UCL Discovery
UCL home » Library Services » Electronic resources » UCL Discovery

That ain’t you: Blocking spearphishing through behavioral modelling

Stringhini, G; Thonnard, O; (2015) That ain’t you: Blocking spearphishing through behavioral modelling. In: Detection of Intrusions and Malware, and Vulnerability Assessment. (pp. pp. 78-97). Springer Green open access

[thumbnail of paper.pdf]
Preview
Text
paper.pdf

Download (295kB) | Preview

Abstract

One of the ways in which attackers steal sensitive information from corporations is by sending spearphishing emails. A typical spearphishing email appears to be sent by one of the victim’s coworkers or business partners, but has instead been crafted by the attacker. A particularly insidious type of spearphishing emails are the ones that do not only claim to be written by a certain person, but are also sent by that person’s email account, which has been compromised. Spearphishing emails are very dangerous for companies, because they can be the starting point to a more sophisticated attack or cause intellectual property theft, and lead to high financial losses. Currently, there are no effective systems to protect users against such threats. Existing systems leverage adaptations of anti-spam techniques. However, these techniques are often inadequate to detect spearphishing attacks. The reason is that spearphishing has very different characteristics from spam and even traditional phishing. To fight the spearphishing threat, we propose a change of focus in the techniques that we use for detecting malicious emails: instead of looking for features that are indicative of attack emails, we look for emails that claim to have been written by a certain person within a company, but were actually authored by an attacker. We do this by modelling the email-sending behavior of users over time, and comparing any subsequent email sent by their accounts against this model. Our approach can block advanced email attacks that traditional protection systems are unable to detect, and is an important step towards detecting advanced spearphishing attacks.

Type: Proceedings paper
Title: That ain’t you: Blocking spearphishing through behavioral modelling
Event: 12th International Conference, DIMVA 2015, Milan, Italy, July 9-10, 2015
ISBN-13: 9783319205496
Open access status: An open access version is available from UCL Discovery
DOI: 10.1007/978-3-319-20550-2_5
Publisher version: http://dx.doi.org/10.1007/978-3-319-20550-2_5
Language: English
Additional information: The original publication is available at www.springerlink.com
UCL classification: UCL
UCL > Provost and Vice Provost Offices > UCL BEAMS
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science
URI: https://discovery.ucl.ac.uk/id/eprint/1470379
Downloads since deposit
415Downloads
Download activity - last month
Download activity - last 12 months
Downloads by country - last 12 months

Archive Staff Only

View Item View Item