現今企業之間使用電子郵件進行商業交易資訊的溝通，卻成為網路犯罪份子詐騙公司財務的方法之一。商務電子郵件詐騙（Business Email Compromise, BEC）就是駭客申請了極為相似的郵件網域名稱，利用不意察覺的特性進行中間人攻擊，然後發出電子郵件要求變更帳戶並進行匯款，成為企業財務損失的詐騙手法。為降低BEC詐騙的風險，本研究針對特定高風險財務會計人員的電子郵件日誌，使用ELK Stack（Elasticsearch, Logstashand, Kibana）處理後，比對郵件信任的網域列表，並設計以網域註冊時間與郵件主旨等為過濾條件，來偵測是否為可疑網域的BEC郵件。我們已完成系統雛型BEClookup並以某公司2020年1~12月的郵件日誌為測試，該公司約有3600個郵件帳號，接收4,078,525封外部郵件，檢測出3封假冒郵件網域要進行詐騙的商務電子郵件，其中有一封郵件偽造匯款帳戶預詐騙金額為127,217USD美金。;Corporations exchange commercial information via emails for convenience. However, it is also a channel of cybercriminals. Business Email Compromise (BEC) means hackers apply for a similar email domain name of a corporation and take the advantage of a similar domain name is hard to the identification. Then perform a man-in-the-middle attack to send a request email to change remittance, which becomes a fraud method. In order to mitigate the risk of Business Email Compromise, this study used ELK Stack（Elasticsearch, Logstash and Kibana）to process the email logs, we focus on high-risk financial accountants and use email subjects, registration time of domain name as comparison conditions to detect suspicious domain names in the papers. We have completed the prototype of the system called BEClookup and have made a trial run on one corporation from January to December 2020. There are around 3,600 email accounts and 4,078,525 external emails in the corporation during the period. We detected 3 BEC emails by this methodology. One of the emails fraudulent amounts is up to USD 127,217. The result indicates that this research can help corporations avoid financial loss.
