On Attacking Statistical Spam Filters

By Gregory L. Wittel, Shyhtsun Felix Wu. 2004

225 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Natural Language Processing

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “We focus on strategies designed irrespectively of the domain ML is being applied to, albeit heuristics specific to certain applications exist [71], [29], e.”
Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “…( i ) develop attacks against machine learning, both at training time (poisoning attacks) [22–31] and at test time (evasion attacks) [18– 20, 28, 32–37]; ( ii ) propose systematic methodologies for security evaluation of learning algorithms against such attacks [37– 41]; and ( iii ) design…”
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks (2018, background): “Many of the early attacks on machine learning were exploratory attacks on network and host-based intrusion detection systems [43,41,15,14] or spam ﬁlters [44,29,30,23].”
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain (2017, background): “Here the attacker’s goal was to either craft messages that evade detection [25], [26], [27], [28] to let spam through or influence its training data to cause it to block legitimate messages.”
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners (2015, neutral): “We formalize this intuition as a trade-off between the attacker’s effort EA and risk RA, to be defined below.”
Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition (2016, background): “Hence, unsurprisingly, it has been shown that attacks in many of these domains can be effective at evading ML classifiers designed to detect them [23, 35, 43].”
Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers (2013, background): “Similarly, in [45, 58], the authors describe some statistical attacks against spam filters aimed at understanding message features that are not correctly classified by the filters.”
Security Evaluation of Pattern Classifiers under Attack (2014, neutral): “F”
Adversarial Feature Selection Against Evasion Attacks (2016, background): “, by misspelling bad words like “cheap” as “che@p”), and the exploitation code embedded in malware samples and network packets [5], [7], [10]–[12], [14]–[19].”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, background): “Examples of causative attacks include work in [14, 38, 40, 52, 58], while exploratory attacks can be found in [26, 31, 41, 47, 66].”
SoK: Security and Privacy in Machine Learning (2018, neutral): “, spam filtering [69], [70].”
Spam Filtering Using Inexact String Matching in Explicit Feature Space with On-Line Linear Classifiers (2006, background): “Spam filters that rely on traditional word-based features may be defeated by the spam attack of obfuscation, in which words are intentionally obscured through the use of misspellings, character substitutions, insertions, and deletions (Wittel and Wu, 2004).”
Design of robust classifiers for adversarial environments (2011, background): “For instance, several works proposed different countermeasures to the common GWI and BWO attacks against text-based spam filters, mainly by modifying known classification algorithms, or their training phase [2], [6]–[13].”
Email Spam Filtering: A Systematic Review (2008, background): “Or if the filter employs a machine learning technique, the message may be designed to poison the filter [70, 72, 191], compromising its ability to detect future spam messages.”
Machine learning in adversarial environments (2010, background): “Various spam filter evasion techniques have not only been considered in the literature (Graham-Cumming 2004; Wittel and Wu 2004; Lowd and Meek 2005b) but also witnessed by millions of email users.”
Pattern Recognition Systems under Attack: Design Issues and Research Challenges (2014, background): “Non-stationarity has also been considered, modeled as p(X,Y ; t), t being a parameter denoting time, but only of non-adversarial nature.”