Historically, machine learning in computer security has prioritized defense:
think intrusion detection systems, malware classification, and botnet traffic
identification. Offense can benefit from data just as well. Social networks,
with their access to extensive personal data, bot-friendly APIs, colloquial
syntax, and prevalence of shortened links, are the perfect venues for spreading
machine-generated malicious content. We aim to discover what capabilities an
adversary might utilize in such a domain. We present a long short-term memory
(LSTM) neural network that learns to socially engineer specific users into
clicking on deceptive URLs. The model is trained with word vector
representations of social media posts, and in order to make a click-through
more likely, it is dynamically seeded with topics extracted from the target's
timeline. We augment the model with clustering to triage high value targets
based on their level of social engagement, and measure success of the LSTM's
phishing expedition using click-rates of IP-tracked links. We achieve state of
the art success rates, tripling those of historic email attack campaigns, and
outperform humans manually performing the same task.