# US 12,113,826 B2 · System and method for creating heuristic rules based on received email messages to identity business email compromise attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,826 B2 - Document ID: US12113826B2 - Status: Granted - Kind: B2 - Application number: 18/524,871 - Filed: 2023-11-30 - Published: 2024-03-28 - Granted: 2024-10-08 - Earliest claimed: 2021-02-10 - Assignees: AO Kaspersky Lab - Applicants: AO Kaspersky Lab - Inventors: Roman A Dedenok; Nikita D. Benkovich; Dmitry S. Golubev; Yury G. Slobodyanuk - Web page: https://patentgrep.com/patent/US12113826B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - G06N 3/08: Learning methods - G06N 3/082: modifying the architecture, e.g. adding, deleting or silencing nodes or connections - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 5/025: Extracting rules from data - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - G06N 20/20: Ensemble learning - H04L 51/08: Annexed information, e.g. attachments - H04L 51/212: using filtering or selective blocking - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method creating a heuristic rule to identify Business Email Compromise (BEC) attacks includes filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network that includes a language model, generating, using the first classifier, one or more n-grams based on the extracted terms, wherein each of the n-grams characterizes a particular extracted term, generating, using a second classifier, a vector representation of the extracted terms based on the generated n-grams, assigning a weight coefficient to each of the extracted terms, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding extracted term, and generating a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the extracted terms. ## Claims ### Claim 1 A method for creating a heuristic rule based on received email messages to identify Business Email Compromise (BEC) attacks, the method comprising: filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network that includes a language model; generating, using the first classifier, one or more n-grams based on the one or more extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term; generating, using a second classifier, a vector representation of the one or more extracted terms based on the generated one or more n-grams; assigning a weight coefficient to each of the one or more extracted terms, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding extracted term; and generating a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms. ### Claim 2 (depends on 1) The method of claim 1, wherein the heuristic rule associated with an internal BEC attacks is created by adding a condition to the heuristic rule that includes one or more attributes of the received email message indicating that the received email message comprises an internal email. ### Claim 3 (depends on 2) The method of claim 2, wherein the one or more attributes indicating that the received email message comprises an internal email include at least one of: a domain in the sender's address of the email message and in recipient's address of the email message is the same, the sender's address of the email message is included in a list of trusted email addresses, an IP address of the sender of the email message is included in a list of trusted IP addresses. ### Claim 4 (depends on 1) The method of claim 1, wherein one or more attributes indicating fraud includes information specified in the text of the received email message intended to steal money or information intended to steal confidential information. ### Claim 5 (depends on 4) The method of claim 4, wherein the specified information includes at least information requesting payment of a bill, information requesting personal or corporate data that is not publicly available, a URL address to a third-party resource, or a file containing malicious code. ### Claim 6 (depends on 1) The method of claim 1, wherein the trained recurrent neural network is pre-trained on a large number of open-source texts in at least one natural language. ### Claim 7 (depends on 1) The method of claim 1, wherein the language model of the trained recurrent neural network comprises an Average-Stochastic Gradient Descent Weight-Dropped-Long Short Term Memory (AWD-LSTM) language model. ### Claim 8 (depends on 7) The method of claim 7, wherein the AWD-LSTM language model is additionally trained in such a manner that an output layer of the AWD-LSTM language model predicts the presence of the BEC attack in the received email message. ### Claim 9 (depends on 1) The method of claim 1, further comprising: training a logit model using the vector representation of the extracted terms, wherein the logit model is configured to use a logistical regression with an L1 regularizer. ### Claim 10 (depends on 1) The method of claim 1, wherein the weight coefficient characterizes a degree of contribution of a particular extracted term of the one or more extracted terms to final prediction of the correspondence of the received email messages to a BEC attack category or an internal BEC attack category. ### Claim 11 (depends on 1) The method of claim 1, wherein the extracted term comprises a single word or a word combination. ### Claim 12 (depends on 1) The method of claim 1, wherein the vector representation of the extracted terms is generated based on the one or more of n-grams using statistical measure of term frequency-inverse document frequency (TF-IDF) normalization and an L2 regularizer. ### Claim 13 A system for creating a heuristic rule to identify Business Email Compromise (BEC) attacks, the system comprising: at least one memory; and at least one hardware processor coupled with the at least one memory and configured, individually or in combination, to: filter text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network that includes a language model; generate, using the first classifier, one or more n-grams based on the one or more extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term; generate, using a second classifier, a vector representation of the one or more extracted terms based on the generated one or more n-grams; assign a weight coefficient to each of the one or more extracted terms, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding extracted term; and generate a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms. ### Claim 14 (depends on 13) The system of claim 13, wherein the heuristic rule associated with an internal BEC attacks is created by adding a condition to the heuristic rule that includes one or more attributes of the received email message indicating that the received email message comprises an internal email. ### Claim 15 (depends on 14) The system of claim 14, wherein the one or more attributes indicating that the received email message comprises an internal email include at least one of: a domain in the sender's address of the email message and in recipient's address of the email message is the same, the sender's address of the email message is included in a list of trusted email addresses, an IP address of the sender of the email message is included in a list of trusted IP addresses. ### Claim 16 (depends on 13) The system of claim 13, wherein one or more attributes indicating fraud includes information specified in the text of the received email message intended to steal money or information intended to steal confidential information, and wherein the specified information includes at least information requesting payment of a bill, information requesting personal or corporate data that is not publicly available, a URL address to a third-party resource, or a file containing malicious code. ### Claim 17 (depends on 13) The system of claim 13, wherein the language model of the trained recurrent neural network comprises an Average-Stochastic Gradient Descent Weight-Dropped-Long Short Term Memory (AWD-LSTM) language model. ### Claim 18 (depends on 17) The system of claim 17, wherein the AWD-LSTM language model is additionally trained in such a manner that an output layer of the AWD-LSTM language model predicts the presence of the BEC attack in the received email message. ### Claim 19 (depends on 13) The system of claim 13, wherein the hardware processor is further configured to train a logit model using the vector representation of the extracted terms, wherein the logit model is configured to use a logistical regression with an L1 regularizer. ### Claim 20 A non-transitory computer readable medium storing thereon computer executable instructions creating a heuristic rule to identify Business Email Compromise (BEC) attacks, including instructions for: filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network that includes a language model; generating, using the first classifier, one or more n-grams based on the one or more extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term; generating, using a second classifier, a vector representation of the one or more extracted terms based on the generated one or more n-grams; assigning a weight coefficient to each of the one or more extracted terms, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding extracted term; and generating a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms.