TRUST: Threat Reduction via Understanding Subjective Treatment

This article argues that defenses should shift from solely identifying deceptive email content to modeling what is familiar and truthful for an organization (a "TRUST" model). It proposes baselining legitimate email headers, classifying mail types and attachment behavior, and applying file-behavior analysis (fuzzy hashing, entropy, temporal/frequency measures) to detect phishing and malware more effectively, while noting existing technologies like SPF/DKIM/DMARC are insufficient alone.