Identity and behavior - based secure personalized message classification systems: Market Assessment

基于身份和行为的安全个性化消息分类系统：市场评估

• 批准号: 520640-2017
• 负责人: Traore, Issa
• 金额: $ 1.09万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Idea to Innovation
• 财政年份: 2017
• 资助国家: 加拿大
• 起止时间: 2017-01-01 至 2018-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=618832
• 关键词: Identity; behavior; based; secure; personalized

Phishing is still currently one of the most impactful forms of attacks delivered through electronic messages (i.e. emails, short messages, tweets). Targeted spearheaded phishing poses even more challenges as it relies on intimate knowledge of the victim gathered from online data dumps (e.g. in the dark web) or by hijacking online accounts. Recent high-profile hacking incidents have shown the limits of traditional anti-phishing solutions, such as spam filters and anti-virus systems. Those methods are heavily focused on analyzing the "message" and not the "messenger". As such it is easy to evade them by crafting the "message" to fit expected messaging standard (e.g. by removing spam idiosyncrasies and keywords, proof-reading the message, and using familiar terms and names). We have developed a new approach to protect against targeted spearheaded phishing attacks based on verifying the genuineness of the messenger's identity, and checking whether key message characteristics match the messaging behavior of the claimed messenger identity with respect to the recipient. The genuineness of the messenger's identity is established through stylometric authorship verification, which is known to be very challenging when dealing with short unstructured text. Messaging behavior is based on message origin location patterns (i.e. typical locations from where genuine messages were sent by this messenger), file attachment pattern (i.e. likelihood for the messenger to attach files of certain characteristics), and embedded URLs pattern (i.e. likelihood for the messenger to embed URLs, and validity of such URLs). The proposed model is used to verify both incoming and outgoing messages. Checking outgoing messages allows determining whether a legitimate account has been hijacked and is being leveraged to send out phishing messages to victims known by the account owner. Checking incoming messages protects against phishing attacks by establishing whether the sender is genuine and known by the recipient. The goal of the project is to conduct a market study for the proposed technology. The focus of the market study will be to assess the market potential of the technology in anticipation of transferring it to existing cybersecurity companies.

网络钓鱼仍然是目前通过电子消息（即电子邮件，短信，推文）传递的最具影响力的攻击形式之一。有针对性的矛头型网络钓鱼带来了更多的挑战，因为它依赖于从在线数据转储（例如在暗网中）或通过劫持在线帐户收集的受害者的亲密知识。最近备受瞩目的黑客攻击事件显示了传统反钓鱼解决方案的局限性，例如垃圾邮件过滤器和防病毒系统。这些方法主要集中在分析“信息”，而不是“信使”。因此，很容易通过精心制作“消息”以符合预期的消息传递标准（例如，通过删除垃圾邮件特性和关键字，校对消息，并使用熟悉的术语和名称）来规避它们。我们开发了一种新的方法来防范针对性的矛头型网络钓鱼攻击，该方法基于验证信使身份的真实性，并检查关键消息特征是否与声称的信使身份相对于收件人的消息传递行为相匹配。信使身份的真实性是通过文体作者身份验证建立的，这在处理短的非结构化文本时是非常具有挑战性的。消息传递行为基于消息源位置模式（即，该消息传递者发送真实消息的典型位置）、文件附件模式（即，消息传递者附加具有某些特征的文件的可能性）和嵌入URL模式（即，消息传递者嵌入URL的可能性，以及这些URL的有效性）。该模型用于验证传入和传出消息。检查传出的消息可以确定合法帐户是否已被劫持，并被用来向帐户所有者已知的受害者发送网络钓鱼消息。检查传入的邮件可以通过确定发件人是否是真实的以及收件人是否知道发件人来防止网络钓鱼攻击。该项目的目标是对拟议的技术进行市场研究。市场研究的重点将是评估该技术的市场潜力，预计将其转移到现有的网络安全公司。