Spam Detection Through Sliding Windowing of Headers

Transcription

1 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada C/ Perodsta Danel Saucedo Aranda, s/n Granada (Span) Phone: Fax: Emal: fjsalc@ugr.es, jedv@ugr.es, pgteodor@ugr.es FJSC and JEDV 2011

2 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Index 1. Introducton 2. Prevous Work on Spam Avodance 3. Segmental Approach for Spam Detecton a. Statc Parameterzaton of Headers b. Sldng Wndowng of E-mal headers 4. Segmental-based HMM-based E-mal Detecton 5. Expermental Results a. Framework b. Detecton usng statc parameterzaton c. HMM-based system wth dynamc parameterzaton 6. Conclusons 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 2

3 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Introducton Spam s a bg problem: Tme expended by users deletng spam Computer memory wasted Internet Servce Provders bandwdth wasted Illustratve fgures: In 2008 more than 90% of e-mal were abusve 1 Companes lost more than $70 bllon just n workers' productvty only n USA durng Source: Messagng Ant-Abuse Workng Group (MAAG) 2 Source: Nucleus Research 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 3

4 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Prevous Work on Spam Avodance A wde varety of solutons to fght aganst spam Ant-Spam Strateges/Technques Preventve Healng (Flters) Protocol changes Laws Whtelsts/ blacklsts K-Nearest- Neghbour (KNN) Case-based (ECUE, SpamHuntng) Bayesan Flters Non-machne learnng Machne Learnng Support Vector Machnes (SVMs) Boostng algorthms (Adaboost) Compresson- Based Systems (DMC) 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 4

5 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Prevous Work on Spam Avodance Most of ant-spam methods: Tokenzaton-based Use the body of e-mals (some header felds) Language-dependent and weak M0n y nstead money Volates users prvacy (llegal n many countres) Fco. Javer Salcedo Campos C/ Perodsta Manuel Saucedo The technque proposed: Unversty of Granada H, I m tryng to explan you what are the problems dervated to nspect the body of the e-mals. I don t know what s happen wth ths object. It s awfull. See you later. Based on a new perspectve: e-mal headers are nterpreted as a dgtal sgnal No nspecton of the body s needed (avods prvacy and legal concerns) Independent of the language or body encrypton used n e- mals. 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 5

6 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Segmental Approach for Spam Detecton Statc Parameterzaton of Headers Headers can be descrbed as a sequence of elements of a vocabulary H h1h 2... h T h V V { h 1 K} f K count ( v, H ) j1 count ( v j, H ) p H) f, f,..., ( 1 2 Return-Path: <morukn@andn.org> 0,09 Delvered-To: jgll@gmal.com 0,08 Receved: from amysktchen.net 0,07 (unknown [ ])by mal2.gmal.com (Postfx) wth SMTP d 23C for 0,06 <jgll@gmal.com>; Sat, 23 Jan :25: ,05 (MET) From: Approved 0,04 Store <morukn@andn.org> Subject: New Year 0,03 Sales To: <jgll@gmal.com> 0,02 0,01 Message-Id: < C @mal2.gmal.com> 0 Date: Sat, 23 Jan :25: <? \ _ b e h k n q t w z character count fk 0 = 16 1 = = 5 : = 8 ; = 1... a = 20 b = 5... z = 0 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 6

7 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Segmental Approach for Spam Detecton Sldng Wndowng of E-mal headers Header are consdered as dgtal sgnals codfed n ASCII H h1h 2... ht h V Segmentaton: wndows of W characters dsplaced Δ Return-Path: morukn@andn.org\ndelvered -To: jgll@gmal.com\nreceved: from amysk tchen.net (unknown [ ]) by mal2.g mal.com (Postfx) wth SMTP d 23C for <jgll@gmal.com>; Sat, 23 Jan :25: (MET)\nFrom: Approved Store <moru kn@andn.org> \nsubject: New Year Sales\n To: <jgll@gmal.com>\nmessage-id: C @mal2.gmal.com\nDate:S at, 23 Jan :25: \n 0,09 0,08 0,07 0,06 0,05 0,04 0,09 0,03 0,08 0,02 0,07 0,01 0,06 0,05 0 0,04 0,09 0,03 0, <? \ _ b e h k n q t w z 0,02 0,07 0,01 0,06 0,05 0 0,04 0,09 0,03 0, <? \ _ b e h k n q t w z 0,02 0,07 0,01 0,06 0,05 0 0,04 0, <? \ _ b e h k n q t w z 0,02 0,01 0 count wndow 80 characters dsplacement 40 characters <? \ _ b e h k n q t w z 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 7

8 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Segmental Approach for Spam Detecton Sldng Wndowng of E-mal headers Improvng the dynamcs of the system: addng 1 st and 2 nd dervatves of f k n each wndow Frst order: Second order: d a k k k k ( f f W 1) k k ( d d W 1) Thus a header Q s: Q 1 2 q1 q2... qr, q f, f,... f K,d 1,d 2,...,d K,a 1,a 2,...,a K 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 8

9 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Segmental-based HMM-based E-mal Detecton Hdden Markov Models (HMMs) have been successfully used to model processes of a sequental nature (speech recognton) Evaluaton P(λ Q) probabltes where λ s an HMM model and Q the observed header (Bayes rule) Two ntal models class ( Q) arg max{ P( Q ) P( )} { S, L} Determne topology and wndows wdth W and dsplacement Δ... START 1 2 N-1 N END States 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 9

10 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Segmental-based HMM-based E-mal Detecton Frst experment: determne W and Δ usng 3 states models Best CA value obtaned W=25 and Δ=10 Determnng the number of states of HMMs Accordng to the topology and the length of headers (24 to 2124 segments) Soluton: Use more than one model for spam and ham dependng on the sze of the header 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 10

11 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Segmental-based HMM-based E-mal Detecton Segmental-based HMM-based E-mal Detecton Module assgnement j arg mn N 1C 5 R 19 modules SpamAssassn 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 11

12 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Expermental Results Framework SpamAssassn publc corpus (9351 e-mals wth 2.90 ham/spam rato) 10-fold stratfed cross-valdaton to ncrease the confdence n the expermental fndngs Measures to compare results 1. True Postves (TP) 2. False Postves (FP) 3. Classfcaton Accuracy (CA) n TP N nl FP N n CA SS S S L SS N L n N LL S 100 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 12

13 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Expermental Results Results usng statc parameterzaton Evaluated technques: 1. SVM: Polynomal and Gaussan functons Best results cubc and σ=5 2. KNN: 4 dstances (eucldean, ctyblock, cosne, and correlaton) and 1 to 10 nearest neghbors Best results 2 neghbors 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 13

14 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Expermental Results HMM-based system wth dynamc parameterzaton Last results usng CEAS08 corpus: TP=98.4% CA= 98.6% FP=0.4% 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 14

15 Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada Conclusons A novel method for spam detecton s proposed: a)based only n the nspecton of the headers b)consder the header as a sgnal and parameterze and process t accordngly c) Uses HMMs as basc detector d)preserves the prvacy of users e)independent of the users' language and body encrypton Smlar or better results than other methods lke SVM, Naïve Bayes, etc. 9th Internatonal Conference on Appled Cryptography and Network Securty - ACNS '11 June 7-10, 2011, Nerja (Malaga), Span v1.0 15

16 Thanks for your attenton Spam Detecton Through Sldng Wndowng of E-mal Headers Francsco Salcedo-Campos, Jesus Daz-Verdejo, Pedro Garca-Teodoro Dpt. of Sgnal Theory, Telematcs and Communcatons ETSIIT - CITIC - Unversty of Granada C/ Perodsta Danel Saucedo Aranda, s/n Granada (Span) Phone: Fax: Emal: fjsalc@ugr.es, jedv@ugr.es, pgteodor@ugr.es FJSC and JEDV 2011