Behavior Profiling of Email.PPT

Behavior Profiling of Email Columbia University Department of Computer Science IDS lab: /ids Data Mining Machine Learning in Security Behavior-based Anomaly Detection (Banks figured this out years ago. What is a fraud?) JAM project, 1996- Discover “attacks/bad behavior” via abnormal behavior Compare real-time or archived activity against models of normal (network/host/email) behavior Windows Registry Unix/Windows File System Accesses Command Lines (Masquerade) Application layer Email Can train in real-world environments over “dirty” data and does not require costly, time-intensive training period with formatted or pristine data Unsupervised Probabilistic Anomaly Detection Algorithm Load data and run Many solutions claiming to be “behavior-based” rely upon a static set of rules like signature-based technology Principled mathematical/statistics and machine learning algorithms Malicious E-mail Tracking (MET) An online tool for detecting abnormal email, eg., New viruses, SPAM and misuses by e-mail flow statistics Performs automated e-mail ATTACHMENT traffic analysis Behavior-based detection of “abnormal” traffic An offline tool assisting analysts to Develop models of email behavior of USER ACCOUNTS for various detection task Train, analyze, test models for performance Content vrs Behavior What you are about to see is focused on (temporal) behavior/event streams NOT EXCLUSIVELY CONTENT BASED New source of evidence to correlate with Content-based analyses MET Incorporates Analysis of Attachment Account Statistics Attachment tracking and propagation detection: Across accounts Can be tracked globally (Fails on polymorphic viruses) Eg., Current Virus/Spam Detection Content based “signatures” Signatures in attachments for viruses Attachment type filtering Hotlisted email senders for Spam MEF – Malicious Email Filter Na?ve Bayes classifier assigning likelihood of maliciousness of attachments Na?ve Bayes classifiers applied to word content for Spam Email Atta