Detection of business email compromise attacks

A computer-implemented method comprising:

• receiving a target email from a sender, the sender purportedly being a particular user;
• selecting, from among a plurality of business email compromise (BEC) emails, a particular BEC email that has a same intention as and most similar to the target email, the intention being what the sender is inducing a recipient of the target email to perform;
• determining similarity of the target email with the particular BEC email;
• after receiving the target email, generating a user email with a message that includes words typically used by the particular user for the same intention as the target email;
• determining similarity of the target email with the user email;
• deeming the target email to be part of a BEC attack and not sent by the particular user when the target email is more similar to the particular BEC email than to the user email;
• and
• in response to deeming the target email to be part of the BEC attack and not sent by the particular user, blocking the target email.

A

• a computer comprising a processor and a memory, the memory comprising instructions that when executed by the processor cause the computer to:
• receive a target email in a private computer network, the target email being from a sender and is addressed to a recipient, the sender purportedly being a user of the private computer network;
• determine similarity of the target email with a known business email compromise (BEC) email of a BEC attack;
• after the target email has been received in the private computer network, generate a user email with a message that includes words typically used by the user of the private computer network for a same intention as the target email, the intention being what the sender is inducing the recipient to perform;
• determine similarity of the target email with the user email;
• deem the target email to be part of the BEC attack and not sent by the user of the private computer network when the target email is more similar to the known BEC email than to the user email;
• and
• in response to deeming the target email to be part of the BEC attack and not sent by the user of the private computer network, block the target email.