Classifying spearphising: NLP to distinguish new acquaintances and targeted e-mail attacks

Targeted e-mail attacks have developed in sophistication to become the greatest security threat to organizations. However false positives, e-mails mistakenly blocked is not a price organizations can pay to improve their security. Measuring the interactions between known personnel is possible through historical training data. E-mails from strangers or new acquaintances presents a unique problem. There is no pattern of behavior to define what is normal in this relationship. We are developing models to better capture norms among strangers and distinguish attacks from those. This presentation will focus on the natural language processing component of the cold start problem. It will explore the hierarchical approach we are taking to develop lexicons of language specific to clusters of personnel in organizations that enable us to better classify strangers from attackers.