Towards Proactive SPAM Filtering
|
|
|
- Shawn Tucker
- 10 years ago
- Views:
Transcription
1 Towards Proactive SPAM Filtering DIMVA 2009 Laboratory for Dependable Distributed Systems
2 Survey Motivation Sandnet Setup Template Creation Preliminary Results Summary & Future Work
3 Motivation SPAM is unwanted Why templates for filtering: Templates more precise than current methods? (Bayes Filter, Reputation based,...) Templates send to Bots are encrypted Retrieve template from memory of running bot - too complex?
4 Example Template 1 In this example the body is fixed
5 Example Template 2 Example: Command {file "body.html", quoted printable} tells the bot to substitute the body.html file Xarvester Botnet Quelle:
6 Sandnet Setup Running Spam Bots
7 Sandnet 1
8 Sandnet 2 Spam are collected at the gateway (mbox) Filtering of malicious traffic + rate limit How to handle test s send by bots? Currently blocked Our current setup runs the bots only for a limited time
9 Generating Templates The Algorithm
10 Template Creation 1 The Template Creation Algorithm: Take first as starting template Sort s according to their length Take next as comparing template Common Substring Extraction Add s to the template as long as threshold is not exceeded
11 Template Creation 2
12 Example Template 1 Only X-Mailer Changes Generated from s
13 Example Template 2 Only Subject and X-Mail change Generated from s
14 Example Template 3 Generated from 172 s More complex due to word mutations in the s
15 Preliminary Results Euro Dice Casino Case Study
16 Euro Dice Casino 1 We generated a Template from 71 s all collected during a single day in October 2008
17 Euro Dice Casino 2 We collected SPAM s advertising the casino during June 2008 till April 2009 A total of 493 s advertising the Euro Dice Casino were collected at our spamtraps (some free accounts) Checking against our previously generated template revealed a detection rate of only 5.3% All matches are s received at the spamtraps during October 2008
18 Euro Dice Casino 3 We added a randomly chosen from the spamtrap s to our template generation process
19 Euro Dice Casino 4 Adding a single slightly different resulted in a detection rate of 26% (previously 5.3%) We now match s of this campaign ranging from September to November 2008 All that changed is the URL eurocasinokg.com eurocasino([a-za-z]){2,2}.com
20 Euro Dice Casino 5 Adding another
21 Euro Dice Casino 6 Adding another raises the detection rate to 99% Again only the URL changes: eurocasino([a-za-z]){2,2}.com ([\.A-Za-z]){0,16} The number of distinct s of a campaign determines the quality of a template In this case a total of 3 s suffices for a 99% detection rate of the campaign
22 Summary...and future work
23 Summary Sandnet (run bots periodically) Offline template generation Common Substring Algorithm First results are promising
24 Future Work Rebuild the Sandnet to run bots endlessly Construct templates while collecting the SPAM from the running bots (realtime) Build a Mail-Client Plugin for template filtering Evaluate the approach
25 Jan Göbel Questions? Pi1 - Laboratory for Dependable Distributed Systems
How To Filter Email From A Spam Filter
Spam Filtering A WORD TO THE WISE WHITE PAPER BY LAURA ATKINS, CO- FOUNDER 2 Introduction Spam filtering is a catch- all term that describes the steps that happen to an email between a sender and a receiver
Search Engine Marketing(SEM)
Search Engine Marketing(SEM) Module 1 Website Analysis Competition Analysis About Internet Marketing Scope & Career Opportunities Basics Of HTML & Website Development Platforms Module 2. Search Engine
Protecting the Infrastructure: Symantec Web Gateway
Protecting the Infrastructure: Symantec Web Gateway 1 Why Symantec for Web Security? Flexibility and Choice Best in class hosted service, appliance, and virtual appliance (upcoming) deployment options
Reputation Marketing Proposal. Overview Summary
Reputation Marketing Proposal Overview Summary Issue: Directories Solution: Research, Set Up, and Claim Local Directories 1. Proper Industry Directory Research Develop detailed research on local directories
ISB13 Web security deployment options - which is really best for you? Duncan Mills, Piero DePaoli, Stuart Jones
ISB13 Web security deployment options - which is really best for you? Duncan Mills, Piero DePaoli, Stuart Jones Web Security Deployment Options 1 1 The threat landscape 2 Why Symantec web security 3 Generic
Whose IP Is It Anyways: Tales of IP Reputation Failures
Whose IP Is It Anyways: Tales of IP Reputation Failures SESSION ID: SPO-T07 Michael Hamelin Lead X-Force Security Architect IBM Security Systems @HackerJoe What is reputation? 2 House banners tell a story
DST EMAIL. Product FAQs. Thank you for using our products. DST UK www.dstsystems.co.uk
EFFECTIVE PERSONALISED PRINT AND E-COMMUNICATION SOLUTIONS DESIGNED WITH YOU IN MIND DSTSYSTEMS.CO.UK DST EMAIL Product FAQs version 01 Thank you for using our products. DST UK www.dstsystems.co.uk DST
McAfee. Firewall Enterprise. Application Note TrustedSource in McAfee. Firewall Enterprise. version 8.1.0 and earlier
Application Note TrustedSource in McAfee Firewall Enterprise McAfee version 8.1.0 and earlier Firewall Enterprise This document uses a question and answer format to explain the TrustedSource reputation
E-MAIL FILTERING FAQ
V8.3 E-MAIL FILTERING FAQ COLTON.COM Why? Why are we switching from Postini? The Postini product and service was acquired by Google in 2007. In 2011 Google announced it would discontinue Postini. Replacement:
SPAMMING BOTNETS: SIGNATURES AND CHARACTERISTICS
SPAMMING BOTNETS: SIGNATURES AND CHARACTERISTICS INTRODUCTION BOTNETS IN SPAMMING WHAT IS AUTORE? FACING CHALLENGES? WE CAN SOLVE THEM METHODS TO DEAL WITH THAT CHALLENGES Extract URL string, source server
Project specification for suncoastreoholdings.com. Version 1.0
Project specification for suncoastreoholdings.com Version 1.0 This document lists the list of major functionality that this website will offer on its first version. 10/2/2012 Table of Contents Introduction...
The Latest Internet Threats to Affect Your Organisation. Tom Gillis SVP Worldwide Marketing IronPort Systems, Inc.
The Latest Internet Threats to Affect Your Organisation Tom Gillis SVP Worldwide Marketing IronPort Systems, Inc. Agenda Spam Trends Staying Ahead Blended Threats Spam Trends What Do Dick Cheney & Bill
Adjust Webmail Spam Settings
Adjust Webmail Spam Settings An unsolicited bulk email message is known as "spam." Spam, which usually contains some sort of commercial advertising or proposition, is sent to a large number of recipients
Stop DDoS Attacks in Minutes
PREVENTIA Forward Thinking Security Solutions Stop DDoS Attacks in Minutes 1 On average there are more than 7,000 DDoS attacks observed daily. You ve seen the headlines. Distributed Denial of Service (DDoS)
LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains
LASTLINE WHITEPAPER Using Passive DNS Analysis to Automatically Detect Malicious Domains Abstract The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way
A quick guide to... Permission: Single or Double Opt-in?
A quick guide to... Permission: Single or Double Opt-in? In this guide... Learn how to improve campaign results by sending new contacts a confirmation email to verify their intention to join. Table of
Websense Data Security Solutions
Data Security Suite Data Discover Data Monitor Data Protect Data Endpoint Data Security Solutions What is your confidential data and where is it stored? Who is using your confidential data and how? Protecting
1 Introductory Comments. 2 Bayesian Probability
Introductory Comments First, I would like to point out that I got this material from two sources: The first was a page from Paul Graham s website at www.paulgraham.com/ffb.html, and the second was a paper
聚 碩 科 技 主 題 : 如 何 幫 企 業 行 動 商 務 建 立 安 全 機 制 職 稱 : 技 術 顧 問
聚 碩 科 技 主 題 : 如 何 幫 企 業 行 動 商 務 建 立 安 全 機 制 主 講 人 : 廖 國 宏 Jerry Liao 職 稱 : 技 術 顧 問 Each attack instance can be slightly different 攻 擊 模 式 有 些 微 的 不 同 Domains are rotated in days, even hours 攻 擊 主 機 位 置
Sophos Cloud Help Document date: January 2016
Sophos Cloud Help Document date: January 2016 Contents 1 About Sophos Cloud Help...4 2 Activate Your License...5 3 The Sophos Cloud User Interface...6 4 Dashboard...7 4.1 Action Center...7 4.2 Email Alerts...14
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Agenda Information Security Trends Year 2014 in Review Outlook for 2015 Advice to the Public Hong Kong Computer Emergency Response Team Coordination
Streamlining Web and Email Security
How to Protect Your Business from Malware, Phishing, and Cybercrime The SMB Security Series Streamlining Web and Email Security sponsored by Introduction to Realtime Publishers by Don Jones, Series Editor
REMOTE BACKUP-WHY SO VITAL?
REMOTE BACKUP-WHY SO VITAL? Any time your company s data or applications become unavailable due to system failure or other disaster, this can quickly translate into lost revenue for your business. Remote
MY DIGITAL PLAN MY DIGITAL PLAN BROCHURE
MY DIGITAL PLAN BROCHURE Digital Marketing Overview What is marketing? What is digital marketing and why is it required? Traditional marketing v/s Digital marketing How to do it? Visibility of my brand
SPAM FILTER Service Data Sheet
Content 1 Spam detection problem 1.1 What is spam? 1.2 How is spam detected? 2 Infomail 3 EveryCloud Spam Filter features 3.1 Cloud architecture 3.2 Incoming email traffic protection 3.2.1 Mail traffic
1.M4: Email Marketing
1.M4: Exercises A series of practical exercises is provided below: Module Domain DMI_PDDM_PE_M4_00001 Goals and KPI s Using the goals listed for a business of your choosing, select specific KPI s for each,
Data Center security trends
Data Center security trends Tomislav Tucibat Major accounts Manager, Adriatic Copyright Fortinet Inc. All rights reserved. IT Security evolution How did threat market change over the recent years? Problem:
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
CYBER SCIENCE 2015 AN ANALYSIS OF NETWORK TRAFFIC CLASSIFICATION FOR BOTNET DETECTION
CYBER SCIENCE 2015 AN ANALYSIS OF NETWORK TRAFFIC CLASSIFICATION FOR BOTNET DETECTION MATIJA STEVANOVIC PhD Student JENS MYRUP PEDERSEN Associate Professor Department of Electronic Systems Aalborg University,
Analysis of Spam Filter Methods on SMTP Servers Category: Trends in Anti-Spam Development
Analysis of Spam Filter Methods on SMTP Servers Category: Trends in Anti-Spam Development Author André Tschentscher Address Fachhochschule Erfurt - University of Applied Sciences Applied Computer Science
Payius. Guide to SSL certicates in ecommerce
Payius Guide to SSL certicates in ecommerce Page 2 Table of Contents 1 About This Guide...3 1.1 Purpose...3 1.2 Audience...3 1.3 Prerequisites...3 1.4 Related Documents...3 2 SSL - The Basics...4 2.1 General...4
ParlaMI, Enterprise Instant Messaging
ParlaMI, Enterprise Instant Messaging A step forward for the optimization and protection of corporate communications Why should you use instant messaging in your business environment? Optimize business
Modern Cyber Threats. how yesterday s mind set gets in the way of securing tomorrow s critical infrastructure. Axel Wirth
Modern Cyber Threats how yesterday s mind set gets in the way of securing tomorrow s critical infrastructure Axel Wirth Healthcare Solutions Architect Distinguished Systems Engineer AAMI 2013 Conference
SpamTitan Outlook Addin v1.1 Installation Instructions
SpamTitan Outlook Addin v1.1 Installation Instructions Introduction What does this Addin Do? Allows reporting of SPAM and HAM messages to the SpamTitan appliance, this in turn will allow the Bayesian appliance
FortiMail Email Filtering Course 221-v2.0. Course Overview. Course Objectives
FortiMail Email Filtering Course 221-v2.0 Course Overview FortiMail Email Filtering is a 2-day instructor-led course with comprehensive hands-on labs to provide you with the skills needed to configure,
Private Email Networks
Private Email Networks Email Encryption as it should be done The Email Laundry has been the leading developer of new technology for the email security industry for some time. Our Cloud based service is
Security Incidents And Trends In Croatia. Domagoj Klasić [email protected]
Security Incidents And Trends In Croatia Domagoj Klasić [email protected] Croatian National CERT About us Founded in 2008. in accordance with the Information Security Act We are a department of the Croatian
mdata from Mobile Commons enables organizations to make any data accessible to the public via text message, no programming required.
mdata Web Services mdata from Mobile Commons enables organizations to make any data accessible to the public via text message, no programming required. How it Works 1. A user sends a text message with
SEO: HOW TO DRIVE MORE TRAFFIC TO YOUR WEBSITE
SEO: HOW TO DRIVE MORE TRAFFIC TO YOUR WEBSITE Brock Murray @SEOBrock BEFORE WE START REQUIREMENTS Website (preferably on a CMS ie WordPress) HIGHLY RECOMMENDED! WHAT IS SEO? Search Engine Optimization
TEAL: Transparent Email Archiving Library
TEAL: Transparent Email Archiving Library 1. Users send & receive email as per normal 2. Existing customer filters remove spam & viruses Filters (Spam, Anti-Virus) 3. Interceptor agent takes a copy of
ThreatSTOP Technology Overview
ThreatSTOP Technology Overview The Five Parts to ThreatSTOP s Service We provide 5 integral services to protect your network and stop botnets from calling home ThreatSTOP s 5 Parts: 1 Multiple threat feeds
Online and Scalable Data Validation in Advanced Metering Infrastructures
Online and Scalable Data Validation in Advanced Metering Infrastructures Chalmers University of technology Agenda 1. Problem statement 2. Preliminaries Data Streaming 3. Streaming-based Data Validation
WEBSENSE EMAIL SECURITY SOLUTIONS OVERVIEW
WEBSENSE EMAIL SECURITY SOLUTIONS OVERVIEW Challenge The nature of email threats has changed over the past few years. Gone are the days when email security, better known as anti-spam, was primarily tasked
2. Bulk SMS Software: Custom Desktop Software application using our API.
What is Bulk SMS? In marketing industry SMS stands for Smart Marketing Services. The charges for SMS on mobile phones is very high especially when sending multiple messages and exorbitant when sending
Superior protection from Internet threats and control over unsafe web usage
datasheet Trend Micro interscan web security Superior protection from Internet threats and control over unsafe web usage Traditional secure web gateway solutions that rely on periodic updates to cyber
A General-purpose Laboratory for Large-scale Botnet Experiments
A General-purpose Laboratory for Large-scale Botnet Experiments Thomas Barabosch, Sebastian Eschweiler, Mohammad Qasem, Daniel Panteleit, Daniel Plohmann and Elmar Gerhards-Padilla Cyber Defense Fraunhofer
C I S C O E M A I L S E C U R I T Y A P P L I A N C E
C I S C O E M A I L S E C U R I T Y A P P L I A N C E U R L F I L T E R I N G September 2015 Version 1.3 Tobias Mayer Consulting Systems Engineer The most current version of this document can be found
ANNEXURE TO TENDER NO. MRPU/IGCAR/COMP/5239
ANNEXURE TO TENDER NO. MRPU/IGCAR/COMP/5239 Check Point Firewall Software and Management Software I. Description of the Item Up gradation, installation and commissioning of Checkpoint security gateway
WEBTHREATS. Constantly Evolving Web Threats Require Revolutionary Security. Securing Your Web World
Securing Your Web World WEBTHREATS Constantly Evolving Web Threats Require Revolutionary Security ANTI-SPYWARE ANTI-SPAM WEB REPUTATION ANTI-PHISHING WEB FILTERING Web Threats Are Serious Business Your
Inside the Storm: Protocols and Encryption of the Storm Botnet
Inside the Storm: Protocols and Encryption of the Storm Botnet Joe Stewart, GCIH Director of Malware Research, SecureWorks To be covered in this talk: Quick-and-dirty unpacking of Storm Structure of the
RTCU Gateway 2 Monitor Tool User's Manual
RTCU Gateway 2 Monitor Tool User's Manual Version 3.20 I RTCU Gateway 2 - Monitor Tool Table of Contents Part I Monitor Tool 2 1 Clients... 3 2 Message... Log 4 3 Main... Menu 4 File... 5 Connect... 5
Quarantined Messages 5 What are quarantined messages? 5 What username and password do I use to access my quarantined messages? 5
Contents Paul Bunyan Net Email Filter 1 What is the Paul Bunyan Net Email Filter? 1 How do I get to the Email Filter? 1 How do I release a message from the Email Filter? 1 How do I delete messages listed
Introducing IBM s Advanced Threat Protection Platform
Introducing IBM s Advanced Threat Protection Platform Introducing IBM s Extensible Approach to Threat Prevention Paul Kaspian Senior Product Marketing Manager IBM Security Systems 1 IBM NDA 2012 Only IBM
Technology Blueprint. Essential Protection for PCs. Match your endpoint protection with today s risks
Technology Blueprint Essential Protection for PCs Match your endpoint protection with today s risks LEVEL 1 2 3 4 5 SECURITY CONNECTED REFERENCE ARCHITECTURE LEVEL 1 2 4 5 3 Security Connected The Security
Search Engine Optimisation (SEO) Factsheet
Search Engine Optimisation (SEO) Factsheet SEO is a complex element of our industry and many clients do not fully understand what is involved in getting their site ranked on common search engines such
Bing Ads for Realtors: Get $100 FREE
Click here for your free $100: https://advertise.bingads.microsoft.com/en us/holidayoffer Bing Ads for Realtors: Get $100 FREE Are you a realtor who needs more clients in less time? Do you want a predictable
Email Gateways Using MDaemon 6.0
Email Gateways Using MDaemon 6.0 Alt-N Technologies, Ltd 1179 Corporate Drive West, #103 Arlington, TX 76006 Tel: (817) 652-0204 2002 Alt-N Technologies. All rights reserved. Product and company names
isheriff CLOUD SECURITY
isheriff CLOUD SECURITY isheriff is the industry s first cloud-based security platform: providing fully integrated endpoint, Web and email security, delivered through a single Web-based management console
Detecting Spam in VoIP networks
Detecting Spam in VoIP networks Ram Dantu, Prakash Kolan Dept. of Computer Science and Engineering University of North Texas, Denton Presentation: Heikki Ollikainen /53089D Presentation Introduction Architecture
Removing Web Spam Links from Search Engine Results
Removing Web Spam Links from Search Engine Results Manuel EGELE [email protected], 1 Overview Search Engine Optimization and definition of web spam Motivation Approach Inferring importance of features
Commtouch RPD Technology. Network Based Protection Against Email-Borne Threats
Network Based Protection Against Email-Borne Threats Fighting Spam, Phishing and Malware Spam, phishing and email-borne malware such as viruses and worms are most often released in large quantities in
SafeNet Content Security Product Overview. Protecting the Network Edge
SafeNet Content Security Product Overview Protecting the Network Edge From idea to action, SafeNet smartly protects information as it moves through its lifecycle. With data encryption and control solutions,
Testing Document - DDOS Traffic Shaping Simulator
Testing Document - DDOS Traffic Shaping Simulator Authors Inbar Shabi Anatoly Cherner 1. Functional Requirements 1.1 Client 1.1.1 Graphical presentation of virtual network # Requirement Test Expected Result
MESSAGING SECURITY GATEWAY. Detect attacks before they enter your network
MESSAGING SECURITY GATEWAY Detect attacks before they enter your network OVERVIEW This document explains the functionality of F-Secure Messaging Security Gateway (MSG) what it is, what it does, and how
SB 1386 / AB 1298 California State Senate Bill 1386 / Assembly Bill 1298
California State Senate Bill 1386 / Assembly Bill 1298 InterSect Alliance International Pty Ltd Page 1 of 8 Intersect Alliance International Pty Ltd. All rights reserved worldwide. Intersect Alliance Pty
Domain Name Abuse Detection. Liming Wang
Domain Name Abuse Detection Liming Wang Outline 1 Domain Name Abuse Work Overview 2 Anti-phishing Research Work 3 Chinese Domain Similarity Detection 4 Other Abuse detection ti 5 System Information 2 Why?
the delivery of standout services and information to customers via the internet
Content Management Email Marketing Social Media Marketing ecommerce Reporting and Analytics Website Design Customer Relationship Management Search Engine Optimisation Email Hosting the delivery of standout
A Critical Investigation of Botnet
Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals
F-Secure Internet Gatekeeper
F-Secure Internet Gatekeeper TOC F-Secure Internet Gatekeeper Contents Chapter 1: Welcome to F-Secure Internet Gatekeeper...5 1.1 Features...6 Chapter 2: Deployment...8 2.1 System requirements...9 2.2
FortiMail Email Filtering Course 221-v2.2 Course Overview
FortiMail Email Filtering Course 221-v2.2 Course Overview FortiMail Email Filtering is a 2-day instructor-led course with comprehensive hands-on labs to provide you with the skills needed to design, configure,
Quick Reference Guide. Online Courier: FTP. Signing On. Using FTP Pickup. To Access Online Courier. https://onlinecourier.suntrust.
Quick Reference Guide Online Courier: FTP https://onlinecourier.suntrust.com With SunTrust Online Courier, you can have reports and files delivered to you using an FTP connection. There are two delivery
Innovations in Network Security
Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.
STPIC/Admin/002/2009-2010/ Date: 18.06.09. Sub: Quotation for purchase/renewal of Anti Virus Software Reg.
STPIC/Admin/002/2009-2010/ Date: 18.06.09 Sub: Quotation for purchase/renewal of Anti Virus Software Reg. Software Technology Parks of India (STPI), an autonomous Society under Ministry of Communication
Storm Worm & Botnet Analysis
Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing
Access Control Rules: URL Filtering
The following topics describe how to configure URL filtering for your Firepower System: URL Filtering and Access Control, page 1 Reputation-Based URL Filtering, page 2 Manual URL Filtering, page 5 Limitations
SEO Services Sample Proposal
SEO Services Sample Proposal Scroll down to see the rest of this truncated sample. When purchased, the complete sample is 18 pages long and was written using these Proposal Pack templates: Cover Letter,
Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
2001 2014 EdgeWave. All rights reserved. The EdgeWave logo is a trademark of EdgeWave Inc. All other trademarks and registered trademarks are hereby acknowledged. Microsoft and Windows are either registered
The Hillstone and Trend Micro Joint Solution
The Hillstone and Trend Micro Joint Solution Advanced Threat Defense Platform Overview Hillstone and Trend Micro offer a joint solution the Advanced Threat Defense Platform by integrating the industry
Ciphermail Gateway PDF Encryption Setup Guide
CIPHERMAIL EMAIL ENCRYPTION Ciphermail Gateway PDF Encryption Setup Guide March 6, 2014, Rev: 5454 Copyright c 2008-2014, ciphermail.com. CONTENTS CONTENTS Contents 1 Introduction 4 2 Portal 4 3 PDF encryption
Grow your Business with our advanced Call Tracking services
Grow your Business with our advanced Call Tracking services Track the effectiveness of your numbers in real time Being able to see when calls are coming in and who they re from can be vital to a business