Visible to the public Accurate Spear Phishing Campaign Attribution and Early Detection

TitleAccurate Spear Phishing Campaign Attribution and Early Detection
Publication TypeConference Paper
Year of Publication2016
AuthorsHan, YuFei, Shen, Yun
Conference NameProceedings of the 31st Annual ACM Symposium on Applied Computing
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-3739-7
Keywordsattribution, composability, Human Behavior, Metrics, Pervasive computing, phishing, phishing attack, pubcrawl, semi-supervised learning, spear phishing emails

There is growing evidence that spear phishing campaigns are increasingly pervasive, sophisticated, and remain the starting points of more advanced attacks. Current campaign identification and attribution process heavily relies on manual efforts and is inefficient in gathering intelligence in a timely manner. It is ideal that we can automatically attribute spear phishing emails to known campaigns and achieve early detection of new campaigns using limited labelled emails as the seeds. In this paper, we introduce four categories of email profiling features that capture various characteristics of spear phishing emails. Building on these features, we implement and evaluate an affinity graph based semi-supervised learning model for campaign attribution and detection. We demonstrate that our system, using only 25 labelled emails, achieves 0.9 F1 score with a 0.01 false positive rate in known campaign attribution, and is able to detect previously unknown spear phishing campaigns, achieving 100% 'darkmoon', over 97% of 'samkams' and 91% of 'bisrala' campaign detection using 246 labelled emails in our experiments.

Citation Keyhan_accurate_2016