Research and Development

In The Beginning

Our founder David Poellhuber started Zerospam in order to block a growing threat: malicious emails. For years they had been a nuisance, but were quickly becoming a problem. Zerospam’s initial innovation was to take the filtering off client networks and push it into the cloud. A solution was born.

• Problem: Need to block bad emails to protect our clients.
• Context: Good emails and bad emails have different types of content.
• Solution: Rules (heuristics) can be created that identify these differences. Once identified, the differences can be used to classify emails as good or bad.

Ramping up

Creating rules to block bad emails works. However, it’s time consuming and requires continuous improvement. Rules must be created to block bad emails. Others, to let good emails through. And once they’re created, they have to be updated, corrected, and generally cared for. Rules link to other rules, exponentially increasing complexity.

Our AI journey officially began in 2008. Our team decided to develop automated measures to help classify and block emails. The first engine we used was called OSBF and used Bayesian inference to classify emails. This was replaced by a second engine named OSCAR, which was instead designed to classify messages using Logistic Regression. These engines could be “fed” emails, told whether they should be considered good or bad, and learn how to accurately classify future emails.

• Problem: The volume of bad emails to block only keeps increasing
• Context: The number of emails sent keeps increasing. The different types of emails keep increasing.
• Solution: Automation (first OSBF, then OSCAR)

Improvement

Perhaps the biggest challenge in filtering emails is identifying and fixing your mistakes: false positives and false negatives. Through extended use, we noticed that our two previous engines (OSBF and OSCAR) were having problems updating their parameters. The older models they were built under was limiting our ability to expand detection capabilities.

One limiting factor for the old engines was the amount of data being used for analysis. While they used information from the email content, all of the valuable metadata was being ignored. It’s at this point that we hired a dedicated Machine Learning researcher to upgrade our development capabilities. We shifted approaches and decided to build a new engine from scratch, which became our first artificial neural network. This was the birth of Tyr, our newest automated classification engine.

• Problem: Know when filtering failed.
• Context: Engines require human feedback and human trainers to teach the system. Existing engines were limited by their architecture and insufficient processing of the available data.
• Solution: Machine Learning classification with a true neural network (Tyr)

The new paradigm

Cybercriminals have become more sophisticated and have themselves, begun using AI to craft their campaigns. In order to help their messages bypass the rule-based systems built to stop them, they started to use machine learning to dynamically make small changes to their message content. These changes, while seemingly insignificant -- perhaps just a different word in the subject -- would require our rules team to manually update each variation. The question became, how can we automatically group all of these emails together despite these small differences? The answer:clustering.

Our R&D team once again decided to use AI to help solve this problem and in the process, developed THINC: THreat INtelligence from Clustering. Adapting DBSCAN for email filtering, THINC analyses the email traffic stream and groups email campaigns into clusters that share similar characteristics while also providing a list of those characteristics.

• Problem: Cybercriminals make changes to their campaigns as they send them to avoid detection.
• Context: Two similar emails might be in the same campaign. By clustering these emails into campaigns, blocking them became more efficient. It’s also possible to track them through time.
• Solution: Clustering (THINC). Reduces time to block. Ability to have an automatic feedback loop with Tyr. Ability to share IOC/IOA with the community.

Innovations for the future

Our R&D team is now working on two parallel tracks: classification and clustering. The goal will be to leverage these two techniques and tie them together. Learn more about what new technologies we are pursuing by checking out the Current Development Track.

Research Partnerships

Our research team has achieved great things on its own. In order to improve our R&D efforts, we are always on the lookout for new partnerships. Here are just a couple examples of research partners who we have collaborated with in the past:

• Collaboration with Dr. Fehmi Jaafar -a top cybersecurity researcher- on a project entitled “How to Recognize Malicious Coronavirus Phishing”. This project will help profile COVID-themed threats and improve filtering efficiency.

• Signed agreement with the Computer Research Institute of Montréal (CRIM) for THINC development on three levels: email representations, cluster evolution, and cluster qualifiers. The CRIM is an applied research and expertise centre in information technology, dedicated to making organizations more effective and competitive through the development of innovative technology and the transfer of leading edge know-how, while contributing to scientific advancement.

• Partnership with the National Research Council of Canada Industrial Research Assistance Program (NRC IRAP) to develop and integrate Machine Learning to our filtering architecture. The program provides advice, connections, and funding to help Canadian small and medium-sized businesses increase their innovation capacity and take ideas to market.

• Partnership with the Quebec Cybersecurity Innovation Program (QCIP) to develop features for THINC (eg.: improvements to clustering and classification, adapted greymail blocking), bringTHINC to market, and develop the automatic publishing of Threat Intelligence. The Program is designed to foster innovation, as well as to forge partnerships and new supply chain relationships.

• Collaboration with Professor Alain Tapp, associate member of the Montreal Institute for Learning Algorithms (MILA) to create Tyr, our neural network email classification engine.