One of the ways in which attackers try to steal sensitive information from corporations is by sending spearphishing emails. This type of emails typically appear to be sent by one of the victim's coworkers, but have instead been crafted by an attacker. A particularly insidious type of spearphishing emails are the ones that do not only claim to come from a trusted party, but were actually sent from that party's legitimate email account that was compromised in the first place. In this paper, we propose a radical change of focus in the techniques used for detecting such malicious emails: instead of looking for particular features that are indicative of attack emails, we look for possible indicators of impersonation of the legitimate owners. We present IdentityMailer, a system that validates the authorship of emails by learning the typical email-sending behavior of users over time, and comparing any subsequent email sent from their accounts against this model. Our experiments on real world e-mail datasets demonstrate that our system can effectively block advanced email attacks sent from genuine email accounts, which traditional protection systems are unable to detect. Moreover, we show that it is resilient to an attacker willing to evade the system. To the best of our knowledge, IdentityMailer is the first system able to identify spearphishing emails that are sent from within an organization, by a skilled attacker having access to a compromised email account.
Content-analysis techniques look at the words in the message itself to determine if it is spam or not. Proposed methods include Na "ive Bayes, Support Vector Machines, or other machine learning algorithms @cite_20 @cite_39 @cite_23 @cite_17 . Other systems detect spam by looking at malicious URLs in the email @cite_44 @cite_3 . Content-analysis techniques work well in detecting spam, however are too computationally intensive to be applied to every email that a busy mail server receives @cite_35 . In , we solve this problem by analyzing emails as they get sent. We claim that this analysis is feasible, because the amount of emails that a mail server sends is lower than the amount of emails that it receives. Another problem of traditional content-analysis techniques is that they look for words that are indicative of spam. In the presence of a targeted attack, there might be no such words, since an attack email will use a language that is similar to the one used in everyday business emails. This is why in we learn the typical sending behavior of a user and match it against the emails she sends.
@cite_35 @cite_3 @cite_39 @cite_44 @cite_23 @cite_20 @cite_17
6401868 1481472066 1543155826 1648885110 2169384781 2041597619
PCT No. PCT EP97 00301 Sec. 371 Date Aug. 20, 1997 Sec. 102(e) Date Aug. 20, 1997 PCT Filed Jan. 23, 1997 PCT Pub. No. WO97 27421 PCT Pub. Date Jul. 31, 1997An operating room light with ceiling suspension is provided with a shaft protruding from the ceiling and containing internal electrical conductors, the shaft being enveloped in its end region by a support body provided on its outer circumference with slip rings for establishing electrical connections between the shaft and the conductors contained in a swivel arm; the swivel arm is provided with a swivel arm head as part of a rotary joint, which envelops the support body and which contains on its barrel-shaped inside slip ring pickups for making contact with the slip rings of the support body; viewed in axial direction, the support body is provided at both of its ends with bearing bushes functioning as sliding bearings, the upper bearing bush supporting an axial bearing ring that bears thereon to hold the swivel arm head; the support body together with the bearing bushes is secured against radial and axial shifting by means of threaded pins passed through openings in the pivot as well as by a locking ring held by means of annular slot in the end region of the shaft. By virtue of conical transition regions, it is possible to slip the swivel arm head with its slip ring pickups onto the support body in simple manner, thus providing advantages in particular for assembly and maintenance and for cases in which swivel arms are mounted one above the other. In this paper we present Botlab, a platform that continually monitors and analyzes the behavior of spam-oriented botnets. Botlab gathers multiple real-time streams of information about botnets taken from distinct perspectives. By combining and analyzing these streams, Botlab can produce accurate, timely, and comprehensive data about spam botnet behavior. Our prototype system integrates information about spam arriving at the University of Washington, outgoing spam generated by captive botnet nodes, and information gleaned from DNS about URLs found within these spam messages. We describe the design and implementation of Botlab, including the challenges we had to overcome, such as preventing captive nodes from causing harm or thwarting virtual machine detection. Next, we present the results of a detailed measurement study of the behavior of the most active spam botnets. We find that six botnets are responsible for 79 of spam messages arriving at the UW campus. Finally, we present defensive tools that take advantage of the Botlab platform to improve spam filtering and protect users from harmful web sites advertised within botnet-generated spam. In addressing the growing problem of junk E-mail on the Internet, we examine methods for the automated construction of filters to eliminate such unwanted messages from a user’s mail stream. By casting this problem in a decision theoretic framework, we are able to make use of probabilistic learning methods in conjunction with a notion of differential misclassification cost to produce filters Which are especially appropriate for the nuances of this task. While this may appear, at first, to be a straight-forward text classification problem, we show that by considering domain-specific features of this problem in addition to the raw text of E-mail messages, we can produce much more accurate filters. Finally, we show the efficacy of such filters in a real world usage scenario, arguing that this technology is mature enough for deployment. We study the use of support vector machines (SVM) in classifying e-mail as spam or nonspam by comparing it to three other classification algorithms: Ripper, Rocchio, and boosting decision trees. These four algorithms were tested on two different data sets: one data set where the number of features were constrained to the 1000 best features and another data set where the dimensionality was over 7000. SVM performed best when using binary features. For both data sets, boosting trees and SVM had acceptable test performance in terms of accuracy and speed. However, SVM had significantly less training time. Spam is a key problem in electronic communication, including large-scale email systems and the growing number of blogs. Content-based filtering is one reliable method of combating this threat in its various forms, but some academic researchers and industrial practitioners disagree on how best to filter spam. The former have advocated the use of Support Vector Machines (SVMs) for content-based filtering, as this machine learning methodology gives state-of-the-art performance for text classification. However, similar performance gains have yet to be demonstrated for online spam filtering. Additionally, practitioners cite the high cost of SVMs as reason to prefer faster (if less statistically robust) Bayesian methods. In this paper, we offer a resolution to this controversy. First, we show that online SVMs indeed give state-of-the-art classification performance on online spam filtering on large benchmark data sets. Second, we show that nearly equivalent performance may be achieved by a Relaxed Online SVM (ROSVM) at greatly reduced computational cost. Our results are experimentally verified on email spam, blog spam, and splog detection tasks.