RAIDER: Reinforcement-aided spear phishing detector

Spear Phishing is one of the most difficult to detect cyber attacks facing businesses and individuals worldwide. In recent years, considerable research has been conducted into the use of Machine Learning (ML) techniques for spear-phishing detection. ML-based solutions are vulnerable to zero-day attacks, as when the algorithms do not have access to the relevant historical data, they cannot be reliably trained. Furthermore, email address spoofing is a low-effort yet widely applied forgery technique in spear phishing which the standard email protocol SMTP fails to detect without the use of extensions. Detecting this type of spear threat requires (i) a close investigation of each sender within the mailbox; and (ii) a thorough exploration of the similarity of its characteristics to the spoofed email. This raises scalability challenges due to the growing number of features relevant for investigation and comparison, which is proportional to the number of the senders within a particular mailbox. This differs from traditional phishing attacks, which typically look at email bodies and are generally limited to a binary classification between ‘phishing’ and ‘benign’ emails.