5

This question already has an answer here:

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc).

I order to do this I need to have a lis of examples I could use to understand "spam", "phishing" or "social engineer" language.

I'm planning to focus on english language emails.

Are there any databases that contain examples of:
- spam email (my spam box is very mixed, and I might have some valid emails in there.
- phishing emails (or spear phishing)
- emails marked as social engineering attacks.

marked as duplicate by Deer Hunter, Matthew, LvB, Dmitry Grigoryev, Xander Mar 15 '16 at 13:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Hi Florin - it's always worth having a quick search to see if your question has already been asked... – Rory Alsop Mar 15 '16 at 13:58
  • 1
    @RoryAlsop, I did look around. I'm not interested in targeted attacks like the other post. I am interested in anything. – sir_k Mar 15 '16 at 14:52
1

Assuming you're using some sort of machine learning (and even if you're not), you'll need a distraction corpus as well (in the anti-spam industry, we call desired mail "ham" because it's easier to say than "non-spam"), and that will –by far– be your biggest challenge.

One starting point on your road to attracting spam could be this old Stack Overflow request for a Publicly Available Spam Filter Training Set or this old Stack Overflow Brainstorm: How to quickly create a honeypot for mass spam? While both are off-topic for Stack Overflow, that might not be the case here.

Another starting point is the SpamAssassin public corpus, though at this point it's 10+ years old.

There are other techniques for attracting spam and ham, too. Search for seeding a spam trap and you'll find tons of advice from anti-spam experts and email service providers.

Generally speaking, it's a lot of effort to collect a good corpus that will help you predict how to filter new spam. It's significantly harder to collect proper samples of phishing, advance-fee fraud, and other targeted spam. I've already mentioned that collecting non-bulk ham will also be a challenge, but if you're trying to calibrate to catch phishing, you'll need to make sure your ham corpus contains lots of legitimate non-marketing mail related to finance and account maintenance.

Your best bet is to team up with somebody in the industry who already has good data.

This could include free software communities like that of SpamAssassin. If you can instantiate your work as a logical combination of regular expressions (SpamAssassin rules), you can get the SpamAssassin QA system to run your combinations against its own corpora. This will require licensing your work as Apache License v2 so that it can be used by SpamAssassin itself.

The Anti-Phishing Working Group (APWG) has lots and lots of phishing samples, though you may have to pay for them (unless you're working on a paper for their eCrime Symposium?)

Project Honeypot also has a good collection of spam (though they won't have ham). You might be able to work with them.

Not the answer you're looking for? Browse other questions tagged or ask your own question.