{"id":9143,"date":"2020-12-24T15:21:05","date_gmt":"2020-12-24T12:21:05","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=9143"},"modified":"2020-12-24T15:21:05","modified_gmt":"2020-12-24T12:21:05","slug":"federated-learning-against-mail-threats","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/federated-learning-against-mail-threats\/9143\/","title":{"rendered":"E-posta tehditlerine kar\u015f\u0131 m\u00fccadelede birle\u015fik \u00f6\u011frenme"},"content":{"rendered":"<p>E-postan\u0131zda bir tehdit (kimlik av\u0131 veya spam) olu polmad\u0131\u011f\u0131n\u0131 bulman\u0131n en kolay yolu nedir? \u0130stenmeyen bir mesaj\u0131n anla\u015f\u0131lmas\u0131n\u0131 sa\u011flayan \u00e7e\u015fitli teknik ba\u015fl\u0131klar ve di\u011fer dolayl\u0131 i\u015faretler size ipucu verebilir, ancak en bariz k\u0131s\u0131m olan mesaj metnini unutmamal\u0131s\u0131n\u0131z. Bunun, analiz edilmesi gereken ilk \u015fey oldu\u011fu d\u00fc\u015f\u00fcn\u00fclebilir. Sonu\u00e7ta siber su\u00e7lular veya k\u00f6t\u00fc niyetli reklamc\u0131lar al\u0131c\u0131lar\u0131 manip\u00fcle etmek i\u00e7in e-posta metinlerini kullan\u0131r. Yine de bu o kadar kolay de\u011fil; imza analizi ge\u00e7mi\u015fte bu g\u00f6revleri ba\u015far\u0131yla yerine getirebiliyordu ancak art\u0131k metni makine \u00f6\u011frenmesi algoritmalar\u0131n\u0131 kullanarak analiz etmek gerekiyor. Makine \u00f6\u011frenimi modelinin mesajlar\u0131 do\u011fru \u015fekilde s\u0131n\u0131fland\u0131racak \u015fekilde e\u011fitilmesi i\u00e7in ilgili algoritmalar\u0131n \u00e7ok fazla say\u0131da mesajla beslenmesi gerekir; ancak bu, gizlilik nedeniyle pratikte her zaman m\u00fcmk\u00fcn olmayabiliyor. Buna bir \u00e7\u00f6z\u00fcm bulduk.<\/p>\n<h2>\u0130mza analizi neden art\u0131k etkili de\u011fil?<\/h2>\n<p>On y\u0131l \u00f6nce, istenmeyen e-postalar\u0131n b\u00fcy\u00fck bir k\u0131sm\u0131n\u0131 yakalamak mesaj metinleri sayesinde nispeten kolayd\u0131 \u00e7\u00fcnk\u00fc siber su\u00e7lular genellikle benzer \u015fablonlar\u0131 kullan\u0131yordu \u2013 spam (ve kimlik av\u0131) mesajlar\u0131n\u0131n metinleri neredeyse hi\u00e7 de\u011fi\u015fmiyordu. G\u00fcn\u00fcm\u00fczde siber su\u00e7lular e-postalar\u0131n\u0131n verimlili\u011fini s\u00fcrekli olarak art\u0131r\u0131yor ve milyonlarca yem kullan\u0131yorlar: Yeni video oyunlar\u0131, TV dizileri veya ak\u0131ll\u0131 telefon modelleri; siyasi haberler; hatta acil durumlar (\u00f6rne\u011fin, COVID-19 ile ilgili bol miktarda phishing ve spam yap\u0131ld\u0131) . Konu \u00e7e\u015fitlili\u011finin artmas\u0131 tespit s\u00fcrecini zorla\u015ft\u0131r\u0131yor. Dahas\u0131, sald\u0131rganlar art\u0131k e-posta filtrelerinden kurtulmak i\u00e7in tek bir e-posta grubunun i\u00e7indeki metni bile de\u011fi\u015ftirebiliyor.<\/p>\n<p>Elbette imza temelli yakla\u015f\u0131mlar hala kullan\u0131l\u0131yor, ancak ba\u015far\u0131lar\u0131 temelde birinin zaten istenmeyen veya zararl\u0131 olarak s\u0131n\u0131fland\u0131rd\u0131\u011f\u0131 metinlerle kar\u015f\u0131la\u015ft\u0131rmaya dayan\u0131yor. Proaktif olarak \u00e7al\u0131\u015fam\u0131yorlar \u00e7\u00fcnk\u00fc spam g\u00f6ndericileri e-posta metninde de\u011fi\u015fiklik yaparak onlar\u0131 atlatabiliyor. Bu sorunu \u00e7\u00f6zmenin tek yolu makine \u00f6\u011freniminden ge\u00e7iyor.<\/p>\n<h2>\u00d6\u011frenmedeki sorun ne?<\/h2>\n<p>Son y\u0131llarda makine \u00f6\u011frenimi y\u00f6ntemleri pek \u00e7ok sorunun \u00e7\u00f6z\u00fcm\u00fcnde iyi sonu\u00e7lar verdi. Modeller b\u00fcy\u00fck miktarda veriyi analiz ederek karar vermeyi \u00f6\u011freniyor ve bir bilgi ak\u0131\u015f\u0131nda \u00f6nemsiz olmayan ortak \u00f6zellikleri buluyor. E-posta tehditlerini tespit etmek i\u00e7in DMARC ile birlikte teknik e-posta ba\u015fl\u0131klar\u0131 \u00fczerinde e\u011fitilmi\u015f olan sinir a\u011flar\u0131n\u0131 kullan\u0131yoruz. \u00d6yleyse neden ayn\u0131 \u015feyi mesaj metni \u00fczerinde yapam\u0131yoruz?<\/p>\n<p>Yukar\u0131da belirtti\u011fimiz gibi, modellerin b\u00fcy\u00fck miktarda veriye ihtiyac\u0131 vard\u0131r. Bu durumda, veriler e-postalardan olu\u015fur ve yaln\u0131zca k\u00f6t\u00fc ama\u00e7l\u0131 olanlara de\u011fil, yasal ve ger\u00e7ek olan mesajlara da ihtiyac\u0131m\u0131z var. Onlar olmadan, modele bir sald\u0131r\u0131y\u0131 me\u015fru yaz\u0131\u015fmalardan ay\u0131rt etmeyi \u00f6\u011fretmek imkans\u0131z olur. Her t\u00fcr istenmeyen e-postay\u0131 yakalayan \u00e7ok say\u0131da e-posta tuza\u011f\u0131m\u0131z var (bunlar\u0131 imza temelli yakla\u015f\u0131mlar i\u00e7in kullan\u0131yoruz), ancak \u00f6\u011frenme i\u00e7in yasal e-postalar\u0131 almak ve kullanmak daha karma\u015f\u0131k bir i\u015f.<\/p>\n<p>Veriler merkezi \u00f6\u011frenme i\u00e7in normalde sunucularda toplan\u0131r. Ancak metinlerden bahsediyorsak, ek zorluklar ortaya \u00e7\u0131k\u0131yor: E-postalar \u00f6zel veriler i\u00e7erebilir, bu nedenle bunlar\u0131 orijinal bi\u00e7iminde saklamak ve i\u015flemek m\u00fcmk\u00fcn de\u011fil. \u00d6yleyse, yeterince b\u00fcy\u00fck bir yasal e-posta y\u0131\u011f\u0131n\u0131n\u0131 nas\u0131l elde edebiliriz?<\/p>\n<h2>Birle\u015fik \u00f6\u011frenme<\/h2>\n<p>Bu sorunu birle\u015fik \u00f6\u011frenme y\u00f6ntemini kullanarak \u00e7\u00f6z\u00fcyoruz, yasal e-postalar\u0131 toplama ihtiyac\u0131n\u0131 makul bir \u015fekilde ortadan kald\u0131r\u0131p bunun yerine modelleri, merkezi olmayan bir \u015fekilde e\u011fitiyoruz. Model e\u011fitimi, do\u011frudan m\u00fc\u015fterinin posta sunucular\u0131nda ger\u00e7ekle\u015fiyor ve merkezi sunucu, ileti metnini de\u011fil, yaln\u0131zca makine \u00f6\u011frenimi modellerinin e\u011fitimli a\u011f\u0131rl\u0131klar\u0131n\u0131 al\u0131yor. Algoritmalar merkezi sunucuda verileri modelin ortaya \u00e7\u0131kan s\u00fcr\u00fcm\u00fcyle birle\u015ftiriyor ve biz de ard\u0131ndan onu m\u00fc\u015fterinin \u00e7\u00f6z\u00fcmlerine geri g\u00f6nderiyoruz; burada da model, e-posta ak\u0131\u015f\u0131n\u0131 analiz etmeye devam ediyor.<\/p>\n<p>Bu biraz sadele\u015ftirilmi\u015f bir resim: Yeni e\u011fitilen model ger\u00e7ek e-postalar\u0131 i\u015flemek \u00fczere kullan\u0131lmadan \u00f6nce, birka\u00e7 ek e\u011fitimden ge\u00e7iyor. Di\u011fer bir deyi\u015fle, iki model e-posta sunucusunda ayn\u0131 anda \u00e7al\u0131\u015f\u0131yor: biri e\u011fitim modunda, di\u011feri aktif modda. Merkezi sunucuya yap\u0131lan birka\u00e7 gitgelden sonra, yeniden e\u011fitilen model aktif olan\u0131n yerini al\u0131yor.<\/p>\n<p>Belirli e-postalar\u0131n metnini model a\u011f\u0131rl\u0131klar\u0131ndan \u00e7\u0131karmak imkans\u0131zd\u0131r; b\u00f6ylelikle s\u00fcre\u00e7 boyunca gizlilik garanti alt\u0131na al\u0131nm\u0131\u015f olur. Bununla birlikte, ger\u00e7ek e-postalarla \u00f6\u011frenim, alg\u0131lama modelinin kalitesini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r.<\/p>\n<p>\u015eu anda, spam s\u0131n\u0131fland\u0131rmas\u0131 i\u00e7in bu yakla\u015f\u0131m\u0131 test modunda, <a href=\"https:\/\/www.kaspersky.com.tr\/small-to-medium-business-security\/microsoft-office-365-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_wpplaceholder____kso365___\" target=\"_blank\" rel=\"noopener\">Kaspersky Security for Microsoft Office 365'de<\/a> zaten kullan\u0131yoruz ve ola\u011fan\u00fcst\u00fc sonu\u00e7lar al\u0131yoruz. Yak\u0131nda, daha geni\u015f \u00e7apta uygulanacak ve kimlik av\u0131, BEC ve benzeri di\u011fer tehditleri belirlemek i\u00e7in kullan\u0131lacak.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kes-cloud\">\n","protected":false},"excerpt":{"rendered":"<p>\u0130stenmeyen e-postalar\u0131 filtrelemek i\u00e7in modelleri e\u011fitme y\u00f6ntemimiz, verimlili\u011fi kaybetmeden gizlili\u011fi koruman\u0131za olanak tan\u0131yor.<\/p>\n","protected":false},"author":2629,"featured_media":9144,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194],"tags":[1921,1074,1610,240],"class_list":{"0":"post-9143","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"tag-e-posta","10":"tag-kimlik-avi","11":"tag-makine-ogrenimi","12":"tag-spam"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/federated-learning-against-mail-threats\/9143\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/federated-learning-against-mail-threats\/22199\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/federated-learning-against-mail-threats\/17677\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/federated-learning-against-mail-threats\/23846\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/federated-learning-against-mail-threats\/21931\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/federated-learning-against-mail-threats\/20758\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/federated-learning-against-mail-threats\/24408\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/federated-learning-against-mail-threats\/23581\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/federated-learning-against-mail-threats\/29618\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/federated-learning-against-mail-threats\/37936\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/federated-learning-against-mail-threats\/16116\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/federated-learning-against-mail-threats\/16765\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/federated-learning-against-mail-threats\/14287\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/federated-learning-against-mail-threats\/25901\/"},{"hreflang":"zh","url":"https:\/\/www.kaspersky.com.cn\/blog\/federated-learning-against-mail-threats\/12365\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/federated-learning-against-mail-threats\/29753\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/federated-learning-against-mail-threats\/26499\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/federated-learning-against-mail-threats\/23165\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/federated-learning-against-mail-threats\/28496\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/federated-learning-against-mail-threats\/28312\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/e-posta\/","name":"e-posta"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2629"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=9143"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9143\/revisions"}],"predecessor-version":[{"id":9145,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9143\/revisions\/9145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/9144"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=9143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=9143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=9143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}