## 4 Methodology Strategies Preventing BEC Attacks
### Technical Methods  
Prevention alone is a good start, but it will not suffice against BEC attackers and their evolving techniques. The second line of defense should technical methods, such as:  
* Anti-spam and anti-malware software: Anti-spam software provides protection from spam and phishing attacks, while anti-malware software is able to detect malware. Both of the aforementioned attacks can be part of a BEC scheme. * Time-of-click protection: This rewrites URLs in email messages and provides point-of-click protection using multiple reputation services [28]. * Executive tracking list: Uses details synched from an Active Directory to automatically detect users' real names within header and envelope address fields [28]. * Nearby domains: Compares the sender domain to legitimate domain names to identify nearby domains, meaning domains that vary by one or two characters [28]. * Directory harvest attack (DHA) prevention: Drops an email destined for invalid or fake email addresses [28]. * Multi-factor authentication (MFA): MFA provides a valid means for authentication that requires two or more verification factors to gain access to a resource [29]. * Email protocols: confirm that email protocols are updated and ban old email protocols (POP, IMAP, STMP) that can be used to override MFA. * DKIM: DomainKey Mail (DKIM) is a cryptographic method for email integrity checks and authentication. Emails are signed by the private key of the sending domain, and the receiver domain verifies the signature of the email using the public key of the sender domain available through DNS. * SPF: Sender Policy Framework (SPF) provides validation of an email's IP from a list of authorized IP addresses. * DMARC authentication: Domain-based Message Authentication, Reporting and Conformance (DMARC) combines mechanisms that include DKIM and SPF, and it prevents attackers from spoofing the organization and domain [30]. Its main weakness is that DMARC processes only header information, and it is weak against impersonation. * Encryption: Encryption can be used to prevent data breaches by requiring both the sender and receiver to have a pair of cryptographic keys. * Verifiers: Using applications like an invoice verifier, which can scan a QR code on an invoice, provides a verification method that allows users to ensure the authenticity of the invoice attached in an email [31]. * Machine Learning (ML): machine learning technology, as part of the field of artificial intelligence, is composed by algorithms that can analyze email data to construct a model that can classify them and report any anomalies as red flags indicating BEC attempts [32]. While all the above counter measurements are required to successfully repel BEC attacks, the most promising and ever developing field is that of ML. ML algorithms can detect fraudulent email addresses, scan for red flags like the absence of DMARC, and learn, from email databases, the normal behavior of a user. There are four categories of machine learning algorithms ([33, 34, 35]), the selection of which can be determined by the needs of each company:  
* Supervised learning: The operator provides the machine learning algorithm with a known dataset that includes desired inputs and outputs, and the algorithm must find a method to determine how to arrive at those inputs and outputs. The algorithm tries to model relationships between the target output and the input features and match the operator's results. This process continues until the algorithm achieves a high level of accuracy. * Semi-supervised learning: Semi-supervised learning is similar to supervised learning in the way that it uses labeled data and is similar to unsupervised learning because it also uses unlabeled data. An operator can use a small amount of data to train a model to classify the rest of the unlabeled data in a dataset. * Unsupervised learning: In this case, the algorithm studies data to identify patterns without the help of a human operator.