Behavioural Analytics for Predicting Social Engineering Attacks: A Risk-Based Approach Using Decision Trees, Gradient Boosting, and Bayesian Networks

Social engineering attacks exploit human behaviour and remain a leading cause of security breaches. This paper evaluates predictive models that use behavioural analytics to estimate the risk of social engineering attacks. We compare Decision Trees, Gradient Boosting (XGBoost style ensemble) and Bayesian Networks on a phishing websites / behavioural dataset. Feature engineering emphasized URL and interaction patterns, response times, and email interaction rates. Models were trained and evaluated using accuracy, precision, recall, F1, and ROC-AUC. Gradient Boosting attained the highest ROC-AUC and strong F1 scores, Decision Trees offered interpretability, and Bayesian Networks provided probabilistic insight. We propose a lightweight risk prediction framework suitable for integration with alerting systems and security awareness programs.