System and method for creating heuristic rules based on received email messages to identity business email compromise attacks

A system for creating a heuristic rule to identify Business Email Compromise (BEC) attacks, the system comprising:

• at least one memory;
• and
• at least one hardware processor coupled with the at least one memory and configured, individually or in combination, to:
• filter text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network that includes a language model;
• generate, using the first classifier, one or more n-grams based on the one or more extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term;
• generate, using a second classifier, a vector representation of the one or more extracted terms based on the generated one or more n-grams;
• assign a weight coefficient to each of the one or more extracted terms, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding extracted term;
• and
• generate a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms.

A non-transitory computer readable medium storing thereon computer executable instructions creating a heuristic rule to identify Business Email Compromise (BEC) attacks, including instructions for:

• filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network that includes a language model;
• generating, using the first classifier, one or more n-grams based on the one or more extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term;
• generating, using a second classifier, a vector representation of the one or more extracted terms based on the generated one or more n-grams;
• assigning a weight coefficient to each of the one or more extracted terms, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding extracted term;
• and
• generating a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms.