1. 1 www.bitdefender.com Spam – a living thing Predicting future evolution based on the past Daniel Raduta

2. 2 www.bitdefender.com Filter’s race  Many approaches  Mostly reactive Heuristic Reputation based Spam fingerprints …  Some proactive Bayesian  Main purpose: quickly adapt to new spammer tricks

3. 3 www.bitdefender.com Know better  Dissecting spam phenomena  How do they unleash spam  A spam email is more than text Headers, MIME structure, text content, embedded images, …  Closer studying how the spam changes  Spam email:  Complex structure  Comes in many flavors, but with some common essentials  Ongoing evolution

4. 4 www.bitdefender.com Predict  Spam is close to a living thing!  Spam populations evolve to adapt to environment changes, otherwise they’ll be extinct  Think of how to model its evolution Borrow from genetics theories and models Other methods  Based on past evolution we can predict future evolution  True proactive method