Based on my understanding of the field, it seems like there is a lot of attention paid to spam filtering based on the contents and metadata of an email, and there is considerable attention paid to detecting malicious attachments on their own, but I was wondering whether any work has been done on taking a ML approach of analyzing attachments and emails together to determine malice. It seems like you could do a lot better detecting emails with bad attachments if the contents of the attachment don't match up with the body of the email.
For instance, an email whose body claims to have an earnings report wouldn't be suspicious, and an executable file wouldn't be any more suspicious than any executable file, but an earnings report email with an executable attachment should set off red flags.
I was wondering whether products already incorporated this insight or if there were open source projects that integrated this capability.
For context, I work at a large company that already has a spam filter, and we perform automated static and dynamic analysis on attachments, my question is whether I could tie the output of the tree together with ML to provide better coverage for threats that may slip through. We already do manual content to catch these kinds of things so I was wondering if applying ML could catch novel threats. I know that EXEs aren't the main threat.