Detection of Business Email Compromise Attacks with Writing Style Analysis

Phishing scams have long been used to obtain sensitive information via email. Recently, scammers have increasingly been using spear-phishing and targeting corporate employees, this type of attack is called Business Email Compromise (BEC-attacks). BEC-attacks problem is highly relevant to mobile networks, as mobile users are much more vulnerable to such types of attacks than regular users. The main methods of detecting BEC-attacks are considered and their comparative analysis is made. It is demonstrated that the most promising approach for detecting BEC-attacks is a complex analysis of email headers, content analysis, and authors writing-style analysis with machine learning algorithms. BEC-attacks detection method is proposed based on the above-mentioned analysis and its decomposed functional model is presented. A feature space includes writing-style features (words 3-grams); day of the week and time of sending the email; email’s urgency features; email headers features. To evaluate the BEC-attacks detection accuracy, the experiments on datasets, containing emails in Russian and English, were carried out. The experiments showed that the best accuracy is achieved with word n-grams and LSVC with a feature scaling method for emails in Russian and English.