Email Account Compromise Detection via East-West Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current email security systems fail to effectively detect compromised mailboxes involved in lateral phishing, lateral scam, lateral BEC, outbound scam, and fraudulent money transfer requests due to their reliance on north-south traffic filters and inability to differentiate between internal and external threats.
Innovation Solution
A system comprising an adaptive pre-filter, retrospective behavior engine, and verdict correlation engine that analyzes current email-sending behavior against historical data using fuzzy logic, anomaly detection, and machine learning to classify emails as benign, suspicious, or malicious, and takes responsive actions such as suspending compromised accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional north-south traffic filters and email authentication controls (SPF, DKIM, DMARC) are used, then external email threats can be blocked, but internal compromised email accounts cannot be detected
Solution Approach 1:
The system segments email security into two distinct detection paths: north-south traffic filtering for external threats and east-west behavior analysis for internal threats. The east-west segment monitors communication patterns between internal email accounts, enabling detection of compromised accounts that pass traditional external filters.
Solution Approach 2:
The system adds a new dimension of analysis by examining east-west email traffic patterns and behavioral characteristics rather than relying solely on traditional north-south authentication controls. This dimensional shift enables detection of internal threats that authenticate successfully but exhibit anomalous communication patterns.
2Measurement precision
If email authentication controls like SPF, DKIM, and DMARC are implemented, then email authenticity can be verified, but compromised internal accounts sending fraudulent emails cannot be identified
Solution Approach 1:
The system introduces an intermediary behavioral analysis layer that operates between email authentication verification and final delivery. This intermediary monitors the communication patterns and characteristics of authenticated emails, detecting fraud even when authentication controls confirm the sender's legitimacy.
Solution Approach 2:
The system implements feedback mechanisms that continuously monitor email communication patterns and adjust detection thresholds based on observed behavior. When anomalous patterns are detected from authenticated internal accounts, the system can trigger alerts or block further communication, creating a feedback loop that prevents fraud.
3Reliability
If comprehensive behavioral analysis and anomaly detection are performed on all emails, then compromised accounts can be detected, but system complexity and processing overhead increase significantly
Solution Approach 1:
The system applies local quality by focusing comprehensive behavioral analysis only on east-west internal email traffic rather than all emails. External emails continue to use traditional lightweight authentication checks, while internal emails receive enhanced behavioral monitoring, optimizing the balance between detection capability and system complexity.
4Loss of time
If real-time monitoring of all email communications is implemented, then internal threats can be detected immediately, but processing time and computational resources increase
Solution Approach 1:
The system applies partial action by monitoring only the critical east-west internal email traffic patterns rather than analyzing every email attribute in real-time. This selective monitoring approach provides timely detection of compromised accounts while consuming fewer computational resources compared to comprehensive real-time analysis of all emails.
Data Source
AI summary
Techniques and architecture are described for detecting a compromised mailbox as an email account compromise (EAC) involved in lateral phishing, lateral scam, lateral BEC, outbound scam, lateral and inbound fraudulent money transfer requests. For example, the techniques and architecture provide a method that comprises scanning, by a pre-filter, electronic mail messages (emails) within an organization, wherein the emails originate within the organization. The pre-filter analyzes the emails with respect to known fraudulent email practices and determines that an email is a questionable email. A retrospective behavior engine analyzes the questionable email with respect to one or more historical traits to provide a feature set. Based at least in part on the feature set, the verdict correlation engine determines that the questionable email belongs in a class of emails from multiple classes of emails. Based at least in part on the class, the verdict correlation engine performs a responsive action.