# Holmes: An Efficient and Lightweight Semantic Based Anomalous Email Detector

arXiv: https://arxiv.org/abs/2104.08044 · HTML: https://mlsanity.com/paper/2104.08044/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 46 references that are in the map.
- First posted on arXiv 16 Apr 2021.

## Builds on (most cited first, 9 of 9)

- [Distributed Representations of Sentences and Documents](https://mlsanity.com/paper/1405.4053/) (2014)
- [UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats](https://mlsanity.com/paper/2001.01525/) (2020)
- [Similarity encoding for learning with dirty categorical variables](https://mlsanity.com/paper/1806.00979/) (2018)
- [Detecting and Characterizing Lateral Phishing at Scale](https://mlsanity.com/paper/1910.00790/) (2019)
- [Provenance-based Intrusion Detection: Opportunities and Challenges](https://mlsanity.com/paper/1806.00934/) (2018)
- [LuNet: A Deep Neural Network for Network Intrusion Detection](https://mlsanity.com/paper/1909.10031/) (2019)
- [Densely Connected Residual Network for Attack Recognition](https://mlsanity.com/paper/2008.02196/) (2020)
- [DualNet: Locate Then Detect Effective Payload with Deep Attention Network](https://mlsanity.com/paper/2010.12171/) (2020)
- [Pelican: A Deep Residual Network for Network Intrusion Detection](https://mlsanity.com/paper/2001.08523/) (2020)

## Abstract (arXiv)

Email threat is a serious issue for enterprise security. The threat can be in various malicious forms, such as phishing, fraud, blackmail and malvertisement. The traditional anti-spam gateway often maintains a greylist to filter out unexpected emails based on suspicious vocabularies present in the email's subject and contents. However, this type of signature-based approach cannot effectively discover novel and unknown suspicious emails that utilize various evolving malicious payloads. To address the problem, in this paper, we present Holmes, an efficient and lightweight semantic based engine for anomalous email detection. Holmes can convert each email event log into a sentence through word embedding and then identify abnormalities that deviate from a historical baseline based on those translated sentences. We have evaluated the performance of Holmes in a real-world enterprise environment, where around 5,000 emails are sent/received each day. In our experiments, Holmes shows a high capability to detect email threats, especially those that cannot be handled by the enterprise anti-spam gateway. It is also demonstrated through our experiment that Holmes can discover more concealed malicious emails that are immune from several commercial detection tools.