Detecting Credential Spearphishing in Enterprise Settings
summary
A real-world deployment analyzes 372 million emails with five focused features: sender-login anomalies derived from LDAP (new IP geolocated city and prior city logins), click-only exploit signals using the clicked URL’s fully qualified domain visit count and days-since-first-visit, and a click filter to limit alerts. Detection uses a nonparametric ranking where DES counts events more benign in every dimension to score anomalies under a budget of 10 alerts per day, finding 17 of 19 campaigns (2 previously unknown) with a 0.0004% false positive rate.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:32What are spear phishing attacks
- 3:08Our goal
- 4:29Challenges
- 5:42The Lure and Exploit Stages
- 12:36Manual Rules
- 14:21Unsupervised Learning
- 17:27DES
- 19:50RealTime Detector
- 22:24RealTime Detector Results
- 24:32Conclusion
related talks
05mKnowledge and Capabilities that Non-Expert Users Bring to Phishing Detection
27mBlunting the Phisher's Spear: A Risk-Based Approach...
29mBecoming You: A Glimpse Into Credential Abuse
53mRisk Profiles: Why Some Employees Attract Danger and Others Dodge It
42mPhishing With a Net: The NIST Phish Scale and Cybersecurity Awareness
26mIntegrating Identity and Fraud
07mSpear Phishing the Masses: When Open Data is Dark
09mPresenting Suspicious Details in User-Facing E-mail Headers Does Not Improve...