# Leveraging Dialogue State Tracking for Zero-Shot Chat-Based Social Engineering Attack Recognition
## 4 The Proposed SG-CSE Attack State Tracker  
### Description  
We propose the SG-CSE Attack State Tracker (SG-CSEAST), a system that estimates the dialogue state during a CSE attack state by predicting the intention and slot-value pairs at turn t of the dialogue. The SG-CSEAST consists of the following four units depicted in Figure 1.  
* NLU: converts the utterances into a meaningful representation. * SG-CSE BERT: takes into account the dialogue history, and outputs the estimated state of the CSE attack. * CSE Policy: decides which mitigation action to take. * Mitigation Action: applies the selected mitigation action. In this work, we implement the SG-CSE BERT unit, which detects information leakage and deception attempts. The information concerns SME, Information Technology (IT), and personal details, while in our context, we define deception as the attempt of a malicious user to persuade a user to use an IT resource. We follow the schema-guided paradigm utilizing Das and dialogue history. The steps toward SG-CSE BERT implementation are the following (Figure 2):  
1. Using CSE Corpus [17], we extract related dialogue acts (SG-CSE Das) by mapping the utterance intention to a proposed DA. 2. We create a new corpus (SG-CSE Corpus) appropriate for DST, labeled with SG-CSE Das. This corpus is used to fine-tune and evaluate our detection model. 3. We utilize the CSE conceptual model and the CSE ontology [17] to create a schema-based ontology. Thus, different attack types are extracted. 1. Four different CSE attack types are extracted and will be represented as services. 2. Each service will be mapped to a specific schema. 3. The schema will have several intents which will be mapped to the corresponding DA. Figure 1: The SG-CSE attack State Tracker main units. The schema-guided paradigm makes use of a domain's ontology to create the required schema that describes each service existing in the domain. In our research, the domain is the CSE attacks, and we predict the service, user intention, and requested slot-value pairs. For example, for an utterance like: \"What is the CEO's first name?\" the SG-CSE BERT model should be able to build a representation like the one presented in Table 2.  
A CSE attack is unleashed through the exchange of utterances in turns of a dialogue. Time is counted in turns, and thus at any turn \(t\), the CSE attack is at the state \(s_{t}\) and this state comprises the summary of all CSE attack history until time \(t\). State \(s_{t}\) encodes the attacker's goal in the form of (slot, value) pairs. The different slot and value pairs are produced by the CSE ontology [17] and the proposed DAs that represent the in-context entities, intents, and their interconnection. The values for each slot are provided by the attacker during the CSE attack and represent her goal, e.g., during a CSE attack, at turn \(t\) the state \(s_{t}\) could be \(s_{t}=\{(employee_{name},NULL),\ (employee_{position},CEO)\}\}\). In such a state, the attacker's goal has been encoded for slots _employee_name_, _employee_position_ during the dialogue. Figure 3 depicts the dialogue system concepts and evolution that are related to our research and the concepts transferred from the dialogue systems field to the CSE attack domain for the purpose of CSE attack recognition via CSE attack-state tracking. As Figure 3 depicts, a dialogue can be realized between humans or between humans and machines. The latter is called dialogue systems and can be task-oriented or conversational. The architecture of dialogue systems can be described using frames, and among their properties, dialogue-state tracking is a property that represents the state of the dialogue at any given moment. The schema is created based on the SG-CSE domain ontology, and we can perform prediction tasks using state-of-the-art language models such as BERT.