Malicious Spam Emails Developments and Authorship Attribution

Abstract

The Internet is a decentralized structure that offers speedy communication, has a global reach and provides anonymity, a characteristic invaluable for committing illegal activities. In parallel with the spread of the Internet, cybercrime has rapidly evolved from a relatively low volume crime to a common high volume crime. A typical example of such a crime is the spreading of spam emails, where the content of the email tries to entice the recipient to click a URL linking to a malicious Web site or downloading a malicious attachment. Analysts attempting to provide intelligence on spam activities quickly find that the volume of spam circulating daily is overwhelming; therefore, any intelligence gathered is representative of only a small sample, not of the global picture. While past studies have looked at automating some of these analyses using topic-based models, i.e. separating email clusters into groups with similar topics, our preliminary research investigates the usefulness of applying authorship-based models for this purpose. In the first phase, we clustered a set of spam emails using an authorship-based clustering algorithm. In the second phase, we analysed those clusters using a set of linguistic, structural and syntactic features. These analyses reveal that emails within each cluster were likely written by the same author, but that it is unlikely we have managed to group together all spam produced by each group. This problem of high purity with low recall, has been faced in past authorship research. While it is also a limitation of our research, the clusters themselves are still useful for the purposes of automating analysis, because they reduce the work needing to be performed. Our second phase revealed useful information on the group that can be utilized in future research for further analysis of such groups, for example, identifying further linkages behind spam campaigns.

Authorship Analysis of the Zeus Botnet Source Code

“…While supervised learning allows us to use cross-fold validation to choose good parameters, unsupervised learning must rely either on other metrics (such as cluster stability) or ensemble learning to reduce the impact of bad parameter sets. For this application we chose the latter, given EAC's use in previous studies of this nature [10], [11].…”

From ZeuS to Zitmo: Trends in Banking Malware

“… Spam campaigns: the user receives an e-mail message from a well-known organization with some false banking information attached or with a link included in the e-mail. Once, the user clicks the link or downloads the attached file to the e-mail, the system will be infected [10,37].…”

Malicious URL Detection using Deep Learning

“…WhatsApp, Orkut etc. are the most commonly used applications to spread the malicious URLs [1], [2], [3]. They host unsolicited information on the web page.…”