那不是你：在发送之前检测Spearphishing电子邮件
That Ain't You: Detecting Spearphishing Emails Before They Are Sent
摘要：
攻击者试图从企业窃取敏感信息的方法之一是发送鱼叉式网络钓鱼电子邮件。这种类型的电子邮件通常看起来是由受害者的同事发送的，但实际上是由攻击者精心制作的。一种特别阴险的鱼叉式网络钓鱼电子邮件不仅声称来自受信任的一方，而且实际上是从该方的合法电子邮件帐户发送的。在本文中，我们提出了一个根本性的变化，用于检测这种恶意电子邮件的技术重点：而不是寻找特定的功能，是指示攻击电子邮件，我们寻找可能的指标，冒充合法所有者。我们提出了IdentityMailer，一个系统，通过学习用户随着时间的推移的典型电子邮件发送行为，并将任何后续的电子邮件从他们的帐户发送对这个模型来验证电子邮件的作者。我们在真实世界的电子邮件数据集上的实验表明，我们的系统可以有效地阻止从真正的电子邮件帐户发送的高级电子邮件攻击，传统的保护系统无法检测到。此外，我们表明，它是弹性的攻击者愿意逃避系统。据我们所知，IdentityMailer是第一个能够识别从组织内部发送的鱼叉式网络钓鱼电子邮件的系统，这些电子邮件由熟练的攻击者访问受损的电子邮件帐户。
英文摘要：
One of the ways in which attackers try to steal sensitive information from corporations is by sending spearphishing emails. This type of emails typically appear to be sent by one of the victim's coworkers, but have instead been crafted by an attacker. A particularly insidious type of spearphishing emails are the ones that do not only claim to come from a trusted party, but were actually sent from that party's legitimate email account that was compromised in the first place. In this paper, we propose a radical change of focus in the techniques used for detecting such malicious emails: instead of looking for particular features that are indicative of attack emails, we look for possible indicators of impersonation of the legitimate owners. We present IdentityMailer, a system that validates the authorship of emails by learning the typical email-sending behavior of users over time, and comparing any subsequent email sent from their accounts against this model. Our experiments on real world e-mail datasets demonstrate that our system can effectively block advanced email attacks sent from genuine email accounts, which traditional protection systems are unable to detect. Moreover, we show that it is resilient to an attacker willing to evade the system. To the best of our knowledge, IdentityMailer is the first system able to identify spearphishing emails that are sent from within an organization, by a skilled attacker having access to a compromised email account.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
