# Leveraging Dialogue State Tracking for Zero-Shot Chat-Based Social Engineering Attack Recognition
## 4 The Proposed SG-CSE Attack State Tracker
### The SG-CSE BERT Model  
This section introduces the SG-CSE BERT model, which operates in a schema-guided setting and can condition the CSE attack service schema using the descriptions of intents and slots. To enable the model to represent unseen intents and slots, a BERT-based model pre-trained on large corpora is employed. As a result, the proposed SG-CSE is a model for zero-shot schema-guided dialogue-state tracking in CSE attack dialogues. The SG-CSE BERT model encodes all schema intents, slots, and categorical slot values into embedded representations. Since social engineering attacks can take many forms, schemas may differ  
Figure 7: Excerpt of CSE ontology. in their number of intents and slots. Therefore, predictions are made over a dynamic set of intents and slots by conditioning them on the corresponding schema embedding. The sequence pairs used for the embeddings of intent, slot, and slot value are presented in Table 7, and they are fed as input to the pre-trained BERT model (Figure 9) where \begin{table}
\begin{tabular}{l l l} \hline \hline
**Slot** & **Type** & **Example Values** \\ \hline Hardware & Dictionary & CD, DVD, USB stick \\ Network & Numbers & 192.168.13.21 \\ Server & String & subdomain.domain.tld \\ Service & String & Email, FIT, ssh \\ Software & String & RDP, Firefox \\ Personal\_Email & String & user@domain.tld \\ Personal\_Name & String & [PERSON] \\ Personal\_Telephone & Numbers & 0123456789 \\ Dept\_Email & String & [EMAIL_ADDRESS] \\ Dept\_Name & String & Sales, Marketing \\ Employee\_Name & String & [PERSON] \\ Employee\_Email & String & [EMAIL_ADDRESS] \\ Employee\_Telephone & Numbers & 0123456789 \\ Employee\_Position & String & Executive, Manager \\ Office\_Number & Numbers & 12, 23 \\ Enterprise\_Address & String & 26 th Av. Somewhere \\ Enterprise\_Location & String & Athens, Thessaloniki \\ Enterprise\_Name & String & ACME, Other \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Slots in SG-CSE Corpus. Figure 8: Example schema for CSE\_SME_Info_Extraction. \(a_{1},\ \ldots,\ a_{n}\) and \(v,\ldots,v_{n}\) are the two sequence tokens that are fed as a pair to SG-CSE BERT encoder. The \(U_{CLS}\) is the embedded representation of the schema and \(t,\ldots,t_{n+m}\) are the token-level representations. **Schema Embeddings**: Let \(I,\ S\) be the intents and slots of CSE attack service and \(\left\{i_{j}\right\}\) where \(1\ \leq j\ \leq I\) and \(\left\{s_{j}\right\}\) where \(1\ \leq j\ \leq S\) their embeddings. The embeddings of the \(N\) non-categorical slots are denoted by \(\left\{s_{j}^{n}\right\}\) where \(1\ \leq j\ \leq N\ \leq S\) and the embeddings for all possible values that the \(k^{th}\) categorical slot can take are denoted by \(\left\{v_{j}^{k}\right\}\) where \(1\ \leq j\ \leq V^{k}\) and \(1\ \leq k\ \leq C\). C is the number of categorical slots and \(N+C=S\). **Utterance Embedding**: A pair of two consecutive utterances between the two interlocutors is encoded and represented to embeddings as \(u_{CLS}\) and the token level representations \(\left\{t_{i}\right\}\) where \(1\ \leq i\ \leq M\) and M the total number of tokens in the pair of utterances. The model utilizes the schema and utterance embeddings and a set of projections [4] to proceed to predictions for active intent, requested slot, and user goal. More specifically, the **active intent,** which is the intent requested by the attacker that we are trying to recognize, takes the value 'NONE' if the model currently processes no intent. Otherwise, if \(i_{0}\) is the trainable parameter in \(\mathbb{R}^{d}\) then the intent is given by:  
\[l_{int}^{j}=\mathcal{F}_{int}\big{(}u,\ i_{j},\ 1\big{)},\ 0\ \leq j\ \leq I\]  
SoftMax function is used to normalize the logits \(l_{int}^{j}\) are normalized and produce a distribution over the set of intents plus the \"NONE\" intent. The intent with the highest probability is predicted as active.