The costliest attacks often carry no malware at all. Business email compromise, executive impersonation, and pretexting work by manipulating a person into wiring money or handing over credentials — there is no malicious file for an antivirus to catch. Detecting them means reading communications for manipulation, not payloads.

Social Safeguard, Inc.'s US11936686B2, “System, device and method for detecting social engineering attacks in digital communications” (issued March 19, 2024; CPC H04L 63/1466 — attacks involving impersonation, and H04L 63/1483 — phishing protection), describes detecting social-engineering attacks in digital communications. Read it at US11936686B2.

“Embodiments of the present disclosure use natural language processing, machine learning and relevant corpora to detect social engineering attacks with a high degree of accuracy.”— U.S. Patent No. 11,936,686 source

The filing lays out a three-phase pipeline, and the detail is in how it turns prose into numbers. Phase one is pre-processing: an incoming message is cleaned, the language is detected first — the specification notes this matters because “languages like Japanese do not use spacing the way western languages do” and must be tokenized differently — and the text is broken into tokens with part-of-speech tags. Per claim 1, the system extracts “an initial attribute” and determines “whether the extracted initial attribute comprises a special feature so as to generate a lexical feature vector.”

Those “special features” are the concrete tells of manipulation. The specification's lexical feature extractor flags signals such as “the inclusion of a URL that has an IP address instead of a domain name,” which “is not normal in business communications,” and “the use of an unusually long URL… a strategy to mask a suspicious domain.” A separate spelling-feature extractor “count[s] the number of misspelled words” and normalizes that count by message length — turning the rough grammar typical of mass phishing into a numeric feature. Claim 2 confirms the pre-processing identifies and removes “a URL, an email address, and an IP address” so they can be analyzed as structured attributes rather than raw text.

Phase two adds topical analysis. The system tokenizes the message and, “based on determining whether the cleaned token list includes one or more suspicious topics,” generates “a topics vector and a correlation score for each token.” This is where the relevant corpora come in: the model has learned which subject matter — wire transfers, gift cards, urgent credential resets — correlates with attacks. In phase three the lexical and topical vectors are combined and a trained model predicts a single “risk score,” and “upon the risk score exceeding a risk threshold,” the message is classified as a social-engineering attack. The CPC tag H04L 63/1466, attacks involving impersonation, is the precise classification: detection aimed at the human-targeting layer, scoring intent rather than scanning for known-bad attachments.

The dependent claims reveal a more modern engine underneath the lexical heuristics. Claim 5 transforms “each token… into an embedded representation by applying a universal” sentence/word embedding, and claim 6 calculates “a correlation between the embedded representation for each token” and the suspicious topics — meaning the topic detection is semantic, matching meaning rather than exact keywords, so “urgent wire transfer” and a paraphrase of it score alike. Claim 4 names the specific manipulation it hunts: whether the message “comprises an authoritative action request” — the pretext-and-demand structure of executive impersonation. Claim 3 enumerates concrete lexical red flags, including “a URL with an IP address” and a URL exceeding “a threshold minimum number” of characters. The detector thus blends crisp rules for the obvious tells with embedding-based semantics for the subtle ones — which is what “a high degree of accuracy” in the abstract is built on.

The specification details the topic engine that makes intent measurable. A “topics feature extractor” evaluates the cleaned tokens for “common topics included in social engineering attack messages,” using NLP “to detect meaning such as… urgency, where the message recipient is being pressured” into acting. To find a topic, the system transforms each token “into an embeddings representation using state of the art NLP techniques based on bidirectional transformers” — the same class of language model that powers modern AI — and then scores correlation against known attack topics. This is why the detector resists simple evasion: an attacker who rewords “send the wire today” cannot escape a model that compares meaning in embedding space rather than matching strings. The three feature streams — lexical anomalies, normalized spelling errors, and transformer-scored topics — converge on the single risk score, so a message can be flagged for being too urgent and too authoritative even if it contains no link and no misspelling at all.

Why this is a business story: business email compromise is consistently among the highest-dollar-loss categories the FBI tracks, which created a whole market — Abnormal Security, Tessian, and others — selling behavioral email security on exactly this premise. The mechanics matter to that market because the moat is the model and the corpora, not a blocklist: a vendor's edge is how well its feature extractors and topic models generalize. The rise of AI-generated, grammatically perfect phishing raises the stakes precisely by attacking the spelling-error feature this filing leans on — pushing the field toward the topical and contextual signals it also describes. Patents on detecting manipulation, not malware, mark where that money is flowing.

The grounded read: social-engineering detection runs a message through language-aware tokenizing, extracts lexical tells (IP-address URLs, masked links, abnormal misspelling rates) and a suspicious-topic score, then fuses them into one risk score — because the attack targets the person, not the machine. Social Safeguard's 2024 grant names that intent-focused, NLP-driven detection in step-by-step detail — the basis of the fast-growing behavioral email-security market.