Browse > Article
http://dx.doi.org/10.13089/JKIISC.2020.30.5.835

A Study on the Effective Countermeasure of Business Email Compromise (BEC) Attack by AI  

Lee, Dokyung (Korea University)
Jang, Gunsoo (DHI&C)
Lee, Kyung-ho (Korea University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.30, no.5, 2020 , pp. 835-846 More about this Journal
Abstract
BEC (Business Email Compromise) attacks are frequently occurring by impersonating accounts or management through e-mail and stealing money or sensitive information. This type of attack accounts for the largest portion of the recent trade fraud, and the FBI estimates that the estimated amount of damage in 2019 is about $17 billion. However, if you look at the response status of the companies compared to this, it relies on the traditional SPAM blocking system, so it is virtually defenseless against the BEC attacks that social engineering predominates. To this end, we will analyze the types and methods of BEC accidents and propose ways to effectively counter BEC attacks by companies through AI(Artificial Intelligence).
Keywords
Business email compromise; BEC; SCAM; Social engineering; email attack; Machine Learning;
Citations & Related Records
연도 인용수 순위
  • Reference
1 FSEC, "2020 Cybersecurity Issue Forecast Report," http://www.fsec.or.kr/fsec/index.do, Mar. 2020
2 KISA, "2019 KISA Cyber Threat Trend Report," KISA,https://www.krcert.or.kr/data/reportView.do?bulletin_writing_sequence=35239, Feb. 2020
3 Trendmicro, "Business Email Compromise," https://www.trendmicro.com/vinfo/us/security/definition/businessemail-compromise-(bec), Mar. 2020
4 R Sikorski, R Peters, "A privacy primer for the Web: spam, bread crumbs, and cookies," The Journal of the American Medical Association, ISSN 0098-7484, E-ISSN 1538-3598, Apr. 1998
5 Hinde Stephen, "Spam: the evolution of a nuisance," pp. 474-478, ISSN 0167-4048, Sept. 2003
6 W.G. Hoover, C.G. Hoover, "SPAM-based recipes for continuum simulations," pp. 78-85, ISSN 1521-9615, Mar/Apr. 2001
7 DuBoff, Leonard D, King, Christy O, Educators Beware, "Avoiding the Scams," pp. 11-13, ISSN 8756-3894, E-ISSN 1559-7075, Mar/Apr. 2009
8 Deborah Schaffer, "THE LANGUAGE OF SCAM SPAMS: LINGUISTIC FEATURES OF NIGERIAN FRAUD E-MAILS," pp. 157-179, ISSN 0014-164X , Apr. 2012
9 FBI, "FBI IC3 2019 Internet Crime Report," https://www.fbi.gov/news/stories/2019-internet-crime-report-released-021120, Jan. 2020
10 Peter Ribic, "The Nigerian email scam novel," pp. 424-436, ISSN 1744-9855, Jan. 2019
11 Blanzieri, Enrico and Anton Bryl, "A survey of learning-based techniques of email spam filtering," Artificial Intelligence Review 29.1, pp. 63-92, July. 2008   DOI
12 JAKOBSSON and Bjorn Markus, "Detection of business email compromise," U.S. Patent Application No 15/414,489, Aug. 2017.
13 ZWEIGHAFT and David, "Business email compromise and executive impersonation: are financial institutions exposed?," Journal of Investment Compliance, May. 2017.
14 Hyun-Jun Kirn, Jason J. Jung and 0eun-Sik Jo. "Spam-Mail Filtering System Using Weighted Bayesian Classifier," Journal of KIISE: software and usage products 31.8, pp. 1092-1100, Aug. 2004
15 Wikipedia, "email header Standard," https://tools.ietf.org/html/rfc822, Feb. 2020
16 BecomingHuman.AI, "AI algorithms," https://becominghuman.ai/, Feb. 2020
17 Microsoft, "ML Algorithms Sheet," https://docs.microsoft.com/, Feb. 2020
18 Wikipedia, "Confusion Matrix," https://en.wikipedia.org/wiki/Confusion_matrix, Mar. 2020
19 Sango Lee, "Spam-Filtering by Identifying Automatically Generated Email Accounts," Journal of the Society of Information Sciences," Software and Applications 32.5, pp. 378-384, May. 2005
20 Jindal, Nitin, and Bing Liu. "Review spam detection," Proceedings of the 16th international conference on World Wide Web, pp. 1189-1190, May. 2007.
21 Markines, Benjamin, Ciro Cattuto, and Filippo Menczer. "Social spam detection," Proceedings of the 5th International Workshop on Adversarial Information Retrieval on the Web, pp. 41-48, Apr. 2009.
22 Barreno, Marco, et al. "The security of machine learning," Machine Learning 81.2, pp. 121-148, Apr. 2010   DOI
23 Remorin, Lord, Ryan Flores, and Bakuei Matsukawa, "Tracking Trends in Business Email Compromise (BEC) Schemes," Trend Micro 18.1, 2018
24 Buczak, Anna L., and Erhan Guven. "A survey of data mining and machine learning methods for cyber security intrusion detection," IEEE Communications surveys & tutorials 18.2, pp. 1153-1176, Oct. 2015   DOI
25 Blog, "levenshtein algorithm," https://www.cuelogic.com/blog/the-levenshtein-algorithm, Jan. 2020
26 Papernot, Nicolas, et al. "Towards the science of security and privacy in machine learning," :1611.03814, Nov. 2016
27 Akinyelu, Andronicus A and Aderemi O. Adewumi, "Classification of phishing email using random forest machine learning technique," Journal of Applied Mathematics 2014, Apr. 2014
28 Academic Information, "BEC, SCAM, social engineering," https://academic.naver.com/, Feb, 2020
29 Scholar, "BEC, SCAM, social engineering," https://scholar.google.co.kr/,Feb, 2020