Canning more than SPAM with Bayesian filtering

Martin Overton IBM Global Services

When most people think of tools to combat malware, very few will give a passing thought to Bayesian filtering, why?

Common reasons include:

• They don't realize that Bayesian filtering can be used against malware (viruses, Trojans, worms, etc.)
• They are just for spam.
• They don't know how to train them for malware.

This paper will investigate the use of Bayesian filtering, specifically to counter/block/detect malware. What's more, this paper will focus on tools such as Popfile and SpamPal (which are free anti-spam systems available for both UNIX and Windows).

The use of Bayesian filtering systems can be extremely useful in cases of fast-burning or very complex malware outbreaks as a stop-gap until the anti-virus vendors manage to get reliable updates out to their customers.

Bayesian filtering of internal mail can also be useful in identifying infected systems in your organization that need remedial action before 'the trickle' of infections become a 'torrent' and you are left fighting to keep your head above the rising waters.

The paper will include statistics clearly showing the accuracy of Bayesian filtering, not just for malware, but also for SPAM and 419 advance-fee-frauds.