Most people are familiar with phishing, where an attacker sends out a malicious email that pretends to be legitimate. Common phishing emails pretending to be notifications from trusted organizations (banks, Amazon, Netflix, etc.) that require the recipient to log into their account to fix the issue. By setting up a website that mimics the legitimate site, attackers can collect login credentials and other personal information.
\r\nSpear phishing emails are a more targeted version of phishing emails. Rather than use a pretext that applies to a large number of people (like an email from a common bank), spear phishers research their intended targets and tailor their malicious emails to that target. A simple example is one where the attacker uses the company logo and the name of a CEO to craft an attack that looks like the CEO ordering an employee to do something for them. Since these phishing emails look more realistic and personal, they are more likely to trick their targets.
\r\nThe detection of spear phishing emails is a major component of a company's cyberdefense strategy. However, the more sophisticated a phishing email becomes, the more difficult it is to detect. Here we'll discuss some applications of machine learning to detect phishing emails.
\r\nMachine learning is a powerful tool for analyzing data and extracting patterns and anomalies. However, these algorithms need usable data in order to draw valid conclusions. There are presently three methods by which machine learning and anomaly detection algorithms can be applied to the detection of spear phishing emails.
\r\n\r\n\r\nSocial graph analysis
\r\nOne of the first ways that machine learning can be applied to spear phishing detection is based on a \"social graph\" of the common communication patterns within a company. For example, members of the same department in the company are expected to communicate frequently and will have a high level of interconnectivity. On the flip side, you don't expect the accounting department intern to be frequently sending emails to the CEO or vice versa.
\r\nBuilding a social graph of a company is straightforward. By observing the information included in the headers of each email sent within the company, connections can be observed without needing to read the contents of the email itself. And by weighting connections between company employees based on frequency of communication, a social graph can be created.
\r\nSpear phishing attacks usually use a communication path outside of the ordinary within a company. One example is a business email compromise (BEC) attack where the attacker pretends to be someone in authority (like the CEO) and contacts another member of staff with instructions. These attacks are designed to take advantage of employee's instinctive reaction to obey authority.
\r\nSocial graph analysis can help detect this type of spear phishing attack. By observing the connections used by each email and comparing them to the model, machine-learning algorithms can detect anomalous emails. While these may be legitimate, providing a warning decreases the probability that the recipient will be taken in by an attack.
\r\nUser communication profiling
\r\nEveryone has their own unique style and voice that is expressed when writing emails. Some of these are generally applicable (few CEOs include emoticons or text message abbreviations in their official communications) while others are more specific (someone may have a favorite phrase that they use frequently). These idiosyncrasies can be used to help detect and protect against spear phishing emails.
\r\nNatural language processing (NLP) is a field dedicated to teaching computers to understand and model language. Using NLP techniques, it is possible to analyze written text and extract identifying features from it. For example, the use of a dangling preposition (like the \"for\" in \"What do you want that for?\") is more common in some areas (and the people who grew up in those areas) than others. Also, people have different vocabularies, and a simple statistical analysis of word and phrase choice and preferred sentence structure and complexity can help to differentiate the writing of different people.
\r\nUsing this type of linguistic analysis, certain types of spear phishing emails can be detected with anomaly detection algorithms. If someone writes an email in their own voice but then signs it as the CEO, it won't fit the profile generated from the CEO's legitimate emails. However, spear phishing emails which use a legitimate email as a template but change the destination of a few links may be undetectable by this method. Using this technique in combination with the others discussed here improves the probability that spear phishing emails will be detected and their recipients warned appropriately.
\r\nEmail structural analysis
\r\nWhen you get an email, what you see in your email client of choice is the sender, recipient, time, subject, message, and attachments. While this is the bulk of the information contained within most emails, it is far from everything in them and this other information can help in detecting spear phishing attacks.
\r\nFor example, emails contain the chain of IP addresses that an email hopped through from the sender to the recipient. If the sender typically uses Gmail for their mail and rarely travels outside the United States, the originating IP address should probably be a Google server located within the U.S. While the chain of IP addresses can be faked or modified, it typically involves adding additional hops to conceal the originating address. If a user's emails typically take a hop or two to reach their destination and suddenly this one takes five to ten hops, then maybe it deserves additional scrutiny.
\r\nAnother way to detect spear phishing through structural analysis of emails is observation of the headers that are and are not included in the email. For example, Gmail has several headers (X-GM-Message-State and X-Google-Smtp-Source are examples). If you have an email claiming to be from a Gmail server that lacks these headers or an email not from Gmail that has them, it may be cause for suspicion.
\r\nBy observing and recording common structural details of a user's emails, it's possible to build up a user-specific profile for each employee in an organization. Each new email can then be compared to this profile using anomaly detection algorithms and flagged to notify the recipient if there is reason for suspicion.
\r\n
Detecting and protecting against spear phishing attacks is an important component of an organization’s cyber defense strategy. Ninety-one percent of cyberattacks begin with a phishing email, so an effective spear phishing detection strategy is an important step in protecting an organization's cyberassets.
\r\nMany email protection tools provide basic protection against phishing attacks by checking for malicious links or attachments within an email. However, spear phishing attacks do not require this kind of content to function since the goal may be to tell the recipient to wire money to a certain bank account in response to an attached, non-malicious invoice. Selection of an email protection tool that provides these advanced spear phishing detection features will improve an organization’s cybersecurity posture and decrease the probability of a breach.
\n","docType":"article","guid":"articles_76264681549ea3f36ad8dfd9bbed8a58","lastModified":"2018-05-18T07:00:00.000Z","published":"2018-05-18T07:00:00.000Z","structuredData":null,"subtitle":"As phishing emails become more sophisticated, companies are turning to machine learning.","template":"legacy","title":"How Companies Are Detecting Spear Phishing Attacks Using Machine Learning","type":"article","author":{"avatar":null,"bio":"I am Chief Scientist at Inky.com, Leading development at Inky, an enterprise communications security platform, working to protect corporate email from new breeds of sophisticated phishing attacks.\r\n\r\nBesides full-stack development, my background includes machine learning, big data, and natural language processing applied to text and communications data.","name":"Andrew Goldberg","image":null,"slug":null,"social":{"facebook":"https://www.facebook.com/inkymail/","linkedin":"https://www.linkedin.com/in/andrewbgoldberg/","twitter":"https://twitter.com/inkymail","website":"https://www.inky.com"},"status":"enabled","title":null,"type":"New BDC Member","user":{"imagePath":"https://staging.business.com/images/uploads/user/profile/66c254755a3abaa9e11a0e86ffbaa758d86e3.jpg","profile":{"company":"Inky Email Protection","jobTitle":"Chief Scientist","website":"https://www.inky.com"}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Technology Solutions","slug":"technology-solutions"}},"meta":{"robots":"index, follow","description":"As phishing emails become more sophisticated, companies are turning to machine learning to root out these cyberattacks.","title":"Using Machine Learning to Detect Spear Phishing Attacks - business.com"},"parsedContent":{"toc":[{"id":"detect-spear-phishing-with-machine-learning","title":"Detect spear phishing with machine learning"},{"id":"protecting-against-phishing-attacks","title":"Protecting against phishing attacks"}],"json":[{"component":"p","children":["Most people are familiar with phishing, where an attacker sends out a malicious email that pretends to be legitimate. Common phishing emails pretending to be notifications from trusted organizations (banks, Amazon, Netflix, etc.) that require the recipient to log into their account to fix the issue. By setting up a website that mimics the legitimate site, attackers can collect login credentials and other personal information."]},{"component":"p","children":["Spear phishing emails are a more targeted version of phishing emails. Rather than use a pretext that applies to a large number of people (like an email from a common bank), spear phishers research their intended targets and tailor their malicious emails to that target. A simple example is one where the attacker uses the company logo and the name of a CEO to craft an attack that looks like the CEO ordering an employee to do something for them. Since these phishing emails look more realistic and personal, they are more likely to trick their targets."]},{"component":"p","children":["The detection of spear phishing emails is a major component of a company's cyberdefense strategy. However, the more sophisticated a phishing email becomes, the more difficult it is to detect. Here we'll discuss some applications of machine learning to detect phishing emails."]},{"component":"h2","props":{"id":"detect-spear-phishing-with-machine-learning"},"children":["Detect spear phishing with machine learning"]},{"component":"p","children":["Machine learning is a powerful tool for analyzing data and extracting patterns and anomalies. However, these algorithms need usable data in order to draw valid conclusions. There are presently three methods by which machine learning and anomaly detection algorithms can be applied to the detection of spear phishing emails."]},{"component":"blockquote","children":[{"component":"h3","children":["Social graph analysis"]},{"component":"p","children":["One of the first ways that machine learning can be applied to spear phishing detection is based on a \"social graph\" of the common communication patterns within a company. For example, members of the same department in the company are expected to communicate frequently and will have a high level of interconnectivity. On the flip side, you don't expect the accounting department intern to be frequently sending emails to the CEO or vice versa."]},{"component":"p","children":["Building a social graph of a company is straightforward. By observing the information included in the headers of each email sent within the company, connections can be observed without needing to read the contents of the email itself. And by weighting connections between company employees based on frequency of communication, a social graph can be created."]},{"component":"p","children":["Spear phishing attacks usually use a communication path outside of the ordinary within a company. One example is a business email compromise (BEC) attack where the attacker pretends to be someone in authority (like the CEO) and contacts another member of staff with instructions. These attacks are designed to take advantage of employee's instinctive reaction to obey authority."]},{"component":"p","children":["Social graph analysis can help detect this type of spear phishing attack. By observing the connections used by each email and comparing them to the model, machine-learning algorithms can detect anomalous emails. While these may be legitimate, providing a warning decreases the probability that the recipient will be taken in by an attack."]},{"component":"h3","children":["User communication profiling"]},{"component":"p","children":["Everyone has their own unique style and voice that is expressed when writing emails. Some of these are generally applicable (few CEOs include emoticons or text message abbreviations in their official communications) while others are more specific (someone may have a favorite phrase that they use frequently). These idiosyncrasies can be used to help detect and protect against spear phishing emails."]},{"component":"p","children":["Natural language processing (NLP) is a field dedicated to teaching computers to understand and model language. Using NLP techniques, it is possible to analyze written text and extract identifying features from it. For example, the use of a dangling preposition (like the \"for\" in \"What do you want that for?\") is more common in some areas (and the people who grew up in those areas) than others. Also, people have different vocabularies, and a simple statistical analysis of word and phrase choice and preferred sentence structure and complexity can help to differentiate the writing of different people."]},{"component":"p","children":["Using this type of linguistic analysis, certain types of spear phishing emails can be detected with anomaly detection algorithms. If someone writes an email in their own voice but then signs it as the CEO, it won't fit the profile generated from the CEO's legitimate emails. However, spear phishing emails which use a legitimate email as a template but change the destination of a few links may be undetectable by this method. Using this technique in combination with the others discussed here improves the probability that spear phishing emails will be detected and their recipients warned appropriately."]},{"component":"h3","children":["Email structural analysis"]},{"component":"p","children":["When you get an email, what you see in your email client of choice is the sender, recipient, time, subject, message, and attachments. While this is the bulk of the information contained within most emails, it is far from everything in them and this other information can help in detecting spear phishing attacks."]},{"component":"p","children":["For example, emails contain the chain of IP addresses that an email hopped through from the sender to the recipient. If the sender typically uses Gmail for their mail and rarely travels outside the United States, the originating IP address should probably be a Google server located within the U.S. While the chain of IP addresses can be faked or modified, it typically involves adding additional hops to conceal the originating address. If a user's emails typically take a hop or two to reach their destination and suddenly this one takes five to ten hops, then maybe it deserves additional scrutiny."]},{"component":"p","children":["Another way to detect spear phishing through structural analysis of emails is observation of the headers that are and are not included in the email. For example, Gmail has several headers (X-GM-Message-State and X-Google-Smtp-Source are examples). If you have an email claiming to be from a Gmail server that lacks these headers or an email not from Gmail that has them, it may be cause for suspicion."]},{"component":"p","children":["By observing and recording common structural details of a user's emails, it's possible to build up a user-specific profile for each employee in an organization. Each new email can then be compared to this profile using anomaly detection algorithms and flagged to notify the recipient if there is reason for suspicion."]}]},{"component":"h2","props":{"id":"protecting-against-phishing-attacks"},"children":["Protecting against phishing attacks"]},{"component":"p","children":["Detecting and protecting against spear phishing attacks is an important component of an organization’s cyber defense strategy. ",{"component":"a","props":{"href":"https://www.darkreading.com/endpoint/91--of-cyberattacks-start-with-a-phishing-email/d/d-id/1327704?","rel":"nofollow"},"children":["Ninety-one percent of "]},"cyberattacks",{"component":"a","props":{"href":"https://www.darkreading.com/endpoint/91--of-cyberattacks-start-with-a-phishing-email/d/d-id/1327704?","rel":"nofollow"},"children":[" begin with a phishing emai"]},{"component":"a","props":{"href":"https://www.darkreading.com/endpoint/91--of-cyberattacks-start-with-a-phishing-email/d/d-id/1327704?","rel":"nofollow"},"children":["l"]},", so an effective spear phishing detection strategy is an important step in protecting an organization's cyberassets."]},{"component":"p","children":["Many email protection tools provide basic protection against phishing attacks by checking for malicious links or attachments within an email. However, spear phishing attacks do not require this kind of content to function since the goal may be to tell the recipient to wire money to a certain bank account in response to an attached, non-malicious invoice. Selection of an email protection tool that provides these advanced spear phishing detection features will improve an organization’s cybersecurity posture and decrease the probability of a breach."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5af/ee35792a3a44a7c8b4585/1500-0-","caption":"wk1003mike","isBlurred":true},"bestPicks":null},"related":{"relatedArticles":[{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"Using Lean Strategies to Achieve Team Synergy and Efficiency","canonical":"https://www.business.com/articles/lean-strategies-team-efficiency/","slug":"lean-strategies-team-efficiency","thumbnail":"https://www.business.com/images/content/5be/480e49c658a51108b458c/1500-0-","dek":"Learn more about lean manufacturing strategies and how to implement them in your business.","lastModified":"2018-11-08T08:00:00Z","published":"2018-11-08T08:00:00Z","sponsored":false},{"title":"How to Hire for Your Business","canonical":"https://www.business.com/articles/how-to-staff-business/","slug":"how-to-staff-business","thumbnail":"https://www.business.com/images/content/5ea/9c8bb9c658aee018b456c/1500-0-","dek":"Sterling Staffing Solutions CEO Stephen Carter shares his tips on staffing your business.","lastModified":"2020-07-31T15:00:00Z","published":"2018-08-16T12:00:00Z","sponsored":false},{"title":"Your Guide to Creating a Small Business Marketing Plan","canonical":"https://www.business.com/articles/sample-marketing-plan-outline-and-template/","slug":"sample-marketing-plan-outline-and-template","thumbnail":"https://www.business.com/images/content/5f3/3e1765a215eb62d8b4567/1500-0-","dek":"Follow these templates and guidelines to get started on creating your business's marketing plan.","lastModified":"2020-08-12T12:28:00Z","published":"2018-03-02T13:00:00Z","sponsored":false},{"title":"From COVID-19 to Hurricane Season: Disaster Preparedness for Small Business","canonical":"https://www.business.com/articles/business-disaster-prep/","slug":"business-disaster-prep","thumbnail":"https://www.business.com/images/content/5e7/a495e5a215eb11d8b4569/1500-0-","dek":"Natural disasters – whether a hurricane, tornado or outbreak like COVID-19 – can have a disastrous effect on small businesses, but they don't have to. Here's how to weather a disaster successfully.","lastModified":"2020-03-25T15:19:00Z","published":"2018-09-26T07:00:00Z","sponsored":false},{"title":"The Ultimate Small Business Guide to Credit Card Processing Fees","canonical":"https://www.business.com/articles/credit-card-processing-fees/","slug":"credit-card-processing-fees","thumbnail":"https://www.business.com/images/content/5d2/346547b437454698b4577/1500-0-","dek":"Learn about credit card processing fees and how to negotiate for lower costs.","lastModified":"2020-06-16T10:08:00Z","published":"2017-12-07T08:00:00Z","sponsored":false},{"title":"How to Choose the Best Business Loan","canonical":"https://www.business.com/articles/how-to-choose-a-business-loan/","slug":"how-to-choose-a-business-loan","thumbnail":"https://www.business.com/images/content/5db/c5c175a215e47798b456f/1500-0-","dek":"Small businesses have a lot of funding options, but choose wisely.","lastModified":"2020-02-04T14:25:00Z","published":"2020-02-04T14:25:00Z","sponsored":false},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay - 08-05","canonical":"https://staging.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://staging.business.com/images/content/5c5/afd7f54d26d67178b458d/1500-0-","dek":"Edit 07-24 - subtitle","lastModified":"2019-08-05T20:58:00Z","published":"2018-06-21T16:05:00Z","sponsored":null},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay","canonical":"https://www.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://www.business.com/images/content/5c5/e0a269c658a457c8b4591/1500-0-","dek":"You no longer need to carry a bulky wallet filled with numerous credit cards or cash.","lastModified":"2018-06-21T16:06:00Z","published":"2018-06-21T16:05:00Z","sponsored":false},{"title":"How Crooks Hack Passwords and How You Can Protect Your Business","canonical":"https://www.business.com/articles/how-crooks-hack-passwords/","slug":"how-crooks-hack-passwords","thumbnail":"https://www.business.com/images/content/5a7/2321651ee47ea618b4568/1500-0-","dek":"The use of traditional passwords is a slippery slope for companies these days.","lastModified":"2018-01-31T08:00:00Z","published":"2018-01-31T08:00:00Z","sponsored":false},{"title":"Cloud Encryption: Using Data Encryption in The Cloud","canonical":"https://www.business.com/articles/cloud-data-encryption/","slug":"cloud-data-encryption","thumbnail":"https://www.business.com/images/content/5d0/8eac17b437482458b4578/1500-0-","dek":"Data security remains a top concern in cloud adoption.","lastModified":"2018-07-03T12:10:00Z","published":"2018-07-03T12:10:00Z","sponsored":false},{"title":"7 Reasons to Hire Marketing Experts Rather Than Doing It Yourself","canonical":"https://www.business.com/articles/7-reasons-to-hire-marketing-experts/","slug":"7-reasons-to-hire-marketing-experts","thumbnail":"https://www.business.com/images/content/5a6/6603951ee4704458b4595/1500-0-","dek":"You may think DIY marketing is cheaper, but it could cost you far more in the long run.","lastModified":"2018-01-22T08:00:00Z","published":"2018-01-22T08:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df3d8695a215e58428b4570/POS_GETTY_DERO2084.jpg","canonical":"https://staging.business.com/categories/best-pos-systems/","title":"The Best POS Systems of 2021","dek":"Before you choose a POS system, check out our reviews of the best picks for 2021. ","slug":"best-pos-systems","lastModified":"2021-03-17T17:33:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2018-05-18T07:00:00.000Z","template":"legacy","title":"How Companies Are Detecting Spear Phishing Attacks Using Machine Learning","meta":{"robots":"index, follow"},"docType":"articles","slug":"machine-learning-spear-phishing","canonical":"https://staging.business.com/articles/machine-learning-spear-phishing/","skipTOC":false}},"staticQueryHashes":[]}