[Paper Review] Detecting and Characterizing Lateral Phishing at Scale

Grant Ho, Asaf Cidon+6 more|arXiv (Cornell University)|Oct 2, 2019

Spam and Phishing Detection43 citations

TL;DR

The paper presents a large-scale detection and characterization of lateral phishing using 113 million employee-sent emails from 92 organizations, achieving 87.3% detection with under four false positives per one million emails, and analyzes attacker strategies.

ABSTRACT

We present the first large-scale characterization of lateral phishing attacks, based on a dataset of 113 million employee-sent emails from 92 enterprise organizations. In a lateral phishing attack, adversaries leverage a compromised enterprise account to send phishing emails to other users, benefitting from both the implicit trust and the information in the hijacked user's account. We develop a classifier that finds hundreds of real-world lateral phishing emails, while generating under four false positives per every one-million employee-sent emails. Drawing on the attacks we detect, as well as a corpus of user-reported incidents, we quantify the scale of lateral phishing, identify several thematic content and recipient targeting strategies that attackers follow, illuminate two types of sophisticated behaviors that attackers exhibit, and estimate the success rate of these attacks. Collectively, these results expand our mental models of the 'enterprise attacker' and shed light on the current state of enterprise phishing attacks.

Motivation & Objective

• Study the scale and impact of lateral phishing in real-world enterprises.
• Develop a practical detector using minimal data (historical emails) that yields low false positives.
• Characterize attacker strategies, targeting, and content tailoring in lateral phishing at scale.

Proposed method

• Construct a classifier to detect URL-based lateral phishing using features derived from recipient set, lure keywords, and URL reputation.
• Use three feature sets: recipient likelihood (recipients per email and similarity to historical recipient sets), lure indicators based on a phishy keyword list, and exploit indicators via global and local URL reputation features.
• Train a Random Forest classifier on a ground-truth mix of user-reported attacks and benign emails, with cross-validation and a 200:1 benign-to-attack sampling ratio.
• Evaluate with a temporal split: train on April–June 2018 data from 52 exploratory organizations and test on July–October 2018 data from 92 organizations, including a held-out 40 organizations.
• Report metrics at the incident level (unique (subject, sender) pairs) to reflect practical alert behavior.

Experimental results

Research questions

• RQ1 What is the scale and prevalence of lateral phishing across multiple enterprises?
• RQ2 Can a detector operate effectively with minimal data (historical emails) and still achieve practical accuracy?
• RQ3 What attacker behaviors and content strategies characterize lateral phishing in real-world deployments?
• RQ4 How effective is the detector in identifying known and new lateral phishing incidents, and how many false positives does it generate?

Key findings

• The detector identified 87.3% of lateral phishing incidents in the test set.
• The detector generated 316 false positives over 87,413,431 emails in the test period (0.00036% FP rate).
• Across training data (April–June 2018), the detector correctly identified 88.6% of incidents with 62 total false positives among 25.7 million emails.
• In the test dataset, the detector found 49 new incidents not reported by users and 47 known incidents, with a precision of 23.3% and a detection rate of 87.3%.
• Global URL reputation and number of recipients were the most important features (weights 0.42 and 0.34 respectively) for the classifier.