internet security tHreAt rePOrt GOVernMent 2013

p. 126
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
SPAM AND FRAUD ACTIVITy TRENDS
Spam by Category
Background
Spam is created in a variety of different styles and complexities.
Some spam is plain text with a URL; some is cluttered with
images and/or attachments. Some comes with very little in
terms of text, perhaps only a URL. And, of course, spam is
distributed in a variety of different languages. It is also common
for spam to contain “Bayes poison” (random text added to
messages that has been haphazardly scraped from websites to
“pollute” the spam with words bearing no relation to the intent
of the spam message itself). Bayes poison is used to thwart spam
filters that typically try to deduce spam based on a database of
words that are frequently repeated in spam messages.
Any automated process to classify spam into categories would
need to overcome this randomness issue. For example, the
word “watch” may appear in the random text included in
a pharmaceutical spam message, posing a challenge as to
classifying the message as pharmaceutical spam or in the
watches/jewelry category. Another challenge occurs when a
pharmaceutical spam contains no obvious pharmaceuticalrelated
words, but only an image and a URL.
Spammers attempt to get their messages through to recipients
without revealing too many clues that the message is spam.
Clues found in the plain text content of the email can be
examined using automated anti-spam techniques. A common
way to overcome automated techniques is by using random text.
An equally effective way is to include very little in the way of
extra text in the spam, instead including a URL in the body of
the message.
Spam detection services often resist classifying spam into
different categories because it is difficult to do (for the reasons
above) and because the purpose of spam detection is to
determine whether the message is spam and to block it, rather
than to identify its subject matter. The most accurate way to
overcome the ambiguity faced by using automated techniques
to classify spam is to have someone classify unknown spam
manually. While time-consuming, this process provides much
more accurate results. An analyst can read the message,
understand the context of the email, view images, follow URLs,
and view websites in order to gather the bigger picture around
the spam message.
Methodology
Once per month, several thousand random spam samples are
collected and classified by Symantec.cloud using a combination
of electronic and human analysis into one of the following
categories:
• Casino/Gambling
• Degrees/Diplomas
• Diet/Weight Loss
• Jobs/Money Mules
• Malware
• Mobile Phones
• Pharmaceutical
• Phishing
• Scams/Fraud/419s
• Sexual/Dating
• Software
• Unknown/Other
• Unsolicited Newsletters
• Watches/Jewelry