1995 publication, the authors Winkler and Dealy posit that the hacker community has started to define SE as "the process of using social interactions to obtain information about a victim's computer system." [START_REF] Winkler | don't rely on it: A case study in social engineering[END_REF]. The most popular definition of SE is the one by Kevin Mitnick who defines it as "using influence and persuasion to deceive people and take advantage of their misplaced trust in order to obtain insider information" [START_REF] Mitnick | The art of deception: controlling the human element of security[END_REF].

An individual may be at the risk of exposing his or her own personal information to a social engineer. It is also the case that more and more individuals are exposed to electronic computing devices as the costs of these devices are decreasing drastically. Electronic computing devices have become significantly more affordable during the past few years and due to this nearly everyone has access to these devices. This provides the social engineer with more victims to target using skillfully crafted SE attacks.

Social engineers use a variety of techniques to manipulate their victims with the goal of extracting sensitive information from them. The title of Kevin Mitnick's book, The art of deception: controlling the human element of security, suggests that SE can be seen as an art of deception [START_REF] Mitnick | The art of deception: controlling the human element of security[END_REF].

Various articles define SE and give descriptions of an SE attack. The definitions are diverse and often reflect one aspect of an approach relevant to a particular research project. Commonly agreed upon definitions that include all the different entities in SE are required. The purpose of this paper is to craft definitions and develop an ontological model for SE. Several papers, each with a different view on SE, have been studied and analysed to develop this model.

An ontology is a technology that allows for a formal encoded description of a domain and allows for the representation of semantic information: all the entities and their inter-relationships can be defined and represented. It also has powerful reasoning capabilities [START_REF] Uschold | Ontologies and semantics for seamless connectivity[END_REF]. The ontological model presented in this paper will be implemented in future to provide an SE ontology.

The rest of this paper is structured as follows. Section 2 provides a background on different existing SE definitions and proposes more structured definitions for terms within the domain of SE. Section 3 discusses some existing taxonomies for the SE domain. Section 4 expands on the definitions provided in section 2 by providing an SE attack classification model as well as an ontological model for SE attacks. Section 5 concludes the paper by providing a summary of the contributions.

Defining Social Engineering

The earliest literature that the authors found on SE is an article by [START_REF] Quann | The hack attack -increasing computer system awareness of vulnerability threats[END_REF] [START_REF] Quann | The hack attack -increasing computer system awareness of vulnerability threats[END_REF]. According to these authors SE, whilst still in its infancy, is seen as "an attempt to exploit the help desks and other related support services normally associated with computer systems" [START_REF] Quann | The hack attack -increasing computer system awareness of vulnerability threats[END_REF]. SE was later described as "trickery and deceit, also known as Social Engineering", according to [START_REF] Kluepfel | Foiling the wiley hacker: more than analysis and containment[END_REF] [START_REF] Kluepfel | Foiling the wiley hacker: more than analysis and containment[END_REF][START_REF] Kluepfel | In search of the cuckoo's nest [computer security[END_REF]. Even in one of the most prominent hacker magazines, the 2600: The Hacker Quarterly1 , the term Social Engineering was not widely used. One of the articles entitled, "Janitor Privileges", explains in great detail how to perform an SE attack, however the term Social Engineering is never mentioned in the article [START_REF]Voyager: Janitor privileges[END_REF].

The following definitions of SE illustrate that there exists no single, widely accepted definition:

 "a social/psychological process by which an individual can gain information from an individual about a targeted organization." [START_REF] Thornburgh | Social engineering: the "dark art[END_REF]  "a type of attack against the human element during which the assailant induces the victim to release information or perform actions they should not." [START_REF] Nohlberg | Securing Information Assets: Understanding, Measuring and Protecting against Social Engineering Attacks[END_REF]  "the use of social disguises, cultural ploys, and psychological tricks to get computer users to assist hackers in their illegal intrusion or use of computer systems and networks." [START_REF] Abraham | An overview of social engineering malware: Trends, tactics, and implications[END_REF][START_REF] Erbschloe | Trojans, worms, and spyware: a computer security professional's guide to malicious code[END_REF]  "the art of gaining access to secure objects by exploiting human psychology, rather than using hacking techniques." [START_REF] Boshmaf | The socialbot network: when bots socialize for fame and money[END_REF][START_REF] Boshmaf | Design and analysis of a social botnet[END_REF]  "an attack in which an attacker uses human interaction to obtain or compromise information about an organization or its computer system." [START_REF] Kvedar | The use of formal social engineering techniques to identify weaknesses during a computer vulnerability competition[END_REF][START_REF] Mcdowell | Cyber security tip st04-0141, avoiding social engineering and phishing attacks[END_REF][START_REF] Cruz | Social engineering and awareness training[END_REF][START_REF] Culpepper | Effectiveness of using red teams to identify maritime security vulnerabilities to terrorist attack[END_REF]]  "a process in which an attacker attempts to acquire information about your network and system by social means." [START_REF] Mills | Analysis of a social engineering threat to information security exacerbated by vulnerabilities exposed through the inherent nature of social networking websites[END_REF][START_REF] Doctor | CompTIA A+ Complete Study Guide[END_REF]  "a deception technique utilized by hackers to derive information or data about a particular system or operation." [START_REF] Hamill | Evaluating information assurance strategies[END_REF][START_REF]Joint Chiefs of Staff: Information assurance: Legal, regulatory, policy and organizational legal, regulatory, policy and organizational considerations[END_REF][START_REF] Hamill | Modeling information assurance: A value focused thinking approach[END_REF]]  "a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures." [START_REF] Braverman | Behavioural modelling of social engineering-based malicious software[END_REF]  "a hacker's manipulation of the human tendency to trust other people in order to obtain information that will allow unauthorized access to systems." [START_REF] Åhlfeldt | Security issues in health care process integration? a research-in-progress report[END_REF][START_REF] Granger | Social engineering fundamentals, part i: Hacker tactics[END_REF]  "the science of skilfully manoeuvring human beings to take action in some aspect of their lives." [START_REF] Schoeman | Social recruiting: a next generation social engineering attack[END_REF][START_REF] Hadnagy | Social Engineering: The Art of Human Hacking[END_REF]  "Social Engineering, in the context of information security, is understood to mean the art of manipulating people into performing actions or divulging confidential information." [START_REF] Espinhara | Using online activity as digital fingerprints to create a better spear phisher[END_REF]  "the act of manipulating a person or persons into performing some action." [START_REF] Nemati | Pervasive Information Security and Privacy Developments: Trends and Advancements[END_REF][START_REF] Mcquade | Understanding and managing cybercrime[END_REF]  "using subversive tactics to elicit information from end users for ulterior motives." [START_REF] Spinapolice | Mitigating the risk of social engineering attacks[END_REF]  "using influence and persuasion to deceive people and take advantage of their misplaced trust in order to obtain insider information." [START_REF] Mitnick | The art of deception: controlling the human element of security[END_REF][START_REF] Lenkart | The vulnerability of social networking media and the insider threat new eyes for bad guys[END_REF][START_REF] Bezuidenhout | Social engineering attack detection model: Seadm[END_REF][START_REF] Mouton | Development of cognitive functioning psychological measures for the seadm[END_REF][START_REF] Mouton | Social engineering from a normative ethics perspective[END_REF]]  "the use of social disguises, cultural ploys, and psychological tricks to get computer users to assist hackers in their illegal intrusion or use of computer systems and networks." [START_REF] Kingsley Ezechi | Detecting and combating malware[END_REF] These definitions specify different ideas as to what SE involves. Two of these definitions specifically focus on gaining information from an organisation [START_REF] Thornburgh | Social engineering: the "dark art[END_REF][START_REF] Kvedar | The use of formal social engineering techniques to identify weaknesses during a computer vulnerability competition[END_REF][START_REF] Mcdowell | Cyber security tip st04-0141, avoiding social engineering and phishing attacks[END_REF][START_REF] Cruz | Social engineering and awareness training[END_REF][START_REF] Culpepper | Effectiveness of using red teams to identify maritime security vulnerabilities to terrorist attack[END_REF]. Several of the definitions define SE as the manipulation and persuasion of people in order to get information or to persuade someone to perform some action. Furthermore, some of the definitions are formed around gaining access to computer systems and networks. The only element that all of these definitions have in common is that a human is exploited in order to gain some unauthorised information or perform some action.

The authors of this paper propose the following definitions:

 Social Engineering: The science of using social interaction as a means to persuade an individual or an organisation to comply with a specific request from an attacker where either the social interaction, the persuasion or the request involves a computer-related entity.  Social engineer (noun): An individual or group who performs an act of Social Engineering.  Social engineer (verb): To perform an act of Social Engineering. When the verb is used in the Past Perfect form, it means a successful Social Engineering attack has occurred. For example, "The target may not know that he or she has been social engineered."  Social Engineering attack: A Social Engineering attack employs either direct communication or indirect communication, and has a social engineer, a target, a medium, a goal, one or more compliance principles and one or more techniques.

Section 4.2 elaborates more on these definitions. Apart from the several definitions available for SE, there are also various taxonomies which try to encapsulate SE and the structure of an SE attack. In existing literature, a few taxonomies were proposed to provide some structure to the domain of SE. All of these taxonomies have inherent flaws in them and these flaws are discussed in the following section.

Existing Taxonomies

Several taxonomies are studied and discussed in this section: Harley [START_REF] Harley | Re-floating the titanic: Dealing with social engineering attacks[END_REF], Laribee [START_REF] Laribee | Development of methodical social engineering taxonomy project[END_REF], Ivaturi & Janczewski [START_REF] Ivaturi | A taxonomy for social engineering attacks[END_REF], Mohd et al. [START_REF] Mohd Foozy | Generic taxonomy of social engineering attack[END_REF] and Tetri & Vuorinen [START_REF] Tetri | Dissecting social engineering[END_REF].

Harley

Harley [START_REF] Harley | Re-floating the titanic: Dealing with social engineering attacks[END_REF] is one of the first articles to present a taxonomy for the SE domain, and in fact proposes two different taxonomies. The first one defines the following SE techniques and related attacks: Masquerading, Password stealing, Dumpster diving, Leftover, Hoax Virus Alerts and other Chain Letters, Spam and Direct Psychological Manipulation. This taxonomy mixes social compliance principles with techniques.

The second taxonomy defines seven user vulnerabilities: Gullibility, Curiosity, Courtesy, Greed, Diffidence, Thoughtlessness and Apathy. Even though these vulnerabilities are mostly the reasons why individuals are susceptible to SE attacks, they do not specify an SE attack as such. The same SE attack can be performed using more than one of the mentioned vulnerabilities, which clarifies that these vulnerabilities are not the unique establishment of what an SE attack entails. Vulnerabilities of a human, not limited by the seven mentioned above, lead to the susceptibility of an attack.

Laribee

Laribee [START_REF] Laribee | Development of methodical social engineering taxonomy project[END_REF] identifies two different models, namely a trust model and an attack model. According to Laribee, SE is complex and typically requires multiple communications and targets. The two models are meant to be applied, individually or together, at various times to attain each individual attack goal [START_REF] Laribee | Development of methodical social engineering taxonomy project[END_REF]. The trust model describes how the social engineer establishes a trustworthy relationship with the target, whilst the attack model describes how a social engineer performs an information gathering attack. The attack model is limited to four techniques: deception, manipulation, persuasion and influence. In the attack model the social engineer is only able to use one of these techniques. Furthermore, after the technique has been performed, the attack model feeds into the trust model where the aim is to build a trustworthy relationship.

These models are problematic because not all SE attacks require a continuous relationship since there is not always the need to build a trustworthy relationship with the target. A social engineer generally uses a combination of compliance principles and techniques to perform a single SE attack.

Ivaturi & Janczewski

Ivaturi & Janczewski [START_REF] Ivaturi | A taxonomy for social engineering attacks[END_REF] classify an SE attack to be either person-person or to be person-person via media. Person-person is when there is direct communication involving a human, whereas person-person via media involves some medium used to communicate. The medium can be text, voice or video. Person-person attacks involve impersonation. Different techniques are described.

This taxonomy contains a well-defined structure for different SE techniques, as well as the types of attacks in which they are used. It is very similar to the structure of the direct communication part of our model, as further on proposed in section 4.1. Their study only focuses on direct communication and does not further elaborate on a scenario where indirect communication can be used for an SE attack.

Mohd et al.

Mohd et al. [START_REF] Mohd Foozy | Generic taxonomy of social engineering attack[END_REF] classify an SE attack as being either human-based or technical-based. Human-based attacks apply some techniques that are combined to form an attack, such as "in person" and "simple persuasion". The one technique cannot be used without the other. The items they regard as types of attacks are techniques that form a single attack, rather than being used separately as individual attacks.

Their technical-based attacks are mediums used within an SE attack such as "Email, Software, Web sites". Another example is "Denial of Service" which is not an SE attack; it is an attack on a service and brings down a system instead of extracting information from it. The latter effect is the aim of an SE attack.

In summary, the Modh et al. model describes techniques used in SE attacks instead of depicting an SE attack as a whole.

Tetri & Vuorinen

Tetri & Vuorinen [START_REF] Tetri | Dissecting social engineering[END_REF] studied several papers on SE and critically analysed them in order to present an overview of SE. They defined three main dimensions of SE: persuasion, fabrication and data gathering.

Persuasion involves getting someone to comply with an inappropriate request. The paper identifies two features of persuasion: Direct interaction and active engagement between the intruder and the target [START_REF] Tetri | Dissecting social engineering[END_REF]. Fabrication involves techniques such as impersonation and using a false identification document to deceive victims into thinking the attacker is someone else. Data gathering is the process of gaining information from the target.

The authors of this paper agree with Tetri & Vuorinen's description of persuasion although it can be seen as a compliance principle from a psychological perspective. The definitions of fabrication and data gathering on the other hand, are techniques aimed at aiding an SE attack rather than being a phase of an SE attack.

The authors take these taxonomies into account and attempt to improve on these ideas by identifying three different subcategories of an SE attack, as well as, to develop a structured SE attack ontological model. The next section firstly proposes the Social Engineering Attack Classification and then proposes an ontological model for an SE attack.

Ontological Model

In this section the authors motivate and present an ontological model for SE. Subsection 4.1 discusses a classification of an SE attack based on the type of communication that is employed. In subsection 4.2 a broader view is provided which defines the different parts of an SE attack.

Social Engineering Attack Classification

An SE attack, as depicted in Figure1, can be divided into two main categories: An indirect attack and a direct attack.

An indirect attack refers to an incident where a third party medium is used as a way of communicating. Third party mediums typically include physical mediums such as flash drives, pamphlets or other mediums, such as web pages. Communication occurs through third party mediums when a medium is accessed by a target, without direct interaction with the social engineer.

A direct attack is an incident where two or more people are involved in a direct conversation. This conversation can either be one-sided or two-sided. Due to this, this type of attack is further classified into two ways of communicating: Bidirectional or unidirectional communication.

Bidirectional communication is when two or more parties take part in the conversation, in other words, a two-way conversation occurs. Each party consists of an individual, a group of individuals or an organisation. A popular example of an attack in this category is an impersonation attack, where the social engineer impersonates the target in order to gain access to something which the target has access to.

Unidirectional communication is a one-sided conversation where the social engineer communicates with the target, but the target has no means to communicate back with the social engineer. This is normally done through some communication medium such as bulk e-mails or short message service (SMS). An example of a popular attack in this category is an e-mail phishing attack sent from the attacker to the target.

Fig. 1. Social Engineering Attack Classification

The rest of this subsection explains the different categories, bidirectional communication, unidirectional communication and indirect communication, in more detail with an example of each. Each example discusses the various parts of an SE attack, as defined in section 2: a social engineer, a target, a medium, a goal, one or more compliance principles and one or more techniques. Compliance principles are principles used by the attacker, aided by different techniques, in order to persuade the target, through some medium, to comply with a request.

Bidirectional communication (Figure 2) is defined as a two-way conversation between two people. In the bidirectional communication category, the social engineer can either be an individual or a group of individuals. The target of the attack can be an individual or an organisation. The mediums that are frequently used for bidirectional communication are e-mail messages, face-to-face conversations or telephone conversations. Any compliance principle, technique and goal can be used in combination with a bidirectional communication medium.

An example of an SE attack that uses bidirectional communication is one where a social engineer attempts to influence a call centre agent into divulging sensitive information regarding a specific client. In this example, both the attacker and the target are individuals. Pretexting is used as the technique for this attack because the social engineer impersonates the client whose information the social engineer wishes to obtain. The compliance principle used in this example is authority, because the client impersonated by the social engineer acts as if he or she has authorised access to the information. The goal of the attack is to gain unauthorised access to the client's sensitive information.

Fig. 2. Bidirectional Communication

Unidirectional communication (Figure 3) is very similar to bidirectional communication, except that the conversation only occurs in one direction: From the social engineer to the target. The social engineer and the target can either be an individual, a group of individuals or an organisation. The mediums that are frequently used for unidirectional communication are one-way text messages, e-mails or paper mail messages. Any compliance principle, technique and goal can be used in combination with unidirectional communication.

An example of an SE attack that uses unidirectional communication is an e-mail phishing attack where the target places an online order at some online store and waits for delivery of the item. The phishing e-mail is masked as an e-mail from the online store informing the target that a limited offer is available relating to the order. The target recognises the link between the e-mail and his order and clicks on the infected link. The target is specifically chosen. Phishing is the SE technique used for this attack and scarcity is the compliance principle. Since the e-mail states that it is a limited offer, the target feels that he or she has to explore this limited opportunity before it becomes unavailable. The infected link gives the social engineer unauthorised access to the target's computer.

Fig. 3. Unidirectional Communication

Finally, there is indirect communication (Figure 4) which is defined as communication through a third party medium. The social engineer and the target can be either an individual, a group of individuals or an organisation. The mediums that are frequently used for indirect communication are pamphlets, flash drives and web pages. Any compliance principle, technique and goal can be combined with indirect communication.

An example of an SE attack that uses indirect communication is when a social engineer leaves an infected flash drive lying around in a specifically chosen location with the intention of it being picked up by the target. The infection vector on the flash drive opens up a backdoor on the target's computer when inserted into the computer, allowing the social engineer unauthorised access to the computer. In this example the social engineer, as well as the target, are individuals. The technique used for this attack is known as baiting because a physical object is left in visible view of a target. The success of the attack relies on the curiosity level of the target. The compliance principle used is social validation, which states that someone is more willing to comply if they are performing some action they believe to conform to a social norm. The target may feel socially obliged to attempt to find the owner of the lost flash drive. This leads to the target plugging the flash drive into his or her computer which then activates the backdoor and unknowingly grants access to the social engineer. The goal of the attack is unauthorised access to the target's computer.

Social Engineering Attack Ontological Model

The model that is presented in this section has been compiled from various other taxonomies and the authors' classification of SE attacks. The purpose of this ontological model is not just to define the domain but also to form the foundation for an ontology for SE attacks. Our argument is that a taxonomy is too limited to define SE and SE attacks sufficiently. An ontological model provides additional structure to fully define this domain. According to Van Rees (2003), a taxonomy is a hierarchical structure to aid the process of classifying information, while an ontology is a welldefined set of definitions that create a taxonomy of classes and the relationships between them. Van Rees also states that "an ontology resembles both a kind of taxonomy-plus-definitions and a kind of knowledge representation language." [START_REF] Van Rees | Clarity in the usage of the terms ontology, taxonomy and classification[END_REF].

It is clear from the other taxonomies discussed previously, that their authors tend to mix techniques, compliance principles, mediums and phases of an attack. Our ontological model represents each entity of an attack as well as the relationships between entities.

An ontology allows a formal, encoded description of a domain: All the relevant entities, their attributes and their inter-relationships can be defined and represented in a machine-readable model. [START_REF] Gruber | A translation approach to portable ontology specifications[END_REF] defines an ontology as "formal, explicit specification of a shared conceptualisation." [START_REF] Gruber | A translation approach to portable ontology specifications[END_REF]. Noy and McGuinness define an ontology as: "…a common vocabulary for researchers who need to share information in a domain …includes machine-interpretable definitions of basic concepts in the domain and relations among them." [START_REF] Noy | Ontology development 101: A guide to creating your first ontology[END_REF]. Ontologies have automated reasoning facilities that enable the derivation of new information from the facts contained in an ontology.

The model is based on our definition of an SE attack as depicted in Figure 5. We defined a Social Engineering attack (Section 2) to have: The model, in its current state, provides the building blocks to further expand the model into a full ontology. As a future task, when the ontology is built from this model, additional relationships between these classes can be developed and described in detail. One example of a relationship between two classes is performsAttack between the Social Engineer class and the Target class. Our model partially represents our definition of Social Engineer (Section 2): An individual or group who performs an act of Social Engineering. The latter part of the definition requires representation of the verb social engineer and will be presented in the ontology as the relation performsAttack.

Further development of the ontology will be performed as future research.

Conclusion

Organisations usually employ advanced technical security measures to minimise opportunities for unauthorised individuals, however, every organisation has employees who are likely to be susceptible to SE attacks. As electronic computing devices becomes more prevalent, the group of individuals who can be targeted by Social Engineering is increasingly significantly. These reasons motivate why SE is such an important field of research. Although SE is a discipline that enjoys attention, it is still not well defined. This paper provides an overview of several definitions from the literature and shows that many researchers define SE to suit their specific topic of research.

In order for the field of Social Engineering to mature, it is required to have commonly accepted domain definitions. Based on all of the definitions and existing taxonomies that have been examined, this paper proposes both a Social Engineering Attack Classification as well as a Social Engineering Attack Ontological Model.

The Social Engineering Attack Classification divides an SE attack into two classes: a direct attack and an indirect attack. The direct attack is further subdivided into an attack utilising bidirectional communication and an attack utilising unidirectional communication. The indirect attack class is further defined as an attack utilising third party mediums as a communication platform.

The Social Engineering Attack Ontological Model expands on the Social Engineering Attack Classification by providing six entities of an attack as well as the relationships between these entities. This model currently represents the definition of an SE attack and partially represents the definition of a social engineer.

In summary, this paper is able to provide definitions for several terms within the domain of Social Engineering. The most important of these terms are Social Engineering and Social Engineering attack. The first one is defined as: The science of using social interaction as a means to persuade an individual or an organisation to comply with a specific request from an attacker where either the social interaction, the persuasion or the request involves a computer-related entity. The latter term is defined as: A Social Engineering attack employs either direct communication or indirect communication, and has a social engineer, a target, a medium, a goal, one or more compliance principles and one or more techniques.

Additional work is required to fully develop the ontological model. This includes the expansion of classes as well as the relationships between classes. In future work it is also required to represent the different phases of an SE attack.

Fig. 4 .

 4 Fig. 4. Indirect Communication via 3rd Party Medium



  one Social Engineer;  one Target;  one or more Compliance Principles;  one or more Techniques;  one Medium; and  one Goal.

Fig. 5 .

 5 Fig. 5. An Ontological Model of a Social Engineering attack Each of the six entities is represented as a different class in the model. The subclasses of each class are shown in Figure 5. For example, the Social Engineering Attack class has two subclasses: Direct Communication and Indirect Communication. In turn Direct Communication has two subclasses: Bidirectional Communication and Unidirectional Communication.The model, in its current state, provides the building blocks to further expand the model into a full ontology. As a future task, when the ontology is built from this model, additional relationships between these classes can be developed and described in detail. One example of a relationship between two classes is performsAttack between the Social Engineer class and the Target class. Our model partially represents our definition of Social Engineer (Section 2): An individual or group who performs an act of Social Engineering. The latter part of the definition requires representation of the verb social engineer and will be presented in the ontology as the relation performsAttack.Further development of the ontology will be performed as future research.

A magazine which was established by Emmanuel Goldstein in mid January 1984 and contains articles regarding the undergound world of hacking. The individuals publishing in this magazine are mostly individuals who are already facing several charges regarding computer related crimes.[START_REF] Goldstein | The Best of 2600, Collector's Edition: A Hacker Odyssey[END_REF]