用个性化神经网络识别邮件作者,防内部账号被冒用。
Per-sender neural network classifiers for email authorship validation
- 为每位发件人训练专属写作风格模型,实时验证邮件真伪。
- 字符级卷积网络在多场景下准确率与F1值均超90%。
- 适合企业邮件安全系统部署,对性能影响极小。
商业电子邮件欺诈和横向鱼叉式网络钓鱼是现代组织中最昂贵且破坏性最大的威胁之一。尽管入站钓鱼防御已显著提升,大多数组织仍默认信任内网邮件,导致员工账户被攻破后易受攻击。本文提出并研究了作者身份验证问题:验证声称的发件人是否真正撰写了某封邮件。该方法是一种轻量级、实时的防御手段,通过建模每位发件人的写作风格来补充传统检测方式。论文还基于Enron语料库构建了新数据集,模拟了人工撰写和大语言模型生成的非真实邮件。评估了朴素贝叶斯模型与字符级卷积神经网络(Char-CNN)两种分类器。实验表明,Char-CNN在多种条件下均达到高准确率与高F1分数。最后讨论了部署可行性,证明每发件人分类器可低开销集成至现有商业邮件安全系统中。
原文摘要 · Abstract (English)
Business email compromise and lateral spear phishing attacks are among modern organizations' most costly and damaging threats. While inbound phishing defenses have improved significantly, most organizations still trust internal emails by default, leaving themselves vulnerable to attacks from compromised employee accounts. In this work, we define and explore the problem of authorship validation: verifying whether a claimed sender actually authored a given email. Authorship validation is a lightweight, real-time defense that complements traditional detection methods by modeling per-sender writing style. Further, the paper presents a collection of new datasets based on the Enron corpus. These simulate inauthentic messages using both human-written and large language model-generated emails. The paper also evaluates two classifiers -- a Naive Bayes model and a character-level convolutional neural network (Char-CNN) -- for the authorship validation task. Our experiments show that the Char-CNN model achieves high accuracy and F1 scores under various circumstances. Finally, we discuss deployment considerations and show that per-sender authorship classifiers are practical for integrating into existing commercial email security systems with low overhead.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。