System and method for creating heuristic rules to detect fraudulent emails classified as business email compromise attacks

A system for creating a heuristic rule to identify Business Email Compromise (BEC) attacks, the system comprising:

• a hardware processor configured to:
• filter text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network;
• generate, using the first classifier, one or more n-grams based on the extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term;
• generate, using a second classifier, a vector representation of the extracted terms based on the generated one or more n-grams, wherein the second classifier comprises a logit model;
• train the logit model using the vector representation of the extracted terms;
• assign a weight coefficient to each of the one or more extracted terms based on an output of the trained logit model, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding term;
• and
• generate a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms.

A non-transitory computer readable medium storing thereon computer executable instructions creating a heuristic rule to identify Business Email Compromise (BEC) attacks, including instructions for:

• filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network;
• generating, using the first classifier, one or more n-grams based on the extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term;
• generating, using a second classifier, a vector representation of the extracted terms based on the generated one or more n-grams, wherein the second classifier comprises a logit model;
• training the logit model using the vector representation of the extracted terms;
• assigning a weight coefficient to each of the one or more extracted terms based on an output of the trained logit model, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding term;
• and
• generating a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms.