EMAD: Email Masquerade Attack Detection Based on Semi-Supervised Learning

Email, as a primary communication service, plays a crucial role in communication, making it one of the most common targets of cyberattacks. Masquerade attacks, which involve impersonating legitimate users to obtain authentication credentials and gain unauthorized access to services, are particularly common. Since masquerade attacks use legitimate logins, their dwell-time behavior resembles normal users, making detection challenging. Further complicating the issue are the diverse email usage patterns, making the identification of detection results time-consuming and labor-intensive. To slove those problems, we propose a rule-based, self-training, semi-supervised model for masquerade attack detection. It analyzes four types of email logs and classifies usage scenarios. It uses an Auto-Encoder for semisupervised detection with limited labeled data, refining results through iterative self-training with coarse-grained rules. The framework is validated on email data from 6,736 users over three months, identifying 7 anomalous accounts and 12 anomalous IP addresses. Compared to the company's Security Operations Center security tools, the proposed framework detected 3 more anomalous accounts and 7 more anomalous IP while reducing suspicious accounts by 3.72 times and suspicious IP by 3.54 times.