Heuristic BEC Email Detection Using N-Grams and Logit Weights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-fraud technologies are unable to detect Business Email Compromise (BEC) attacks originating from legitimate email addresses within an organization, as they rely on email authentication mechanisms and spam/phishing detection methods that fail to identify internal threats.
Innovation Solution
A system and method using heuristic rules, involving a trained recurrent neural network and logistic regression, to analyze email content and attributes for identifying BEC attacks, including n-gram generation and weight coefficient assignment to detect fraudulent emails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If email authentication mechanisms (DKIM, SPF, DMARC) and standard phishing detection methods are used, then legitimate email addresses within the organization are authenticated, but internal BEC attacks from compromised legitimate addresses cannot be detected
Solution Approach 1:
The patent segments the email analysis into multiple independent components: header authentication (DKIM, SPF, DMARC), content analysis using machine learning classifiers, linguistic pattern detection, and behavioral analysis. This segmentation allows each component to specialize in specific aspects, enabling detection of internal BEC attacks through content and pattern analysis even when header authentication passes.
Solution Approach 2:
The patent introduces an intermediary layer of AI-based classifiers and heuristic analysis between the email authentication mechanisms and the final detection decision. This intermediary analyzes the email content, linguistic patterns, and metadata to detect BEC attacks that bypass traditional authentication, effectively bridging the gap between authentication reliability and attack detection.
2Measurement precision
If standard phishing detection methods focusing on technical email headers and altered spellings are used, then external phishing emails are detected, but internal BEC emails from legitimate addresses are missed
Solution Approach 1:
The patent implements dynamic adaptation by training machine learning classifiers on organization-specific email data and continuously updating detection models based on new attack patterns. The system adapts to internal BEC threats by learning from historical data and adjusting detection parameters, making the detection methodology versatile across different threat types including internal attacks.
Solution Approach 2:
The patent changes detection parameters from static header-based rules to dynamic content-based analysis using AI classifiers. By analyzing linguistic patterns, email content semantics, sender-recipient relationships, and behavioral metrics, the system adjusts detection sensitivity and criteria to identify internal BEC attacks that differ fundamentally from external phishing in their technical characteristics.
3Object-affected harmful factors
If AI-based classifiers and heuristic rules are implemented to detect internal BEC attacks, then detection capability for fraudulent emails is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex detection system into modular components: AI-based classifiers for content analysis, heuristic rule engines for pattern matching, and decision fusion mechanisms. Each module handles specific aspects of BEC detection independently, making the overall complex system manageable, maintainable, and scalable while improving detection capability.
Solution Approach 2:
The patent implements self-service through automated training of machine learning models on organization-specific data, automatic updating of heuristic rules based on detected attack patterns, and self-adjusting detection thresholds. This reduces the operational complexity of managing sophisticated detection systems by enabling them to adapt and improve automatically without extensive manual intervention.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for creating a heuristic rule to identify Business Email Compromise (BEC) attacks includes filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages. One or more n-grams are generated, using the first classifier, based on the extracted terms. A vector representation of the extracted terms is generated, using a second classifier, based on the generated one or more n-grams. The second classifier includes a logit model. A weight coefficient is assigned to each of the one or more extracted terms based on an output of the trained logit model. A higher weight coefficient indicates higher relevancy to BEC attack of the corresponding term. A heuristic rule associated with the BEC attack is generated by combining the weight coefficients of a combination of the one or more extracted terms.