\chapter{State of the Art}
Contemporary approaches to email spoofing prevention and forensic identification have evolved substantially in the last ten years. In this chapter the current state of the art in email security will be examined, exploring both theoretical frameworks and practical implementations designed to address the persistent challenge of email spoofing with particular emphasis on forensic identification and evidence preservation. 


\section{Enhanced Email Security approaches}
Since email threats evolved from simple spam and phishing attempts to sophisticated social engineering attacks, a need for robust defense mechanisms arose. 

Nowadays, email security architectures implement multilayered defense strategies, extending beyond the traditional authentication protocols to incorporate behavioral analysis, content inspection and real-time threat intelligence. These enhanced approaches recognize that email threats are not simple spam and phishing anymore, but they evolved to sophisticated social engineering attacks.


Modern email security gateways, in order to provide an SMTP-level enforcement, started to perform pre-delivery analysis during the SMTP transactions, before the message acceptance. At this tage, decisions are made based on transport-layer metadata such as: IP source address, \texttt{HELO/EHLO} identity, reverse DNS resolution, TLS parameters and historical reputation scores.
All of these deicions are taken before the \texttt{DATA} SMTP command, analyzing: IP reputation, geolocation and SMTP command timing. The results could lead to: \texttt{$550$ reject} or \texttt{$421$ tempfail} \cite{mldetection}.


After message acceptance, advanced security systems perform fine-grained parsing of email headers, reconstructing the full SMTP relay chain from the sequence of \texttt{Received} fields. All those anomalies involving inconsistent timestamps, non-resolving hostnames, forged \texttt{Message-ID} formats, and mismatches between envelope and header domains are used as indicators of spoofing or fraud. Detailed header-level analysis techniques are further examined in \ref{headeranalysis}.

Contemporary email security platforms integrates advanced threat protection with sandbox analysis, real-time attachment and URL scanning, machine learning-based anomaly detection, and policy-based message authentication. Sandbox technology represents a significant advancement in the field, offering isolated environments in which to analyze emails and attachments without exposing organizational networks to potential threats. These sandboxes employ emulation tools and behavioral analysis to identify zero-day exploits, polymorphic malware, and targeted attacks that are even able to evade signature-based detection systems. These types of analysis are usually based on dynamic tracing rather than signature matching \cite{sandboxesmalware}.

Next-generation email security solutions integrate conventional threat intelligence with behavioral anomaly detection, meticulously analyzing an extensive array of data points. These mechanisms also encompass linguistic patterns, tone, sentiment, sender profile characteristics, and historical communication behaviors, thus facilitating the identification of sophisticated threats that rely exclusively on social engineering, thereby circumventing the use of malicious payloads or links \cite{spearphishing}.


\section{Machine learning and AI in spoofing detection}
The use of AI, which has been growing exponentially in recent years, has also found application in phishing and spoofing detection mechanisms, enabling systems to identify threats through pattern recognition and behavioral analysis rather than reliance on known signatures alone.
The study \cite{aidetection} demonstrates that machine learning models trained on extensive datasets of legitimate and malicious emails can recognize subtle textual cues, structural anomalies, and behavioral deviations indicative of spoofing attempts.

An arXiv 2022 paper \cite{mldetection} by Beaman and Isah focused on anomaly detection in emails using machine learning and header information. The result of this research demonstrated that email header information is sufficient to reliably detect spam and phishing emails. Supervised learning algorithms such as Random Forest, SVM, MLP and their ensembles achieved high accuracy scores of 97\% for phishing and 99\% for spam emails. One-class classification with One-Class SVM achieved accuracy scores of 87\% and 89\% with spam and phishing emails respectively. This approach is particularly relevant for DMARC integration, as it demonstrates that authentication metadata can be highly effective for threat detection.

In 2020 \cite{kaspersky} Kaspersky implemented a combination of DMARC technology with machine learning in order to minimize false positives, while protecting against phishing. When fail DMARC checks messages are received, Kaspersky's AI technology analyzes header sequences and content using neural networks trained on approximately 140 million messages (40\% spam). This combination ensures an effective user protection from phishing attacks while minimizing false positives.

\section{Email Header analysis and technical forensics}\label{headeranalysis}
The analysis of email headers is a fundamental forensic technique used to investigate email authenticity, track message origins and reconstruct transmission pathways.
The importance of the headers is given by their structured metadata fields that document the complete history of a message, even including the sequence of MTAs through which it passed, originating IP addresses, timestamps, authentication results and message identifiers.

Email headers play an important role in the identification of sender and receiver (Figure \ref{fig:headerfields}), and through their analysis some information can be collected, such as:
\begin{itemize}
	\item From, To, CC, BCC
	\item Reply-to, Content Type
	\item Message ID, Important Level
	\item Network Path, X-Mailer
	\item MIME Info
	\item Email client information
	\item Time stamp, SMTP information
	\item Encoding details
\end{itemize}
In particular, the \textit{"Received"} header chain provides chronological documentation of each server hop during message transmission. Forensic investigators meticulously analyze this chain to identify anomalies such as unexpected geographic routing, inconsistent timestamps, suspicious intermediate relays, or IP addresses associated with known malicious infrastructure. The process of reverse DNS lookups on IP addresses extracted from headers facilitates the identification of hostnames associated with sending servers. This, in turn, enables investigators to determine the alignment between these hostnames and the domains claimed by the servers.

Other critical header field for forensic analysis is the Message-ID, which provides a unique identifier for each email and it is useful to reveal forged messages when the format differs from known patterns for specific mail system. The Return-Path or envelope-from address indicates where delivery failure notifications should be sent, and especially in spoofed messages they are different from the visible From address. The authentication result headers are also useful because they document SPF, DKIM and DMARC validation outcomes performed by receiving servers.

\begin{figure}[h]
    \centering
    \includegraphics[width=0.85\linewidth]{Figures/email-header-forensics.png}
    \caption{Email Header Fields example (source: \href{https://www.forensicsware.com/blog/email-header-forensics/}{Forensicsware})}
    \label{fig:headerfields}
\end{figure}

The process of content examination serves as a complementary analysis to header analysis. It involves the investigation of email body text, embedded objects, and attachments. This methodical approach seeks to identify any potential indicators of malicious intent. Forensic investigators meticulously analyze linguistic patterns, urgency indicators, and social engineering tactics employed within message content. They then correlate these elements with header anomalies to construct comprehensive threat assessments.


\section{Autorship attribution}
Stylometric analysis is defined as the quantitative study of writing style. Autorship attribution leverages stylometric analysis to identify or verify the authors of anonymous disputed email messages. This is particularly useful in cybercrime investigations where determining the identity of individuals behind malicious email campaigns can enable prosecution and deterrence.
In practical implementations, authorship attribution relies on the extraction of multi-level stylometric features, including: lexical features (word frequency distributions and vocabulary richness), character-level features (character n-grams, punctuation usage), syntactic features (part-of-speech sequences, sentence length distributions), and structural features such as greeting formulas, signature patterns, and formatting conventions.

More advanced Authorship attribution methodologies incorporate Machine and Deep Learning techniques that automatically learn stylistic features from training corpora. Neural network architectures such as Convolutional or Recurrent Neural Networks can model sequential dependencies in text, capturing write style representations that differs from hand-crafted feature sets \cite{autorship}. These models have been developed to learn distributed representations of words that are enriched with linguistic features, including topical, lexical, syntactic, and character-level features. These features are designed to replicate human sentence composition processes.
The effectiveness of stylometric authorship attribution depends critically on several factors such as the availability of sufficient comparison texts from candidate authors, consistency of writing style across documents, and absence of deliberate obfuscation attempts.
One of the most used tool is \href{https://github.com/evllabs/JGAAP}{JGAAP}, an open source tool that through machine learning techniques helps with authorship attribution problems. JGAAP is a modular authorship attribution framework that implements a configurable pipeline for stylometric feature (such as lexical frequences, character and word n-grams, punctuation patterns) extraction and classification, enabling probabilistic attribution and similarity analysis across textual datasets. All the extracted features are then converted into "event sets", thus numerical representations of the author's style, making it possible to compare texts in a quantitative way. For the final result JGAAP applies classification and distance algorithms in order to attribute a text to a specific author or to evaluate the similarity between multiple texts \cite{juola2009jgaap}.

In email investigations, stylometric attribution is enriched by domain-specific indicators, such as reply structure, quotation style, use of subject prefixes (e.g., "\textit{Re:}", "\textit{Fwd:}"), time-of-day sending patterns, language switching, and consistency with historical organizational communication norms.

The Forensic application of autorship attribution include the use of clustering techniques to group anonymous emails by likely author. This enables investigators to link disparate messages to common sources, even when the absolute identity of the author cannot be established. This capability is valuable in the context of spam and spoofing campaigns, since clustering by autorship reduces the investigative workload by grouping related messages for a collective analysis rather than individual examination.
Adversaries may deliberately alter writing style or employ AI-assisted text generation to evade stylometric detection. As a result, authorship attribution must be treated as probabilistic evidence and corroborated with technical indicators such as authentication metadata, routing paths, and infrastructure reuse.



%\section{DMARC monitoring and compliance tools (dal checco)}
%Automated DMARC monitoring and compliance assessment tools offer scalable mechanisms for evaluating authentication configurations, identifying misconfigurations, and maintaining visibility into email authentication outcomes. These tools address the operational complexity of managing authentication records across multiple domains and subdomains, enabling systematic verification that defensive mechanisms function as intended.




\section{Integration with security operations (SIEM integration)}
The integration of email security systems with Security Information and Event Management platforms signifies a pivotal advancement in organizational threat detection and incident response capabilities. SIEM systems are designed to aggregate, normalize, and correlate security event data from diverse sources across IT infrastructure. This capability enables holistic threat analysis, which identifies attack patterns that are invisible when examining individual systems in isolation. \cite{dmarcsiem}

SIEM systems function as the primary investigative tools in the realm of cybersecurity.
They help in the detection of phishing and spoofing through:
\begin{itemize}
	\item \textbf{Centralized Monitoring}: SIEM consolidates logs from multiple sources, 	providing a comprehensive overview of network activities, facilitating the identification of anomalous patterns.
	
	\item \textbf{Correlation of Events}: SIEM tools are designed to analyze patterns by correlating events that appear to be unrelated to one another across the network. For example, the receipt of an email that appears to originate from an internal executive address, followed by multiple failed authentication attempts from an external IP, could be indicative of an email spoofing attempt.
	
	\item \textbf{Automated Alerts and Responses}: SIEM systems enable the immediate identification of potential spoofing attacks. 
	
	\item \textbf{Real-Time Threat Intelligence}: Integration with threat intelligence feeds enables SIEM systems to remain updated on the latest spoofing tactics and malware signatures.
\end{itemize}

\begin{table}[htbp]
\centering
\begin{tabularx}{\textwidth}{l X X}
\toprule
\textbf{SIEM} & \textbf{Data ingested} & \textbf{Detection logic} \\
\midrule
Splunk Enterprise Security &
Email gateway logs; parsed headers (From, Return-Path, Authentication-Results); DMARC reports; DNS telemetry; user-reported phishing. &
Correlation of DMARC failures with delivered messages; detection of domain impersonation via sender mismatch; behavioral baselining of sender domains; campaign-level time correlation. \\
\midrule
Elastic Security &
SMTP/MTA logs; email gateway logs; full header parsing (Received chain, Authentication-Results); DMARC reports; DNS logs with enrichment. &
Query-based detection of SPF/DKIM failures and misalignment; correlation of spoofed domains with anomalous routing paths; forensic timeline reconstruction. \\
\bottomrule
\end{tabularx}
\caption{Comparison of SIEM-based email spoofing detection}
\label{tab:siem_spoofing_compact}
\end{table}

The table \ref{tab:siem_spoofing_compact} summarizes SIEM approaches for email spoofing detection \cite{rfc7208, rfc6376, rfc8601, dmarcRFC, splunk_docs, elastic_docs}.
While both SIEM platforms ingest comparable email-related telemetry, Splunk Enterprise Security emphasizes rule-based correlation and behavioral analytics for alert generation, whereas Elastic Security provides greater flexibility for custom query development and forensic timeline reconstruction.

SIEM has been shown to enhance phishing and spoofing detection capabilities by examining elements beyond the content of the email. Furthermore, SIEM correlates email activity with other threat indicators, such as login anomalies or external web traffic, to detect phishing attempts that bypass standard filters. This ability to provide deep detection across multiple vectors gives SIEM an advantage over standalone email filtering solutions. Practical implementations demonstrate measurable improvements in security posture: financial institutions integrating DMARC monitoring with Splunk SIEM have achieved real-time alerting on unauthorized sender attempts, automated correlation of authentication failures with threat actor infrastructure, and substantial reductions in manual DMARC report analysis workload \cite{dmarc_siem_pro}.

\section{Emerging technologies}
In response to evolving email security challenges, novel technological approaches continue to emerge, particularly those focused on detecting AI-generated phishing attempts and implementing decentralized authentication architectures.

\subsection{AI-generated phishing and spoofing detection}
The proliferation of generative AI tools, which can produce human-quality text, and deepfake technologies capable of creating convincing audio and video impersonations, has introduced sophisticated attack capabilities accessible to low-skill adversaries. 

Nowadays Generative AI serves as both the threat vector and a defensive tool. New generation AI-driven security solutions analyze email content using multimodal analysis that examines text, visual elements, metadata and behavioral patterns, thus making it possible to detect AI-generated phishing emails. In addition to such generic content-based detection, many studies and commercial offerings use AI models that have been trained   with email metadata, authentication outcomes and communication patterns to recognize spoofing and impersonation attacks. These systems blend the results of linguistic analysis with protocol-level signals (SPF/DKIM/DMARC verdicts, sender reputation, and historical interaction history)   to detect social-engineering attacks when there are no malicious payloads \cite{mldetection}, \cite{spearphishing}, \cite{aidetection}.

\subsection{Blockchain-based email systems}
A decentralized approach to email authentication is offered by the Blockchain technology, which addresses vulnerabilities in traditional centralized email infrastructures. With Blockchain-based architectures, the email infrastructure is distributed across peer-to-peer networks, eliminating centralized control and enabling direct user-to-user message routing. In such type of communications, each email transaction is protected by a cryptographic signature, thus ensuring that only authorized recipients are allowed to read the sent emails.
Several research proposals explore blockchain-based mechanisms to redesign email trust and identity binding (e.g., smart-contract-based email protocols and certified email without a conventional TTP). While these approaches can, in principle, reduce spoofing by strengthening identity guarantees, they typically require architectural changes and face interoperability and deployment constraints in SMTP ecosystems \cite{blockchain_email}.

Blockchain email platforms allow to reduce the spoofing problem, integrating with decentralized domain registries. With the verification of the ownership of the domains on the blockchain, it is possible to drastically reduce spoofing while giving users full control on their identities and accounts. Finally, this decentralized paradigm offers an alternative to the classic centralized communications but, at the same time, ensuring security, privacy, ownership  and availability. Despite theoretical advantages documented in technical literature, blockchain email systems face significant adoption challenges including scalability limitations that introduce latency in high-volume environments, implementation costs associated with blockchain infrastructure, interoperability difficulties communicating with traditional email systems, and user experience complexity requiring cryptographic key management \cite{blockchain}.


\section{Legal and Forensic Challenges (evidence collection and preservation, attribution and investigation)}
The use of email evidence in legal proceedings and forensic investigations presents complex challenges spanning authentication, preservation, attribution, and admissibility requirements that vary across jurisdictions, as documented in forensic and legal literature.

\subsection{Evidence Collection and Preservation}
Rigorous protocols are required to maintain authenticity of digital evidences and prevent spoliation throughout collection, analysis, and presentation phases according to forensic standards.
Best practices require the use of forensically sound collection methods and specialized tools to capture emails without altering the metadata or header information. This is typically achieved through server-level extraction rather than user-initiated copying, which could cause the compromission of the integrity of the evidence. Creating master and working copies ensures that the original evidence is preserved while enabling analysis of duplicates, for this reason Master copies must be secured under strict access controls.

A critical evidentiary requirement in forensic literature is the established Chain of custody documentation, which provides chronological records tracking every individual who accessed evidence, the date and duration of access, the purpose of examination, and any actions performed. This meticulous documentation allows courts to verify that evidence remained unaltered between collection and presentation, establishing authenticity and defeating challenges regarding tampering or contamination. Failure to maintain complete chain of custody records can result in evidence exclusion regardless of its probative value, as demonstrated by legal precedents \cite{chainofcustody} \cite{chainofcus}.


\subsection{Attribution and Investigation}
Attribution involves determining the identity of individuals or entities responsible for malicious email activities. It is a fundamental challenge in cybercrime investigations, as documented in law enforcement research.
Techniques and technologies that enhance anonymity such as the use of VPNs, Tor networks, and proxy services, complicate attribution by obscuring the real IP addresses and locations.
When investigators even successfully trace emails to specific IP addresses, obtaining subscriber information from Internet Service Providers requires appropriate legal process including subpoenas, search warrants, or court orders. Attribution assessments use systematic methods to give each evidentiary artifact a reliability and credibility score. This enables the evaluation of confidence levels in attribution conclusions.

A research on email spoofing attacks \cite{spoofingpaper} demonstrated that there are significant vulnerabilities in authentication chains involving multiple protocols, roles, and services, where any failure can break chain-based defenses. The analysis of 30 popular email services and 23 email clients found that all of them were vulnerable to certain types of attacks capable of bypassing SPF, DKIM, DMARC and user-interface protections. These findings underscore attribution challenges when sophisticated attackers exploit protocol inconsistencies to obscure their identities.

Furthermore, cross-border investigation complexities arise when email servers, sender locations, and victim jurisdictions span multiple countries: These investigations require international legal cooperation through mutual legal assistance treaties and adherence to diverse legal frameworks governing data access and privacy protection. For this reason investigators must navigate legal tensions introduced by conflicting privacy regulations, such as the European Union's General Data Protection Regulation, which can prohibit evidence collection methods that are permissible in other jurisdictions.


\subsection{Legal Admissibility Challenges}
The legal admissibility in legal proceedings of email evidence is contingent upon the satisfaction of authentication, relevance, and hearsay exception requirements under applicable evidentiary rules as established in legal scholarship.

Authentication necessitates substantiation that the emails intended as evidence originate from the stated senders and have remained unaltered. This is typically established through digital forensic analysis of metadata, header examination, and hash verification. Consequently, it is frequently essential to solicit the testimony of computer forensic experts who have collected and analyzed the evidence to establish its authenticity and explain the technical collection methodologies to the courts.
Forensic experts must prepare for challenges addressing collection methodology, preservation integrity, and analysis reliability, since it is mandatory the presentation of original emails or properly authenticated duplicates, with forensically preserved copies including complete metadata satisfying this requirement according to evidentiary standards. Furthermore, privacy law compliance, particularly regarding employee email monitoring and third-party service provider data access, requires careful navigation to avoid exclusion of improperly obtained evidence.

The evidentiary value of email forensics extends beyond criminal prosecutions to encompass civil litigation, employment disputes or intellectual property cases. For this reason, in each context, adherence to forensically sound collection and preservation practices proves essential to ensure evidence withstands admissibility challenges and contributes meaningfully to case resolution.






