70 likes | 78 Views
Spam Deobfuscation. Wissam Kazan Daniel Woods. Problem Description. Example Spam Text: Get your Viagra pills here When Obfuscated: G3t y0u*r /|aGrra Pi11z |-|eer Problem: Reverse Obfuscation so Spam Filters Work. Solution Breakdown. Decoding G3t y0u*r /|aG r ra Pi11z |-|eer
E N D
Spam Deobfuscation Wissam Kazan Daniel Woods
Problem Description Example Spam Text: Get your Viagra pills here When Obfuscated: G3t y0u*r \/|aGrra Pi11z |-|eer Problem: Reverse Obfuscation so Spam Filters Work
Solution Breakdown • Decoding G3t y0u*r \/|aGrra Pi11z |-|eer xxxxxxxxxxxxxxx?xxxxxxxxxxxxxxx • Alignment G3t y0u*r \/|aGrra Pi11z |-|eer Get you-r V-iagr-a pills h--ere
Alignment Example Original Text: Wissam Obfuscated Text: VV|sS/\m Naive Alignment: Wissa--m EM Alignment: W-issa-m Correct Alignment: W-issa-m (Result 1.4% error at 37.7% obfuscation)
Decoding Approaches Example: G3t y0u*r \/|aGrra Pi11z |-|eer • Maximum Likelihood • HMM (Viterbi) G -> e -> t -> _ -> y –> o -> . . . | | | | | | G 3 t _ y 0 . . . Get y xx?xx Get y xx?xx Get_y xx?xx Get y xx?xx
Results (37.7% Obfuscation)
Example Result Obfuscated Text: a"bbove diGs{lqaiim3rss and+ e+XclAusXi70Nsd may nQoSt Apxply Correct Test: above disclaimers and exclusions may not apply HMM Prediction: abbove dislaimerss and tclusiond may not pply