Fighting malware and spam

Pseudo-words for spam detection in an unmodified Naive Bayesian Text Classifier

John Graham-Cumming POPFile Project

  download slides (PDF)

The POPFile program has proved highly accurate at spam detection with a low false positive rate, yet uses an unmodified Naïve Bayesian Text Classifier with no ‘magic’ values or tweaks. Initially, POPFile performed poorly against spam, but a library of email parsing code and a set of pseudo-words (non-words fed into the classifier that indicate particular email features – e.g. obfuscation of a spammy word, such as Viagra) have brought POPFile to over 99.8% accuracy. This paper will detail every POPFile pseudo-word, how they are created from spam and ham messages, and give empirical data on their importance when scored against a large corpus of spam and ham messages.

Poll

Virus Bulletin

• Social networking meets social engineering
• Flying solo
• Geneva convention
• 7th German Anti Spam Summit 2009
• Anti-phishing landing page: turning a 404 into a teachable moment
• An update on spamming botnets: are we losing the war?
• Windows Server 2008 Standard Edition SP2 x86