A Behavior-Based Approach to Securing Email Systems

Abstract

The Malicious Email Tracking (MET) system, reported in a prior publication, is a behavior-based security system for email services. The Email Mining Toolkit (EMT) presented in this paper is an offline email archive data mining analysis system that is designed to assist computing models of malicious email behavior for deployment in an online MET system. EMT includes a variety of behavior models for email attachments, user accounts and groups of accounts. Each model computed is used to detect anomalous and errant email behaviors. We report on the set of features implemented in the current version of EMT, and describe tests of the system and our plans for extensions to the set of models.

Can machine learning be secure?

“…Outlier detection is the task of identifying anomalous data and is a widely used paradigm in fault detection [40], intrusion detection [23], and virus detection [33,34]. We find the smallest region that contains some fixed percentage of the observed data, which is called the support of the data's distribution.…”

Pattern-based causal relationships discovery from event sequences for modeling behavioral user profile in ubiquitous environments

“…In [64], the authors highlight the requirements and challenges facing user modeling systems, such as dataset labeling and computational complexity, and summarize the existing user modeling approaches. Stolfo et al [59] propose a histogram-based method for modeling the behavior of users' email accounts. Histograms are compared to find similar and abnormal behaviors in the same user's account.…”

“…In most work on user profile construction, such as [64,13,59,71,33], behavior-based profiles are built using machine learning and data mining techniques. In [64], the authors highlight the requirements and challenges facing user modeling systems, such as dataset labeling and computational complexity, and summarize the existing user modeling approaches.…”

Applying Biometric Principles to Avatar Recognition

“…In particular, a lot of research has been done in vocabulary analysis and profiling of plain text [25,32,33], emails [54,61] and source code [51,19,14]. Written text or spoken word, once transcribed, can be analyzed in terms of vocabulary and style to determine its authorship.…”