Canning more than SPAM with Bayesian filtering
Martin Overton IBM Global Services
Technical stream: Thursday 30 Sept 2004, 11.50-12.30.
When most people think of tools to combat malware, very few will give a passing thought to Bayesian filtering, why?
Common reasons include:
- They don't realize that Bayesian filtering can be used against malware (viruses, Trojans, worms, etc.)
- They are just for spam.
- They don't know how to train them for malware.
This paper will investigate the use of Bayesian filtering, specifically to counter/block/detect malware. What's more, this
paper will focus on tools such as Popfile and SpamPal (which are free anti-spam systems available for both UNIX and
Windows).
The use of Bayesian filtering systems can be extremely useful in cases of fast-burning or very complex malware outbreaks
as a stop-gap until the anti-virus vendors manage to get reliable updates out to their customers.
Bayesian filtering of internal mail can also be useful in identifying infected systems in your organization that need
remedial action before 'the trickle' of infections become a 'torrent' and you are left fighting to keep your head above
the rising waters.
The paper will include statistics clearly showing the accuracy of Bayesian filtering, not just for malware, but also
for SPAM and 419 advance-fee-frauds.
