# A Modular and Adaptive System for Business Email Compromise Detection

arXiv: https://arxiv.org/abs/2308.10776 · HTML: https://mlsanity.com/paper/2308.10776/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 50 references that are in the map.
- First posted on arXiv 21 Aug 2023.

## Builds on (most cited first, 14 of 14)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [GPT-4 Technical Report](https://mlsanity.com/paper/2303.08774/) (2023)
- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Shortcut Learning in Deep Neural Networks](https://mlsanity.com/paper/2004.07780/) (2020)
- [Model Cards for Model Reporting](https://mlsanity.com/paper/1810.03993/) (2018)
- [Blessing of dimensionality: mathematical foundations of the statistical physics of data](https://mlsanity.com/paper/1801.03421/) (2018)
- [Detecting and Characterizing Lateral Phishing at Scale](https://mlsanity.com/paper/1910.00790/) (2019)
- [Cognitive Triaging of Phishing Attacks](https://mlsanity.com/paper/1905.02162/) (2019)
- [On Model Evaluation under Non-constant Class Imbalance](https://mlsanity.com/paper/2001.05571/) (2020)
- [CATBERT: Context-Aware Tiny BERT for Detecting Social Engineering Emails](https://mlsanity.com/paper/2010.03484/) (2020)
- [Catching the Phish: Detecting Phishing Attacks using Recurrent Neural Networks (RNNs)](https://mlsanity.com/paper/1908.03640/) (2019)
- [DeepQuarantine for Suspicious Mail](https://mlsanity.com/paper/2001.04168/) (2020)

## Built on by (most cited first, 1 of 1)

- [Per-sender neural network classifiers for email authorship validation](https://mlsanity.com/paper/2509.00005/) (2025)

## Abstract (arXiv)

The growing sophistication of Business Email Compromise (BEC) and spear phishing attacks poses significant challenges to organizations worldwide. The techniques featured in traditional spam and phishing detection are insufficient due to the tailored nature of modern BEC attacks as they often blend in with the regular benign traffic. Recent advances in machine learning, particularly in Natural Language Understanding (NLU), offer a promising avenue for combating such attacks but in a practical system, due to limitations such as data availability, operational costs, verdict explainability requirements or a need to robustly evolve the system, it is essential to combine multiple approaches together. We present CAPE, a comprehensive and efficient system for BEC detection that has been proven in a production environment for a period of over two years. Rather than being a single model, CAPE is a system that combines independent ML models and algorithms detecting BEC-related behaviors across various email modalities such as text, images, metadata and the email's communication context. This decomposition makes CAPE's verdicts naturally explainable. In the paper, we describe the design principles and constraints behind its architecture, as well as the challenges of model design, evaluation and adapting the system continuously through a Bayesian approach that combines limited data with domain knowledge. Furthermore, we elaborate on several specific behavioral detectors, such as those based on Transformer neural architectures.