Patent ID: 11888891
Assignee: AO KASPERSKY LAB
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A method for creating a heuristic rule to identify Business Email Compromise (BEC) attacks, the method comprising:
filtering text of received email messages, using a first classifier, to extract one or more terms indicative of a BEC attack from the text of the received email messages, wherein the first classifier includes a trained recurrent neural network;
generating, using the first classifier, one or more n-grams based on the extracted terms, wherein each of the one or more n-grams characterizes a particular extracted term;
generating, using a second classifier, a vector representation of the extracted terms based on the generated one or more n-grams, wherein the second classifier comprises a logit model;
training the logit model using the vector representation of the extracted terms;
assigning a weight coefficient to each of the one or more extracted terms based on an output of the trained logit model, wherein a higher weight coefficient indicates higher relevancy to BEC attack of the corresponding term; and
generating a heuristic rule associated with the BEC attack by combining the weight coefficients of a combination of the one or more extracted terms.