Ao Kaspersky Lab

Roman A Dedenok

Dmitry S Golubev

Yury G Slobodyanuk

Nikita D Benkovich

Petr A Salnikov

Andrey A But

Daniil M Kovalchuk

A method creating a heuristic rule to identify Business Email Compromise (BEC) attacks includes filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network that includes a language model, generating, using the first classifier, one or more n-grams based on the extracted terms, wherein each of the n-grams characterizes a particular extracted term, generating, using a second classifier, a vector representation of the extracted terms based on the generated n-grams, assigning a weight coefficient to each of the extracted terms, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding extracted term, and generating a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the extracted terms.

System and method for creating heuristic rules based on received email messages to identity business email compromise attacks

A method for restricting reception of e-mail messages from a sender of bulk spam mail includes identifying an unknown sender of received e-mail messages. A set of e-mail messages received from the identified sender is selected. A type of bulk spam mailing is determined based on the selected set of e-mail messages using one or more spam identification signatures. Restrictions on reception of e-mail messages from a sender distributing bulk spam of the determined type are generated.

System and method for restricting the reception of e-mails from a sender of bulk spam mail

Disclosed herein are systems and method for spam identification. A spam filter module may receive an email at a client device and may determine a signature of the email. The spam filter module may compare the determined signature with a plurality of spam signatures stored in a database. In response to determining that no match exists between the determined signature and the plurality of spam signatures, the spam filter module may placing the email in quarantine. A spam classifier module may extract header information of the email and determine a degree of similarity between known spam emails and the email. In response to determining that the degree of similarity exceeds a threshold, the spam filter module may transfer the email from the quarantine to a spam repository.

System and method for identifying spam email

A method for creating a heuristic rule to identify Business Email Compromise (BEC) attacks includes filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages. One or more n-grams are generated, using the first classifier, based on the extracted terms. A vector representation of the extracted terms is generated, using a second classifier, based on the generated one or more n-grams. The second classifier includes a logit model. A weight coefficient is assigned to each of the one or more extracted terms based on an output of the trained logit model. A higher weight coefficient indicates higher relevancy to BEC attack of the corresponding term. A heuristic rule associated with the BEC attack is generated by combining the weight coefficients of a combination of the one or more extracted terms.

System and method for creating heuristic rules to detect fraudulent emails classified as business email compromise attacks

Disclosed herein are systems and methods for generating heuristic rules for identifying spam emails based on fields in headers of emails. In one aspect, an exemplary method comprises, collecting statistical data on contents of a plurality of emails; analyzing the statistical data to identify different types of content, including headers or hyperlinks in said emails; grouping the emails into clusters based on types of content identified in said emails, wherein at least one cluster group being based on fields in headers of said emails; generating a hash from the most frequent combination of group of data in each cluster; formulating regular expressions based on analysis of hyperlinks of emails corresponding to the generated hashes; and generating heuristic rule for identifying spam emails by combining the hashes and the corresponding regular expressions, wherein the hash is generated based on fields in the headers of said emails.

System and method for generating heuristic rules for identifying spam emails based on fields in headers of emails

Disclosed herein are systems and methods for generating heuristic rules for identifying spam emails. In one aspect, an exemplary method comprises, collecting and analyzing statistical data on contents of a emails to identify different types of content, including headers or hyperlinks, grouping the emails into clusters based on identified types of content, at least one cluster including groups of fields in the headers of said emails, selecting at least one most frequent combination of groups of data in each cluster, generating a hash from the at least one most frequent combination of groups, formulating at least one regular expression based on an analysis of hyperlinks corresponding to the generated hashes, and generating at least one heuristic rule for identifying emails containing spam by combining at least one hash and the corresponding regular expression, wherein at least one hash is from sequences of fields in the headers of said emails.

System and method for generating heuristic rules for identifying spam emails

Systems and methods for identifying a spam email message. A system can include a rules database configured to store a plurality of ratio determination rules, a vectors database configured to store a plurality of known vectors, a message processing tool configured to receive an email message, a gram building tool configured to build a k-skip-n-gram set of word combinations according he ratio determination rules, a vector building tool configured to receive the k-skip-n-gram set of word combinations, and build a vector for each k-skip-n-gram word combination, and a spam identification tool configured to determine a spam presence threshold based on the cosine similarity for each k-skip-n-gram word combination and the plurality of known vectors for the particular email message subject field subject category, and determine that the email message contains spam when the spam presence threshold is exceeded.

Growing community of inventors

Moscow, Russia

Roman A Dedenok