An NLP-driven framework for Business Email Compromise detection and authorship verification

Abstract

Business Email Compromise (BEC) represents a significant cybersecurity threat that exploits linguistic impersonation and social engineering, rather than relying on traditional malware or malicious attachments. These attacks often bypass conventional detection systems by mimicking the language, tone, and identity of trusted individuals within an organization.

This thesis investigates content-based approaches to BEC detection using a suite of natural language processing (NLP) models. It first introduces a transformer-based classifier to identify semantic indicators of deception within email body text. It then presents a Siamese authorship verification (AV) model designed to detect stylistic inconsistencies, even under adversarial mimicry. These components are integrated into a unified multi-task learning (MTL) framework that jointly optimizes for BEC detection and AV, leveraging shared representations while preserving task-specific objectives.

To support empirical evaluation, the thesis proposes a structured taxonomy of BEC fraud and constructs a synthetic dataset through prompt-engineered language model fine-tuning and human validation. Experiments conducted on a combination of real and synthetic emails demonstrate that the MTL framework achieves up to 97% F1-score for BEC detection and 93% for AV, outperforming transfer learning baselines while reducing false positives and computational cost.

This work contributes a principled, modular, and extensible framework for enhancing email security through joint semantic and stylistic analysis, addressing critical gaps in current defenses against sophisticated impersonation-based attacks.

More information

Identifiers

ORCID for Amirah Almutairi: orcid.org/0000-0002-2194-7936

ORCID for Nawfal Al Hashimy: orcid.org/0000-0002-1129-5217

ORCID for Boojoong Kang: orcid.org/0000-0001-5984-9867

Catalogue record

Export record