1 Spam – a living thing Predicting future evolution based on the past Daniel Raduta

2 Filter’s race  Many approaches  Mostly reactive Heuristic Reputation based Spam fingerprints …  Some proactive Bayesian  Main purpose: quickly adapt to new spammer tricks

3 Know better  Dissecting spam phenomena  How do they unleash spam  A spam is more than text Headers, MIME structure, text content, embedded images, …  Closer studying how the spam changes  Spam  Complex structure  Comes in many flavors, but with some common essentials  Ongoing evolution

4 Predict  Spam is close to a living thing!  Spam populations evolve to adapt to environment changes, otherwise they’ll be extinct  Think of how to model its evolution Borrow from genetics theories and models Other methods  Based on past evolution we can predict future evolution  True proactive method