System and method for detecting repetitive cybersecurity attacks constituting an email campaign
According to one embodiment, a system for detecting an email campaign includes feature extraction logic, pre-processing logic, campaign analysis logic and a reporting engine. The feature extraction logic obtains features from each of a plurality of malicious email messages received for analysis while the pre-processing logic generates a plurality of email representations that are arranged in an ordered sequence and correspond to the plurality of malicious email message. The campaign analysis logic determines the presence of an email campaign in response to a prescribed number of successive email representations being correlated to each other, where the results of the email campaign detection are provided to a security administrator via the reporting engine.
1. A system for detecting an email campaign, comprising:
a processor; and
a memory communicatively coupled to the processor, the memory comprises
feature extraction logic that, when executed by the processor, extracts features from each of a plurality of malicious email messages previously determined to be malicious and received for analysis,
pre-processing logic that, when executed by the processor, generates a plurality of email representations corresponding to the plurality of malicious email messages, the plurality of email representations being arranged in an ordered sequence by at least reordering the plurality of email representations in accordance with common characteristics,
campaign analysis logic that, when executed by the processor, determines a first malicious email message of the plurality of malicious email messages is part of the email campaign (i) when a level of correlation between a first email representation of the ordered sequence of the plurality of email representations and a character pattern associated with a known email campaign is determined to exceed a first threshold, and (ii) if the level of correlation between the first email representation and the character pattern fails to exceed the first threshold, when levels of correlation between a prescribed number of successive neighboring pairs of email representations of the plurality of email representations starting with the first email representation are equal to or exceeds a second threshold, wherein the email campaign is a targeted and deliberate cyberattack based on repetitious transmission of email messages in an attempt to gain access to or disrupt operations of a targeted network device or a network to which the targeted network device is in communication, and
reporting engine that, when executed by the processor, generates one or more alert messages via a graphic user interface or an input/output interface to provide a visual representation of results produced from the campaign analysis logic.
2. The system of claim 1 , wherein each feature extracted by the feature extraction logic includes a character string and the features collectively forming a character pattern.
3. The system of claim 2 , wherein the pre-processing logic includes a filtering logic to remove one or more characters from each character pattern corresponding to a malicious email message of the plurality of malicious email messages to produce the plurality of email representations.
4. The system of claim 2 , wherein the pre-processing logic includes (i) a filtering logic to remove one or more characters from each character pattern corresponding to a malicious email message of the plurality of malicious email messages to produce a plurality of filtered character patterns and (ii) an ordering logic to rearrange portions of each of the plurality of filtered character patterns to produce the plurality of email representations.
5. The system of claim 1 , wherein the second threshold represents a lower correlation value than the first threshold.
6. The system of claim 1 , wherein the campaign analysis logic that, when executed by the processor, determines the malicious email message of the plurality of malicious email messages is part of the email campaign by at least (i) determining whether a level of correlation between a first neighboring pair of email representations including the first email representation of the plurality of email representations and a second email representation of the plurality of email representations satisfies the second threshold, (ii) determining whether a level of correlation between a second neighboring pair of email representations including the second email representation and a third email representation of the plurality of email representations satisfies the second threshold, and (iii) continuing to determine whether a level of correlation between each successive neighboring pairs of email representations from the plurality of email representations exceeds the second threshold until the prescribed number email representations of the plurality of email representations are determined to be correlated.
7. The system of claim 1 , wherein the prescribed number of correlated, successive neighboring pairs of email representations form an uninterrupted sequence being a sequence of correlated email representations having no intervening non-correlating email representation.
8. The system of claim 7 , wherein the campaign analysis logic, when executed by the processor, arranges the plurality of email representations being in the ordered sequence based on common characteristics including chronological ordering between each of the plurality of email representations.
9. The system of claim 8 , wherein the campaign analysis logic, when executed by the processor, further determines whether levels of correlation between the prescribed number of successive neighboring pairs of email representations of the plurality of email representations starting with the first email representation is equal to or exceeds the second threshold based on a particular edit distance.
10. The system of claim 1 , wherein the campaign analysis logic, when executed by the processor, determines the first malicious email message is part of the email campaign in response each email representation of the prescribed number of successive email representations being determined to be correlated with a neighboring email representation of the prescribed number of email messages based on a particular edit distance.
11. The system of claim 1 , wherein the memory further comprises the reporting engine that, when executed by the processor and in response to the campaign analysis logic detecting the email campaign, generates one or more alert messages directed to a graphical user interface or a network device to notify an administrator of the email campaign.
12. A computerized method for detecting an email campaign, comprising:
extracting a plurality of features from each of a plurality of email messages, each of the plurality of features form a character pattern;
generating a plurality of email representations corresponding to the plurality of email messages, the plurality of email representations being arranged in an ordered sequence and each of the plurality of email representations being a modified character pattern;
determining a first email message of the plurality of email messages is part of the email campaign (i) when a level of correlation between a first email representation of the ordered sequence of the plurality of email representations and a character pattern associated with a known email campaign is determined to exceed a first threshold, and (ii) if the level of correlation fails to exceed the first threshold, when levels of correlation between a prescribed number of successive email representations of the plurality of email representations are equal to or exceeds a second threshold, wherein the email campaign is a targeted and deliberate cyberattack based on repetitious transmission of the plurality of email messages in an attempt to gain access to or disrupt operations of a targeted network device or a network to which the targeted network device is in communication; and
generating one or more alert messages via a graphic user interface or an input/output interface to provide a visual representation of results produced in determining the email campaign.
13. The computerized method of claim 12 , wherein each feature of the plurality of features extracted includes a character string.
14. The computerized method of claim 13 , wherein the generating of the plurality of email representations comprises removing one or more characters from each character pattern corresponding to an email message of the plurality of email messages to produce the plurality of email representations.
15. The computerized method of claim 12 , wherein generating of the plurality of email representations comprises (i) removing one or more characters from each character pattern corresponding to an email message of the plurality of email messages to produce a plurality of filtered character patterns and (ii) rearranging portions of each of the plurality of filtered character patterns to produce the plurality of email representations.
16. The computerized method of claim 12 , wherein the second threshold represents a lower correlation value than the first threshold.
17. The computerized method of claim 12 , wherein the determining of the first email message of the plurality of email messages being part of the newly detected email campaign by at least (i) determining whether a level of correlation between a first neighboring pair of email representations including the first email representation of the plurality of email representations and a second email representation of the plurality of email representations satisfies the second threshold, (ii) determining whether a level of correlation between a second neighboring pair of email representations including the second email representation and a third email representation of the plurality of email representations satisfies the second threshold, and (iii) continuing to determine levels of correlation between successive neighboring pairs of email representations from the plurality of email representations satisfy the second threshold until a prescribed number email representations of the plurality of email representations are determined to be correlated.
18. The computerized method of claim 12 , wherein the prescribed number of successive email representations with correlation levels satisfying the second threshold form an uninterrupted sequence being a sequence of correlated email representations having no intervening non-correlating email representation.
19. The computerized method of claim 18 , wherein the arranging of the plurality of email representations being in the ordered sequence of the plurality of email representations arranged chronologically.
20. The computerized method of claim 12 , wherein the determining whether the levels of correlation between the prescribed number of successive email representations of the plurality of email representations is equal to or exceeds the second threshold is based on a particular edit distance.
21. A non-transitory computer readable medium including software that, when executed by one or more hardware processors, performs operations to detect an email campaign, comprising:
extracting a plurality of features from each of a plurality of email messages, the extracted features form a character pattern for each of the plurality of email messages;
generating a plurality of email representations by modifying each of the plurality of character patterns;
arranging the plurality of email representations into a selected ordered sequence;
detecting the email campaign being a targeted and deliberate cyberattack based on repetitious transmission of email messages in an attempt to gain access to or disrupt operations of a targeted network device or a network to which the targeted network device is in communications, where the repetitious transmission is determined by a level of correlation between a prescribed number of successive pairs of email representations of the plurality of email representations is equal to or exceeds a threshold; and
generating one or more alert messages via a graphic user interface or an input/output interface to provide a visual representation of information associated with the detected email campaign.
22. The transitory computer readable medium of claim 21 , wherein the prescribed number of correlated, successive pairs of email representations form an uninterrupted sequence being a sequence of correlated email representations having no intervening non-correlating email representation.