Spam – a living thing Predicting future evolution based on the past Daniel Raduta

1. Spam – a living thing Predicting future evolution based on the past Daniel Raduta

2. Filter’s race • Many approaches • Mostly reactive • Heuristic • Reputation based • Spam fingerprints • … • Some proactive • Bayesian • Main purpose: quickly adapt to new spammer tricks

3. Know better • Dissecting spam phenomena • How do they unleash spam • A spam email is more than text • Headers, MIME structure, text content, embedded images, … • Closer studying how the spam changes • Spam email: • Complex structure • Comes in many flavors, but with some common essentials • Ongoing evolution

4. Predict • Spam is close to a living thing! • Spam populationsevolve to adapt to environment changes, otherwise they’ll be extinct • Think of how to model its evolution • Borrow from genetics theories and models • Other methods • Based on past evolution we can predict future evolution • True proactive method