BEC Detection via ML User Email Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Business email compromise (BEC) attacks are challenging to detect due to their similarity to legitimate emails, especially since existing methods like email authentication and content filtering can be bypassed by malware or misconfiguration, leading to high false alarm rates with author identification/authorship analysis.
Innovation Solution
Employing machine learning models trained using BEC email samples to determine the similarity between a target email and known BEC emails versus user emails, with features like metadata and intentions, to identify and prevent BEC attacks by generating reference strings and user models for comparison.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If author identification/authorship analysis is used to detect BEC attacks, then the ability to identify fraudulent emails is improved, but the false alarm rate increases
Solution Approach 1:
The patent segments the detection process into multiple independent analysis components: header analysis, body text analysis, metadata analysis, and behavioral pattern analysis. Each component evaluates specific features independently and contributes to an overall similarity score, allowing the system to reduce false alarms by requiring consensus across multiple segments rather than relying on a single authorship analysis metric
Solution Approach 2:
The patent introduces an intermediary comparison mechanism that generates a hypothetical legitimate email based on the user's communication patterns and compares it against the suspicious email. This intermediary serves as a mediator between the suspicious email and the user's normal behavior, providing a reference point that reduces false alarms by accounting for legitimate variations in email style while still detecting fraudulent content
2Reliability
If email authentication and content filtering are used, then security against BEC attacks is improved, but these methods can be bypassed by malware or misconfiguration
Solution Approach 1:
The patent performs preliminary actions by building comprehensive user profiles and establishing baseline communication patterns before BEC attacks occur. The system pre-analyzes legitimate emails to understand normal sender behavior, language patterns, and communication styles, storing this information for future comparison. This preliminary characterization enables the system to detect anomalies even when authentication mechanisms are bypassed
Solution Approach 2:
The patent moves the detection problem from traditional authentication dimensions (sender identity verification) to a new dimension of behavioral similarity analysis. Instead of relying solely on email headers and authentication protocols, the system analyzes the content, style, and patterns of email bodies, comparing them against established user profiles. This dimensional shift makes detection resistant to authentication bypasses while maintaining adaptability to legitimate email variations
3Measurement precision
If similarity comparison with known BEC emails is performed, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent extracts and focuses on the most discriminative features from emails, such as specific linguistic patterns, header characteristics, and metadata elements that are most indicative of BEC attacks. By identifying and extracting only these critical features rather than analyzing entire email contents, the system achieves high detection accuracy while significantly reducing computational complexity compared to full-text comparison approaches
Solution Approach 2:
The patent transforms email data into standardized parameter representations that facilitate efficient comparison. Instead of comparing raw email texts directly, the system converts emails into structured parameter sets including lexical features, syntactic patterns, and metadata attributes. This parameter transformation enables faster computation while maintaining detection accuracy by focusing on the most relevant characteristics for identifying BEC attacks
Data Source
AI summary
An email attempting to perpetrate a business email compromise (BEC) attack is detected based on similarity of the email to a known BEC email and on similarity of the email to a user email that would have been sent by the purported sender of the email. Metadata of the email is extracted and input to a BEC machine learning model to find the known BEC email among BEC email samples. The extracted metadata are also input to a personal user machine learning model of the purported sender to generate the user email.