AI를 통한 BEC (Business Email Compromise) 공격의 효과적인 대응방안 연구
A Study on the Effective Countermeasure of Business Email Compromise (BEC) Attack by AI
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
이메일을 통해서 거래처나 경영진을 사칭하여 금전이나 민감한 정보를 탈취하는 BEC(Business Email Compromise) 공격이 빈번하게 발생하고 있다. 이러한 공격 형태는 최근 발생한 무역사기 중 가장 큰 비중을 차지하며 FBI에서 추정 2019년 피해 금액만 약 17억 달러에 이른다. 하지만 이에 비해서 기업들의 대응 실태를 살펴보면 전통적인 SPAM 차단시스템에 의존하고 있어 보다 치밀해져만 가는 BEC 공격에는 사실상 무방비 상태이며, 임직원에 관련 사고를 안내하고 주의를 당부하는 변화관리 수준의 대응에 머물고 있다. 이에 BEC 사고 유형과 방법들을 분석하고, AI를 통한 기업에서의 효과적인 BEC 공격 대응방안을 제안하고자 한다.
Abstract
BEC (Business Email Compromise) attacks are frequently occurring by impersonating accounts or management through e-mail and stealing money or sensitive information. This type of attack accounts for the largest portion of the recent tradefraud, and the FBI estimates that the estimated amount of damage in 2019 is about $17 billion. However, if you look atthe response status of the companies compared to this, it relies on the traditional SPAM blocking system, so it is virtuallydefenseless against the BEC attacks that social engineering predominates. To this end, we will analyze the types andmethods of BEC accidents and propose ways to effectively counter BEC attacks by companies through AI(Artificial Intelligence).
참고문헌 (29)
- "FBI IC3 2019 Internet Crime Report" (2020)[URL]
- "2020 Cybersecurity Issue Forecast Report" (2020)[URL]
- "2019 KISA Cyber Threat Trend Report" (2020)[URL]
- "Business Email Compromise" (2020)[URL]
- R Sikorski, "A privacy primer for the Web: spam, bread crumbs, and cookies", The Journal of the American Medical Association (1998)
- Hinde Stephen, "Spam: the evolution of a nuisance", pp.474~478 (2003)
- W.G. Hoover, "SPAM-based recipes for continuum simulations", pp.78~85 (2001)
- DuBoff, Leonard D, "Avoiding the Scams", pp.11~13 (2009)
- Deborah Schaffer, "THE LANGUAGE OF SCAM SPAMS: LINGUISTIC FEATURES OF NIGERIAN FRAUD E-MAILS", pp.157~179 (2012)
- Peter Ribic, "The Nigerian email scam novel", pp.424~436 (2019)
- Blanzieri, Enrico, "A survey of learning-based techniques of email spam filtering", Artificial Intelligence Review, 29(1), pp.63~92 (2008)
- JAKOBSSON, "Detection of business email compromise", U.S. Patent Application No 15, 2017
- ZWEIGHAFT, "Business email compromise and executive impersonation:are financial institutions exposed?", Journal of Investment Compliance (2017)
- Remorin, Lord, "Tracking Trends in Business Email Compromise (BEC)Schemes", Trend Micro, 18(1) (2018)
- "email header Standard" (2020)[URL]
- "AI algorithms" (2020)[URL]
- "ML Algorithms Sheet" (2020)[URL]
- 김현준, "가중치가 부여된 베이지안 분류자를 이용한 스팸 메일 필터링 시스템", 정보과학회논문지 : 소프트웨어 및 응용, 31(8), pp.1092~1100 (2004), 한국정보과학회
- "Confusion Matrix" (2020)[URL]
- 이상호, "자동 생성 메일계정 인식을 통한 스팸 필터링", 정보과학회논문지 : 소프트웨어 및 응용, 32(5), pp.378~384 (2005), 한국정보과학회
- Jindal, Nitin, "Review spam detection", Proceedings of the 16th international conference on World Wide Web, pp.1189~1190 (2007)
- Markines, Benjamin, "Social spam detection", Proceedings of the 5th International Workshop on Adversarial Information Retrieval on the Web, pp.41~48 (2009)
- Barreno, Marco, "The security of machine learning", Machine Learning, 81(2), pp.121~148 (2010)
- Buczak, "A survey of data mining and machine learning methods for cyber security intrusion detection", IEEE Communications surveys & tutorials, 18(2), pp.1153~1176 (2015)
- Papernot, Nicolas, "Towards the science of security and privacy in machine learning", 1611.03814, ~ (2016)
- Akinyelu, Andronicus A, "Classification of phishing email using random forest machine learning technique", Journal of Applied Mathematics (2014)
- "BEC, SCAM, social engineering" (2020)[URL]
- "BEC, SCAM, social engineering" (2020)[URL]
- "levenshtein algorithm" (2020)[URL]