Overview
In cybersecurity, attackers know that hacking an individual is often easier than penetrating a complete infrastructure. They leverage psychological tactics like trust, urgency, and pressure, with the aim of obtaining sensitive information or, in most cases, prompting immediate financial actions. Moreover, since these tactics do not rely on complex technical exploits, they can easily bypass traditional email authentication defenses like DMARC, SPF, and DKIM. Here, we are interested in one of the most common and harmful social engineering tactics: individual display name impersonation (IDNI), a threat that requires not only static rules, but also machine learning models to tackle it.
Social Engineering Problem: Display Name Impersonation
General display name impersonation is a highly effective social engineering attack that falsifies the identity of an individual or a trusted source, such as a well-known, established company to trick employees within an organization. In the specific case of individual display name impersonation, as the name suggests, the attackers mimic the names of trusted individuals, like senior executives, to facilitate fraudulent activities.
In most observed cases, these attacks are perpetrated from external domains rather than compromised internal accounts. Additionally, the success of this tactic exploits modern email user interfaces. To save screen space, especially on mobile phones, the user interface prioritizes the visualization of the sender’s display name while hiding the underlying email address. This drastically increases the attack’s effectiveness since the receiver trusts the name they observe on screen, and because the attacks are often sent from legitimate and highly reputable domains like Gmail, bypassing domain reputation checks and traditional security filters.
To maximize email security and protect customers, the Email Security data science team has developed an enhanced IDNI machine learning model. The newly deployed model demonstrates a high true positive detection rate alongside a low false positive rate.
Main IDNI Model Detection Features
The IDNI model relies on a sophisticated set of features to identify display name impersonation with high accuracy. Some of the relevant components of this detection process include:
User Profiling Infrastructure (UPI). This infrastructure captures historical communication patterns between senders and recipients at both the individual and domain levels.
NLP Models: These models are designed to analyze and classify email subject lines and display names. Display names are categorized into 12 different classes, such as commercial, financial, news, personal names, among others. The personal names category acts as a key differentiator for signaling potential IDNI attacks.
IDNI Detections: Case Studies in Production
Once deployed to production, the updated IDNI model successfully detected several notable IDNI attacks. Figure 1 provides a breakdown of these observations:
Conversely, the model must also handle benign edge cases, such as employees sending messages to their corporate accounts from their personal emails. Figure 2 displays examples of safe emails which the model correctly tags as benign:
These examples demonstrate the discriminative power of the historical interaction features, particularly when the display name and email local part do not perfectly align. Ultimately, this robust feature set is what allows the IDNI model to achieve a high performance metrics.
Production Metrics
In production, the updated IDNI model processes and monitors an average of 400.000 emails per week. Initial performance analysis reveals a 98% true positive rate detection. This directly benefits our customers, delivering robust protection against IDNI attacks while maintaining an excellent user experience through a minimal false positive rate.
Looking at the Future
The most significant challenge for the IDNI model occurs when an attack is performed via an Account Take Over (ATO). In this scenario, the attacker compromises a legitimate, internal email account and uses it to target individuals within or outside a company.
Because the attack comes from a genuine account, both the display name and the underlying email address are completely authentic. This blinds the IDNI model analysis, as no technical impersonation is taking place per se. While the current model does not implement ATO specific detection features, integrating these capabilities into future iterations will improve the overall threat detection accuracy.
