对比深度学习与心理语言学在商业邮件欺诈检测中的效果与效率
Semantic Superiority vs. Forensic Efficiency: A Comparative Analysis of Deep Learning and Psycholinguistics for Business Email Compromise Detection
- 用语义模型（DistilBERT）和语言特征模型（CatBoost）分别分析邮件内容
- 语义模型准确率接近完美，但处理速度较慢；语言特征模型更快但略逊一筹
- 适合需要高精度或低延迟的反欺诈系统选型参考
商业邮件妥协（BEC）是一种高影响的社会工程威胁，具有极端操作不对称性：漏报可能导致重大财务损失，误报则主要带来调查和延迟成本。本文在成本敏感决策框架下，比较两种BEC检测范式：(i) 基于语义的变换器方法（DistilBERT）用于上下文语言理解，(ii) 基于法医心理语言学的方法（CatBoost），利用人工设计的语言与结构特征。我们在一个混合数据集（N = 7,990）上评估两者，该数据集结合了合法企业邮件和30种BEC分类中生成的AI对抗性欺诈邮件，包括字符级Unicode混淆。还引入经典基线（TF-IDF+LogReg 和字符n-gram+Linear SVM）、Smiling Assassin Score消融研究以及同形字映射敏感性分析。DistilBERT在GPU上实现每封邮件7.403毫秒，AUC=1.0000，F1=0.9981；CatBoost在CPU上实现每封邮件0.855毫秒，AUC=0.9860，F1=0.9382。三类成本敏感决策策略（自动放行、自动拦截、人工审查）在假阴性与假阳性成本比为1:5,167时，可优化预期财务损失。
原文摘要 · Abstract (English)
Business Email Compromise (BEC) is a high-impact social engineering threat with extreme operational asymmetry: false negatives can trigger large financial losses, while false positives primarily incur investigation and delay costs. This paper compares two BEC detection paradigms under a cost-sensitive decision framework: (i) a semantic transformer approach (DistilBERT) for contextual language understanding, and (ii) a forensic psycholinguistic approach (CatBoost) using engineered linguistic and structural cues. We evaluate both on a hybrid dataset (N = 7,990) combining legitimate corporate email and AI-synthesised adversarial fraud generated across 30 BEC taxonomies, including character-level Unicode obfuscations. We add classical baselines (TF-IDF+LogReg and character n-gram+Linear SVM), an ablation study for the Smiling Assassin Score, and a homoglyph-map sensitivity analysis. DistilBERT achieves AUC = 1.0000 and F1 = 0.9981 at 7.403 ms per email on GPU; CatBoost achieves AUC = 0.9860 and F1 = 0.9382 at 0.855 ms on CPU. A three-way cost-sensitive decision policy (auto-allow, auto-block, manual review) optimises expected financial loss under a 1:5,167 false-negative-to-false-positive cost ratio.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。