Bypassing ML based phishing and spam detection using evasion
I am Harish SG, a security researcher who studies Masters in Cybersecurity at UT Dallas and AI security intern at Cisco,previously hunted on the Microsoft Bug Bounty Program and Google VRP
I am sharing this article for security awareness and educational purposes only and main purpose of this article to discuss issues in deep learning algorithms and I am sharing only personal opinions and none of these are related to my work at Cisco.
In this article, I am gonna share about How I was able to bypass ML based phishing and spam detection.
Example 1
ML model classified below email as phishing email
ML model classified below email as safe email
In this example email! with some small changes I am able to bypass ML based phishing email detection and this clearly shows dataset of this ML model biased on time sensitive messages
Example 2
ML model classfied below email as phishing email
ML model classfied below email as safe email
In this example email! with some small changes I am able to bypass ML based phishing email detection and this clearly shows dataset of this ML model biased on length of phishing email messages.
Bypassing ML based Spam detection
ML model classfied below twitter message as spam
ML model classfied below twitter message as not spam
I was able to bypass ML based with some small changes to make it look like safe messages. basically all dataset we used train ML models are biased with a subtle difference between one category and other category.
Think we should learn from this research
- we should not depend on ML model for cybersecurity %100
- we should implement additional validators along with ML models
- ML models should be batch trained based on continous non baised feedback on output of ML models
- dataset should be more generalised and it should cover almost all usecases.
Try hacking LLM : https://github.com/harishsg993010/DamnVulnerableLLMProject
Hacking into Bard : https://infosecwriteups.com/hacking-google-bard-24f9dfa7b455
Follow me on twitter: https://twitter.com/CoderHarish
Follow me on linkedin :https://www.linkedin.com/in/harish-santhanalakshmi-ganesan-31ba96171/
