[Paper Review] That Ain't You: Detecting Spearphishing Emails Before They Are Sent

Gianluca Stringhini, Olivier Thonnard|arXiv (Cornell University)|Oct 24, 2014

Spam and Phishing Detection39 references3 citations

TL;DR

This paper introduces IdentityMailer, a system that detects spearphishing emails sent from compromised corporate email accounts by modeling users' legitimate email-sending behavior—such as timing, recipients, and writing style—and flagging deviations as potential impersonation. It effectively blocks stealthy, targeted attacks that evade traditional spam and phishing filters by focusing on behavioral anomalies rather than content or origin.

ABSTRACT

One of the ways in which attackers try to steal sensitive information from corporations is by sending spearphishing emails. This type of emails typically appear to be sent by one of the victim's coworkers, but have instead been crafted by an attacker. A particularly insidious type of spearphishing emails are the ones that do not only claim to come from a trusted party, but were actually sent from that party's legitimate email account that was compromised in the first place. In this paper, we propose a radical change of focus in the techniques used for detecting such malicious emails: instead of looking for particular features that are indicative of attack emails, we look for possible indicators of impersonation of the legitimate owners. We present IdentityMailer, a system that validates the authorship of emails by learning the typical email-sending behavior of users over time, and comparing any subsequent email sent from their accounts against this model. Our experiments on real world e-mail datasets demonstrate that our system can effectively block advanced email attacks sent from genuine email accounts, which traditional protection systems are unable to detect. Moreover, we show that it is resilient to an attacker willing to evade the system. To the best of our knowledge, IdentityMailer is the first system able to identify spearphishing emails that are sent from within an organization, by a skilled attacker having access to a compromised email account.

Motivation & Objective

• To address the growing threat of spearphishing attacks that exploit compromised internal email accounts.
• To overcome the limitations of traditional spam and phishing detection systems, which fail when attacks originate from legitimate accounts.
• To detect subtle, targeted spearphishing emails that mimic genuine user behavior but are authored by attackers.
• To develop a system that validates email authorship by learning individual user behavior profiles over time.
• To ensure resilience against evasion by attackers attempting to imitate legitimate user behavior.

Proposed method

• IdentityMailer builds a behavioral profile for each user based on their historical email-sending patterns, including timing, recipient frequency, and linguistic features such as functional words.
• It enhances profile accuracy by incorporating email patterns from other users in the organization, de-emphasizing common behaviors shared across users.
• The system uses machine learning to compare new outgoing emails against the user’s behavioral model, identifying anomalies indicative of impersonation.
• It focuses on 'writeprint' features—such as specific function words and phrase usage—that are highly individualized and difficult for attackers to replicate.
• The system detects anomalies not only in content but also in metadata, such as sending times and social network interactions, to improve detection robustness.
• It is designed to resist evasion by attackers who attempt to mimic legitimate behavior, as the model captures subtle, long-term behavioral patterns.

Experimental results

Research questions

• RQ1 Can a system detect spearphishing emails sent from compromised internal email accounts that evade traditional spam and phishing filters?
• RQ2 How effective is behavioral modeling in distinguishing between legitimate and impersonated emails, even when content appears normal?
• RQ3 Can the system detect stealthy, one-off spearphishing attacks that do not exhibit obvious anomalies like mass-mailing?
• RQ4 To what extent can an attacker evade the system by imitating a user’s behavior, including timing and writing style?
• RQ5 How does combining multiple behavioral signals (timing, recipients, language) improve detection beyond content-based or origin-based methods?

Key findings

• IdentityMailer successfully detects advanced spearphishing attacks sent from compromised accounts that are undetected by traditional spam and phishing filters.
• The system effectively identifies anomalies even in emails with normal content and origin, by focusing on behavioral deviations from the user’s profile.
• Experiments on real-world email datasets show that IdentityMailer blocks attacks that state-of-the-art systems fail to detect.
• The system is resilient to evasion: attackers cannot reliably mimic the full range of behavioral patterns without being detected.
• By leveraging both individual and organizational email patterns, IdentityMailer reduces false positives while maintaining high detection accuracy for targeted attacks.
• IdentityMailer is the first system to specifically detect spearphishing emails sent from within an organization by attackers who have compromised legitimate accounts.