Research Article
Forensic Analysis and Detection of Spoofing Based Email Attack Using Memory Forensics and Machine Learning
@INPROCEEDINGS{10.1007/978-3-031-25538-0_26, author={Sanjeev Shukla and Manoj Misra and Gaurav Varshney}, title={Forensic Analysis and Detection of Spoofing Based Email Attack Using Memory Forensics and Machine Learning}, proceedings={Security and Privacy in Communication Networks. 18th EAI International Conference, SecureComm 2022, Virtual Event, October 2022, Proceedings}, proceedings_a={SECURECOMM}, year={2023}, month={2}, keywords={Email forensics Email spoofing Memory forensics Cyber security Email attacks}, doi={10.1007/978-3-031-25538-0_26} }- Sanjeev Shukla
Manoj Misra
Gaurav Varshney
Year: 2023
Forensic Analysis and Detection of Spoofing Based Email Attack Using Memory Forensics and Machine Learning
SECURECOMM
Springer
DOI: 10.1007/978-3-031-25538-0_26
Abstract
Emails encounter many types of cyber-attacks and email spoofing is one of the most common and challenging investigation problems. This paper identifies spoofing-based email attacks in an organization by analyzing received and replied emails. The detection works by capturing the email traces via memory forensics. Unlike the traditional approaches of capturing the entire physical memory, we only capture the memory of relevant processes for email header extraction. It significantly reduces the size of the memory dump and makes detection faster. We suggest a novel mechanism called URL extractor, which uses seven novel features from URL to identify the live running email message process by applying ML that traces received emails and captures their header fields for analysis. The authentication header fields ofSPF, DKIM, DMARC,andARCare examined closely to develop a detection algorithm for received emails. Similarly, novel header fields ofReferencealong withMX recordare applied for the detection of replied emails. The MX record is fetched to verify the domain name by sending a forward ns-lookup query to DNS. It also includes an email attack alert mechanism for intimating IT admins of an organization regarding suspected attacks. The results thus obtained show that email detection takes 35 secs (apprx.) to complete with high accuracy and low false positives.
