Business Email Compromise Detection With Dynamic Domain Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security tools are inadequate in detecting and blocking Business Email Compromise (BEC) attacks, which often use domain spoofing and sophisticated tactics to evade detection by existing mail transfer agents and filters, leading to significant financial losses and resource consumption.
Innovation Solution
A system utilizing machine learning-based techniques to dynamically build and maintain a list of legitimate domains, combined with natural language processing and classification models, to accurately identify and block BEC attacks by analyzing message data and assigning lookalike scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing mail transfer agents and filters are used to detect BEC attacks, then the system operates with standard security tools, but the detection accuracy is insufficient and false positives increase
Solution Approach 1:
The patent transforms static domain lists into dynamic, evolving parameters by continuously updating legitimate domain lists based on observed email traffic patterns. The system monitors domain usage over time and adapts its detection parameters accordingly, allowing it to distinguish between legitimate and suspicious domains more accurately without increasing false positives
Solution Approach 2:
The patent replaces traditional mechanical filtering systems with machine learning-based classification models. These models analyze message data, domain characteristics, and communication patterns to dynamically assess risk, substituting rigid rule-based filtering with adaptive intelligent detection that reduces both false negatives and false positives
2Measurement precision
If sophisticated BEC attack detection methods are implemented, then detection capability improves, but computational resources and processing time increase
Solution Approach 1:
The patent performs preliminary classification of email domains and senders before full message analysis. By pre-processing and categorizing domains into legitimate and suspicious lists based on historical data, the system reduces the computational burden on subsequent detection stages, enabling sophisticated analysis only when necessary
Solution Approach 2:
The detection system is segmented into multiple processing stages: initial domain filtering, message data analysis, and detailed classification. This segmentation allows the system to apply computationally intensive machine learning models only to messages that pass initial filters, significantly reducing overall resource consumption while maintaining high detection capability
3Reliability
If real-time BEC detection and response is implemented, then financial losses are minimized, but system complexity and implementation difficulty increase
Solution Approach 1:
The system implements self-service through automated machine learning models that continuously learn from new data and adapt to emerging attack patterns without requiring manual reconfiguration. The automatic updates to legitimate domain lists and dynamic classification rules enable the system to maintain high reliability while reducing the complexity of manual system management
Solution Approach 2:
The patent incorporates feedback loops where detection results and blocked messages are fed back into the training data for continuous model improvement. This automated feedback mechanism allows the system to adapt to new attack vectors automatically, maintaining high financial loss prevention capability while the feedback-driven automation reduces long-term implementation complexity
Data Source
AI summary
An email is received that is from an email sender. From the email, the display name of the email sender, an email address of the email sender, and an email domain of the email sender, is extracted. A score is determined for the email based on at least: the extracted display name of the email sender, the extracted email address of the email sender, and the extracted email domain of the email sender, where the score indicates a probability that the email is from a legitimate sender. Message content of the email is input into multiple classifiers each corresponding to a particular message type. The message type of the email is determined based on output of the classifiers. Based on at least the determined score for the email and the determined message type of the email, a determination is made whether the email is associated with a BEC attack.