Analysis of E-mail Account Probing Attack Based on Graph Mining

Area of Science:

• Cybersecurity
• Network Security
• Data Mining

Background:

• Email is a primary vector for malware, phishing, and advanced persistent threats.
• High-reputation email accounts are frequent targets for probing attacks.

Purpose of the Study:

• To understand the probing patterns of email account attacks.
• To define and characterize a specific type of email account probing attack.

Main Methods:

• Analysis of email account probing logs from a campus network.
• Application of graph mining techniques.
• Dimensional analysis of dataset characteristics.

Main Results:

• Identification and definition of a novel email account probing attack.
• Elucidation of the attack's probing pattern.
• Discovery of opposing characteristics between probing groups and individuals.
• Demonstration of the attack's ability to evade security device detection.

Conclusions:

• The identified probing pattern and its characteristics pose a significant threat to email users and administrators.
• The findings support the development of effective detection and defense mechanisms against these distributed attacks.