Spam Detection Using IsMail - An Artificial Immune System For Mail Slavisa Sarafijanovic and Jean-Yves Le Boudec, EPFL MICS, Neuchatel, August 2-3, 2007. 1/6 MICS
IsMail An Artificial Immune System For Collaborative Spam Detection An artificial immune system is a system based on the principles of the human immune system One antispam system (Ismail is added per email server. Antispam systems collaborate. EPFL ETHZ UNIL 2/6
Let first recall what information can be used for automated spam recognition 1. Spammines of words Per user learned database: P( Spam Credit_card = 0.8 P( Spam Cent = 0.95 P( Spam Picture = 0.001 New spam email: and mind, said Zeb, we don't and mind, said Zeb, we don't 2. Bulkiness of spam Spam bulk: Detecting bulkiness: User 1 User 2 User N Not used enough! Counter Compute P( Spam Picture, NewYear, Credit_card, Per user! 3. Sender information Sent From: spammer12345@distro123.com Sent From: Jean-Yves.LeBoudec@epfl.ch Botnets, Nigerian spam! 3/6
How our artificial immune system (AIS detects spam? (1/2 AIS produces and uses detectors - detectors are binary strings able to recognize (using similarity matching spammy portions of emails Set of detectors: 111010101110 111011100001 101010111111 similarity matching New email: and mind, said Zeb, we don't 010101101101 111011100001 similarity hashing spam/normal 4/6
How our artificial immune system detects spam? (2/2 How the detectors are produced: 4 3 2 Negative Selection Maturation delete as spam feedback from the protected system 1 random candidate detectors 5 new old (memory Maturation (another system 1 2 3 4 5 randomness adaptation to the user s profile local processing collaboration (discover new bulky spam active detectors Conclusion: AIS approach seems to fit well distributed detection problems Analogy to the human immune system: steps 1-5! 5/6
Project Status Initial evaluation (simulation: Patented design: True Positive False Positive Not obfuscated spam Obfuscated spam METHOD TO FILTER ELECTRONIC MESSAGES IN A MESSAGE PROCESSING SYSTEM, US patent No 11/515,063, filed on Sept 5, 2006. Built a realistic prototyping and evaluation platform: Preliminary detection results with respect to the number of collaborating antispam systems: modest collaboration (small number of neighboring servers enables promising detection results; the system is resistant to the tested obfuscation by spammer. (Disclaimer: simulation assumptions! AntispamLab A Tool For Realistic Evaluation of Spam Filters, accepted for The Fourth Conference on Email and Antispam, Mountain View, California, USA, August 2-3, 2007. 6/6