Behavioral Experiments in Email Filter Evasion
Behavioral Experiments in Email Filter Evasion
复制标题
电子邮件过滤器规避的行为实验
DOI：
10.1609/aaai.v30i1.10061
复制
发表时间：
2016
期刊：
影响因子：
6
通讯作者：
Yevgeniy Vorobeychik
中科院分区：
文献类型：
--
作者：
Liyiming Ke;Bo Li;Yevgeniy Vorobeychik
尽管几十年来一直在努力打击垃圾邮件，但不受欢迎的甚至是恶意的电子邮件，比如旨在欺骗收件人泄露敏感信息的网络钓鱼，仍然经常进入人们的邮箱。可以肯定的是，电子邮件过滤器能够阻止大部分垃圾邮件到达用户，但是垃圾邮件发送者和钓鱼者已经掌握了逃避过滤器的艺术，或者操纵电子邮件消息的内容以避免被过滤。我们提出了一个独特的行为实验，旨在研究电子邮件过滤器逃避。我们的实验框架更广泛：考虑到广泛使用机器学习方法来区分垃圾邮件和非垃圾邮件，我们研究了人类受试者如何操纵垃圾邮件模板来逃避基于分类的过滤器。我们发现，在滤波器中加入少量的噪声会显著降低受试者逃避它的能力，观察到噪声不仅有短期影响，而且还会降低长期的逃避性能。此外，我们发现分类器（过滤器）特征对电子邮件模板的更大覆盖显著增加了规避它的难度。这一观察结果表明，积极的特征缩减——应用机器学习中的一种常见做法——实际上可以促进逃避。除了对行为的描述性分析外，我们还开发了一个人类逃避行为的综合模型，该模型与观察到的行为密切匹配，并在模拟中有效地复制了实验结果。
Despite decades of effort to combat spam, unwanted and even malicious emails, such as phish which aim to deceive recipients into disclosing sensitive information, still routinely find their way into one's mailbox.To be sure, email filters manage to stop a large fraction of spam emails from ever reaching users, but spammers and phishers have mastered the art of filter evasion, or manipulating the content of email messages to avoid being filtered.We present a unique behavioral experiment designed to study email filter evasion.Our experiment is framed in somewhat broader terms: given the widespread use of machine learning methods for distinguishing spam and non-spam, we investigate how human subjects manipulate a spam template to evade a classification-based filter.We find that adding a small amount of noise to a filter significantly reduces the ability of subjects to evade it, observing that noise does not merely have a short-term impact, but also degrades evasion performance in the longer term.Moreover, we find that greater coverage of an email template by the classifier (filter) features significantly increases the difficulty of evading it.This observation suggests that aggressive feature reduction — a common practice in applied machine learning — can actually facilitate evasion.In addition to the descriptive analysis of behavior, we develop a synthetic model of human evasion behavior which closely matches observed behavior and effectively replicates experimental findings in simulation.