Automatic Feature Extraction

1

• Automatic Feature Extraction
• Claudiu Musat
• BitDefender

2
What features?

• Call to arms
• You beat Nicky with fists, he comes back with a
  bat. You beat him with a knife, he comes back
  with a gun. And if you beat him with a gun, you
  better kill him (Casino)
• Dont go for the knife theyll find something
  better.
• We have to find the things it pains spammers to
  change

3
But what?!

• They currently use random words, URLs,
  obfuscating, etc but
• They cant change the formatting easily. Its
  bound to stay readable.
• We can isolate the layout prototypes various
  clustering methods
• Still, they wont change everything else
• So we need to find the common parts of similar
  spams.

4
How?

• First we need to isolate similar ones
• Start with the thing we trust layout, and
  break the corpus into clusters.
• Then, for each of the clusters find common
  elements (words, regular expressions, etc.)
• Run the new heuristics against the once we
  already have
• the relief algorithm works just fine for that
• Update.

5
Thanks!

• Qs ?