Heuristic Rule Generation for Business Email Compromise Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-fraud technologies are unable to detect Business Email Compromise (BEC) attacks, particularly those originating from legitimate email addresses within an organization, as they mimic internal communications, making it difficult to distinguish fraudulent emails from genuine ones.
Innovation Solution
The development of heuristic rules using a combination of classifiers, including a pre-trained recurrent neural network and a logit model, to identify BEC attacks by extracting relevant terms, generating n-grams, and assigning weight coefficients based on the likelihood of the email being fraudulent, with additional conditions for internal emails, such as matching sender and recipient domains or trusted addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard email authentication mechanisms (SPF, DKIM, DMARC) are used, then emails from legitimate domains are authenticated, but BEC attacks from compromised internal addresses cannot be detected
Solution Approach 1:
The patent segments the email authentication process into two layers: (1) traditional domain-level authentication (SPF, DKIM, DMARC) that verifies the email domain, and (2) a new content-level heuristic analysis that examines specific linguistic patterns, formatting anomalies, and contextual indicators within the email body. This segmentation allows the system to maintain reliable domain authentication while adding a separate detection mechanism specifically targeted at BEC attack patterns.
Solution Approach 2:
The patent introduces heuristic rules as an intermediary analysis layer between traditional authentication mechanisms and final email delivery. These rules act as a mediator that examines email content characteristics (such as urgent language patterns, specific formatting anomalies, and contextual red flags) without interfering with the primary authentication process, thereby enabling BEC detection while preserving legitimate email flow.
2Difficulty of detecting and measuring
If heuristic rules are applied to all emails, then BEC attacks can be detected, but false positives increase and legitimate emails may be blocked
Solution Approach 1:
The patent applies local quality by making heuristic rule application selective rather than universal. The system identifies specific local characteristics in emails (such as internal sender addresses, urgent language patterns, specific formatting anomalies) and applies heuristic analysis only to emails exhibiting these localized risk indicators. This targeted approach reduces unnecessary analysis of legitimate emails while maintaining high detection capability for suspicious messages.
Solution Approach 2:
The patent employs parameter changes by dynamically adjusting the stringency of heuristic rule application based on email characteristics. The system modifies detection parameters (such as threshold values for suspicious pattern matching) according to the specific context of each email, allowing flexible adaptation that reduces false positives while maintaining sensitivity to actual BEC attacks.
3Measurement precision
If multiple classifiers (RNN and logit model) are combined, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the machine learning detection system into two distinct classifier components: (1) an RNN-based classifier that processes sequential text patterns and linguistic features, and (2) a logit model-based classifier that evaluates structured features and email metadata. Each classifier is optimized for specific types of pattern recognition, and their segmented architecture allows independent training and tuning, reducing overall system complexity while maintaining high combined accuracy.
Solution Approach 2:
The patent merges the outputs of multiple specialized classifiers into a unified detection decision. By combining the RNN classifier's strength in sequential pattern recognition with the logit model's strength in structured feature analysis, the system achieves higher overall detection accuracy than any single classifier could provide alone, while the modular merging approach keeps system complexity manageable.
Data Source
AI summary
A method for creating a heuristic rule to identify Business Email Compromise (BEC) attacks includes filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages. One or more n-grams are generated, using the first classifier, based on the extracted terms. A vector representation of the extracted terms is generated, using a second classifier, based on the generated one or more n-grams. The second classifier includes a logit model. A weight coefficient is assigned to each of the one or more extracted terms based on an output of the trained logit model. A higher weight coefficient indicates higher relevancy to BEC attack of the corresponding term. A heuristic rule associated with the BEC attack is generated by combining the weight coefficients of a combination of the one or more extracted terms.