# A Study on the Psychology of Social Engineering-Based Cyberattacks and Existing Countermeasures
## 3 Influence Methodologies
### Attitude and Behavior  
The theory of planned behavior (TPB) describes a psychological model to predict behavior. The TPB model can be seen in Figure 7[52]. The 'attitude toward the behavior' defines the motivation factors, i.e., the effort a person is willing to put in, to show a certain behavior. For example, an individual on social media might not be willing to share personal information but might participate in an online activity where privacy might be in significant danger. The'subjective norm' defines an individual's behavior influenced by his/her social circle. A person may align his/her behavior to be associated with a group. The 'perceived behavior control' indicates the level of control an individual has over a certain behavior. The three branches of TPB can be used to encourage a victim into revealing information based on the behavioral stimulus [53].  
The methods to influence the attitudes and behaviors of victims can further be divided into sub-domains, as shown in Table 5.  
\begin{table}
\begin{tabular}{c p{142.3 pt}} \hline \hline
**Types of Persuasions** & **Description** \\ \hline Similarity [46] & The similarity of interests invites likeness and dissimilarity leads to dislike. The criminal tends to use this as an effective approach to gain the trust of the victim. For example, on social media platforms, a foe may join groups that are similar to the groups joined by a potential target. Such similarities can help build a relationship of trust between a hacker and a victim. \\ \hline Distraction/ manipulation [25; 47; 48] & Research shows that moderate distraction does facilitate persuasion. Distraction is used as an effective tool in manipulation attacks. An example of a distraction-based SE attack is the DSD attack highlighted in Table 2. \\ \hline Curiosity [49] & The majority of individuals are curious by nature. In a SE attack, human curiosity can be exploited in many ways. For example, the attacker can send a phished email or an infected file as an attachment with a curious subject line, i.e., you are fired, annual performance report, employee layoff list, etc. \\ \hline Persuasion using authority/ credibility [50; 51] & Most people tend to comply in front of an authoritarian figure. On the internet, hackers use symbols and logos that reflect authenticity and authority. For example, an official logo of taxation, law enforcement, etc., to show authority and credibility can be an effective approach to initiate a SE attack. \\ \hline \hline \end{tabular}
\end{table}
Table 4: Persuasion types used in social engineering attacks.  
\begin{table}
\begin{tabular}{c p{142.3 pt}} \hline \hline
**Methods to Influence** **Attitudes and Behaviors** & **Description** \\ \hline Impression/ commitment [54; 55] & The self-presentation theory highlights the fact that every individual presents a likable impression, both internally and to other people. An individual might put a lot of effort into creating a desirable image. Such efforts can be an opening for hackers to conduct SE attacks. For example, an individual’s behavior can be influenced if the social image of that person is threatened. \\ \hline Cognitive dissonance theory [56; 57] & The theory highlights the inner conflict when an individual’s behaviors and beliefs are not aligned with each other. Such conflict can influence cognitive biases, i.e., decision-making. A malicious actor can exploit these cognitive biases for extracting confidential information. \\ \hline \hline \end{tabular}
\end{table}
Table 5: Methods to influence the attitudes and behaviors of victims to conduct social engineering attacks.  
Figure 7: Theory of planned behavior.