以社群行為模組及餘弦定理輔佐實現魚叉式釣魚信件偵測

電子郵件最早是純文字（ASCII）的溝通媒介，發展至後來加入多媒體的附件，成為時下通訊方法之一。郵件往往是人類溝通的管道，但有心人士利用在惡意攻擊上。近年來，進階式持續性攻擊(Advanced Persistent Threat，APT) 盛行，全球金融上的損失高達數億元，駭客為了取得機密情報而研發出新型的攻擊手段：魚叉式網路釣魚，過去許多學者提出釣魚郵件的防範技術，卻不足以對抗魚叉式釣魚郵件。為了有效降低APT威脅，本研究主張模組化使用者過去的社群行為與往來郵件模式：加入社交特色判斷該名寄件者和收件者的相關程度，和單純藉助郵件特色做為判斷準確性部分提升，並分析該名寄件者和收件者的通訊行為，擷取郵件的歷程記錄(Log)：分析標題(Subject)、夾帶檔案(Attachment)類型/尺寸，三種特性的對應關係，並基於三種特性建造通訊者慣用的行為模組，以餘弦相似性對受測信件做相似度偵測，來分類出惡意和正常信件。和以往的防釣魚信件的技術相比，能夠增加準確率及降低誤判率。

關鍵字

社群行為；魚叉式網路釣魚；進階式持續性攻擊；斷詞法；餘弦相似性

並列摘要

Email applications provide an efficient communication way between people for both personal and business purposes. Due to the convenience and popularity of email, hackers can use spear phishing techniques to trick the target users into revealing sensitive information by either clicking a malicious web site link or opening malicious attachments. In the past, many researchers proposed phishing prevention technologies, but they were not successful in fighting spear phishing emails. In order to reduce the threat of spear phishing, we propose a system, called SBModel, combining social feature and email behavioral patterns to detect spear phishing. Experimental results show that SBModel outperforms other approaches.

並列關鍵字

N-gram ； Social Behavior ； Spear Phishing ； Advanced Persistent Threat ； Cosine Theory

參考文獻

[1] Colin Tankard: Advanced Persistent threats and how to monitor and deter them. Network Security 2011(8): 16-19 (2011).

[2] Robert Koch, Mario Golling, Gabi Dreo Rodosek: A Revised Attack Taxonomy for a New Generation of Smart Attacks. Computer and Information Science 7(3): 18-30 (2014)

[3] Jingguo Wang, Tejaswini Herath, Rui Chen, Arun Vishwanath, H. Raghav Rao: Research Article Phishing Susceptibility: An Investigation Into the Processing of a Targeted Spear Phishing Email. IEEE Trans. Prof. Communication 55(4): 345-362 (2012).

[5] Aditya K. Sood, Richard J. Enbody: Targeted Cyberattacks: A Superset of Advanced Persistent Threats. IEEE Security & Privacy 11(1): 54-61 (2013)

[6] Markus Jakobsson:Modeling and Preventing Phishing Attacks. Financial Cryptography 2005: 89

國際替代計量

以社群行為模組及餘弦定理輔佐實現魚叉式釣魚信件偵測

未授權

主題瀏覽