Timeline for ML approach to malicious attachments using email contents
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 9, 2019 at 17:06 | vote | accept | solumnant | ||
| May 7, 2019 at 13:21 | answer | added | A. Hersean | timeline score: 0 | |
| Apr 29, 2019 at 20:54 | comment | added | solumnant | I guess the best way to put my question was whether there was any theoretical basis for what I was thinking of (whitepaper/research), and whether any open source projects or products even exited around the concept. It seemed as though the concept should already exist but I didn't know the name for it or how to look for it. I really just wanted a starting point for my own research, or perhaps other ways to use the existing (computationally expensive) information we already produce. | |
| Apr 29, 2019 at 19:59 | comment | added | schroeder♦ | There's a bit of an issue with your question. Questions of the type "what product/service does X?" is not a great fit on a Q&A site because the lists of potential answers could go on forever (even if I think that there are none of this type). Did you have another question around this situation? | |
| Apr 29, 2019 at 19:43 | history | edited | schroeder♦ | CC BY-SA 4.0 |
removed extraneous explanations
|
| Apr 29, 2019 at 19:41 | history | edited | solumnant | CC BY-SA 4.0 |
Clarified the context and meaning of my question
|
| Apr 29, 2019 at 19:35 | review | Close votes | |||
| May 11, 2019 at 4:46 | |||||
| Apr 29, 2019 at 19:33 | history | edited | solumnant | CC BY-SA 4.0 |
Clarified the context and meaning of my question
|
| Apr 29, 2019 at 19:29 | comment | added | solumnant | @VipulNair That's mostly the case but there are a number of cases where people will send something like "Earnings_Report.pdf.exe". I just want to provide better coverage for the organization and I thought there should be some way to combine our existing email analysis with our automated static and dynamic analysis in a programmatic way. | |
| Apr 29, 2019 at 19:15 | vote | accept | solumnant | ||
| Apr 29, 2019 at 19:37 | |||||
| Apr 29, 2019 at 19:14 | comment | added | solumnant | That's fair. I'm coming from a SOC that can't block content programmatically, and we don't have influence with the people who do. I'm not familiar with the options available to the team that manages filtering either. Part of what we're interested in is tracking campaigns, and I was wondering whether this approach might yield better coverage without costing too many resources. We have a large repository of mail internally if there aren't any large public data-sets. | |
| Apr 29, 2019 at 19:14 | comment | added | yeah_well | I am sure companies are working on it and its still a huge problem to correctly determine if a email is maliscious,spam or not.It just very complex if you start looking at it | |
| Apr 29, 2019 at 19:12 | comment | added | yeah_well | Also no one sends executables to begin with.Most people send docx files or powerpoints with vba. | |
| Apr 29, 2019 at 19:12 | answer | added | schroeder♦ | timeline score: 1 | |
| Apr 29, 2019 at 18:53 | history | edited | solumnant | CC BY-SA 4.0 |
edited title
|
| Apr 29, 2019 at 17:07 | comment | added | Steffen Ullrich | Given the high variance in mail content I doubt that it is possible to get both a high true positive rate and a low false positive rate with this. Most mails would likely not have a clear enough classification at all since not enough similar mails were seen. And there are likely better and simpler approaches, like why should one accept an executable attachment from an unknown sender or from a sender who never send such attachment in the first place? | |
| Apr 29, 2019 at 17:00 | review | First posts | |||
| Apr 30, 2019 at 4:59 | |||||
| Apr 29, 2019 at 16:56 | history | asked | solumnant | CC BY-SA 4.0 |