Take a look at the new version of this page: [ beta version ]. Tell us what you think.

ABSTRACT

In adversarial systems, the performance of a classifier decreases after it is deployed, as the adversary learns to defeat it. Recently, adversarial data mining was introduced as a solution to this, where the classification problem is viewed as a game mechanism between an adversary and an intelligent and adaptive classifier. Over the last years, phishing fraud through malicious email messages has been a serious threat that affects global security and economy, where traditional spam filtering techniques have shown to be ineffective. In this domain, using dynamic games of incomplete information, a game theoretic data mining framework is proposed in order to build an adversary aware classifier for phishing fraud detection. To build the classifier, an online version of the Weighted Margin Support Vector Machines with a game theoretic prior knowledge function is proposed. In this paper, a new content-based feature extraction technique for phishing filtering is described. Experiments show that the proposed classifier is highly competitive compared with previously proposed online classification algorithms in this adversarial environment, and promising results where obtained using traditional machine learning techniques over extracted features.

REFERENCES

• 1: Saeed Abu-Nimeh , Dario Nappa , Xinlei Wang , Suku Nair, A comparison of machine learning techniques for phishing detection, Proceedings of the anti-phishing working groups 2nd annual eCrime researchers summit, p.60-69, October 04-05, 2007, Pittsburgh, Pennsylvania [doi>10.1145/1299015.1299021]
• 2: Marco Barreno , Blaine Nelson , Russell Sears , Anthony D. Joseph , J. D. Tygar, Can machine learning be secure?, Proceedings of the 2006 ACM Symposium on Information, computer and communications security, March 21-24, 2006, Taipei, Taiwan [doi>10.1145/1128817.1128824]
• 3: R. Basne, S. Mukkamala, and A. H. Sung. Detection of Phishing Attacks: A Machine Learning Approach, chapter Studies in Fuzziness and Soft Computing, pages 373--383. Springer Berlin / Heidelberg, 2008.
• 4: A. Bergholz, J. D. Beer, S. Glahn, M.-F. Moens, G. Paass, and S. Strobel. New filtering approaches for phishing email. Journal of Computer Security, 2009. Accepted for publication.
• 5: A. Bergholz, J.-H. Chang, G. Paass, F. Reichartz, and S. Strobel. Improved phishing detection using model-based features. In Fifth Conference on Email and Anti-Spam, CEAS 2008, 2008.
• 6: Battista Biggio , Giorgio Fumera , Fabio Roli, Adversarial Pattern Classification Using Multiple Classifiers and Randomisation, Proceedings of the 2008 Joint IAPR International Workshop on Structural, Syntactic, and Statistical Pattern Recognition, December 04-06, 2008, Orlando, Florida [doi>10.1007/978-3-540-89689-0_54]
• 7: C.-C. Chang and C.-J. Lin. LIBSVM: a library for support vector machines, 2001. Software available at http://www.csie.ntu.edu.tw/~cjlin/libsvm.
• 8: Nilesh Dalvi , Pedro Domingos , Mausam , Sumit Sanghai , Deepak Verma, Adversarial classification, Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, August 22-25, 2004, Seattle, WA, USA [doi>10.1145/1014052.1014066]
• 9: Julie S. Downs , Mandy Holbrook , Lorrie Faith Cranor, Behavioral response to phishing risk, Proceedings of the anti-phishing working groups 2nd annual eCrime researchers summit, p.37-44, October 04-05, 2007, Pittsburgh, Pennsylvania [doi>10.1145/1299015.1299019]
• 10: Ian Fette , Norman Sadeh , Anthony Tomasic, Learning to detect phishing emails, Proceedings of the 16th international conference on World Wide Web, May 08-12, 2007, Banff, Alberta, Canada [doi>10.1145/1242572.1242660]
• 11: D. Fudenbert and J. Tirole. Game Theory. MIT Press, October 1991.
• 12: Claudio Gentile, A new approximate maximal margin classification algorithm, The Journal of Machine Learning Research, 2, 3/1/2002
• 13: R. Gibbons. Game Theory for Applied Economists. Princeton University Press, 1992.
• 14: Joshua Goodman , Gordon V. Cormack , David Heckerman, Spam and the ongoing battle for the inbox, Communications of the ACM, v.50 n.2, p.24-33, February 2007 [doi>10.1145/1216016.1216017]
• 15: John C. Harsanyi, Games with Incomplete Information Played by "Bayesian" Players, I-III, Management Science, v.50 n.12 Supplement, p.1804-1817, December 2004 [doi>10.1287/mnsc.1040.0270]
• 16: M. Kantarcioglu, B. Xi, and C. Clifton. A game theoretic framework for adversarial learning. In CERIAS 9th Annual Information Security Symposium, 2008.
• 17: D. M. Kreps and R. Wilson. Sequential equilibria. Econometrica, 50(4):863--94, July 1982.
• 18: Daniel Lowd , Christopher Meek, Adversarial learning, Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining, August 21-24, 2005, Chicago, Illinois, USA [doi>10.1145/1081870.1081950]
• 19: R. D. McKelvey, A. M. McLennan, and T. L. Turocy. Gambit: Software tools for game theory, version 0.2007.01.30, 2007.
• 20: R. D. McKelvey and T. R. Palfrey. Quantal response equilibria for normal form games. In Normal Form Games, Games and Economic Behavior, pages 6--38, 1996.
• 21: J. Nazario. Phishing corpus, 2004--2007.
• 22: Blaine Nelson , Marco Barreno , Fuching Jack Chi , Anthony D. Joseph , Benjamin I. P. Rubinstein , Udam Saini , Charles Sutton , J. D. Tygar , Kai Xia, Exploiting machine learning to subvert your spam filter, Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, p.1-9, April 15-15, 2008, San Francisco, California
• 23: J. Platt. Sequential minimal optimization: A fast algorithm for training support vector machines. In B. Schoelkopf, C. Burges, and A. Smola, editors, Advances in Kernel Methods - Support Vector Learning. MIT Press, 1998.
• 24: D. Sculley , Gabriel M. Wachman, Relaxed online SVMs for spam filtering, Proceedings of the 30th annual international ACM SIGIR conference on Research and development in information retrieval, July 23-27, 2007, Amsterdam, The Netherlands [doi>10.1145/1277741.1277813]
• 25: O. Sönmez. Learning game theoretic model parameters applied to adversarial classification. Master's thesis, Saarland University, 2008.
• 26: F. Sebastiani. Text categorization. In A. Zanasi, editor, Text Mining and its Applications to Intelligence, CRM and Knowledge Management, pages 109--129. WIT Press, Southampton, UK, 2005.
• 27: Rachna Dhamija , J. D. Tygar, The battle against phishing: Dynamic Security Skins, Proceedings of the 2005 symposium on Usable privacy and security, p.77-88, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073009]
• 28: T. L. Turocy. A dynamic homotopy interpretation of the logistic quantal response equilibrium correspondence. Games and Economic Behavior, 51(2):243--263, May 2005.
• 29: T. L. Turocy. Using quantal reponse to compute nash and sequential equilibria. Economic Theory, Vol. 42, Issue 1, 2010.
• 30: Vladimir N. Vapnik, The nature of statistical learning theory, Springer-Verlag New York, Inc., New York, NY, 1995
• 31: J. Velasquez, H. Yasuda, T. Aoki, and R. Weber. A new similarity measure to understand visitor behavior in a web site. IEICE Transactions on Information and Systems, Special Issues in Information Processing Technology for web utilization, vE87-D i2.:389--396, 2004.
• 32: J. D. Velasquez, S. A. Rios, A. Bassi, H. Yasuda, and T. Aoki. Towards the identification of keywords in the web site text content: A methodological approach. IJWIS, 1(1):53--57, 2005.
• 33: Haixun Wang , Wei Fan , Philip S. Yu , Jiawei Han, Mining concept-drifting data streams using ensemble classifiers, Proceedings of the ninth ACM SIGKDD international conference on Knowledge discovery and data mining, August 24-27, 2003, Washington, D.C. [doi>10.1145/956750.956778]
• 34: Ian H. Witten , Eibe Frank, Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems), Morgan Kaufmann Publishers Inc., San Francisco, CA, 2005
• 35: Xiaoyun Wu , Rohini Srihari, Incorporating prior knowledge with weighted margin support vector machines, Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, August 22-25, 2004, Seattle, WA, USA [doi>10.1145/1014052.1014089]
• 36: Peng Zhang , Xingquan Zhu , Yong Shi, Categorizing and mining concept drifting data streams, Proceeding of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining, August 24-27, 2008, Las Vegas, Nevada, USA [doi>10.1145/1401890.1401987]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.8 Database applications
          Subjects: Data mining

Additional Classification:
  I. Computing Methodologies
  I.5 PATTERN RECOGNITION
      I.5.2 Design Methodology
          Subjects: Classifier design and evaluation

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Security

General Terms:
Algorithms

Keywords:
adversarial classification, data mining, email filtering, game theory, games of incomplete information, spam and phishing detection