Early detection of outgoing spammers in large-scale service provider networks

Authors:
Yehonatan Cohen;Daniel Gordon;Danny Hendler
Affiliations:
Ben Gurion University of the Negev, Be'er Sheva, Israel;Ben Gurion University of the Negev, Be'er Sheva, Israel;Ben Gurion University of the Negev, Be'er Sheva, Israel
Venue:
DIMVA'13 Proceedings of the 10th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Year:
2013

Citing 13
Cited 0

Support-Vector Networks

Machine Learning
Leveraging Social Networks to Fight Spam

Computer
Image Analysis for Efficient Categorization of Image-based Spam E-mail

ICDAR '05 Proceedings of the Eighth International Conference on Document Analysis and Recognition
Rotation Forest: A New Classifier Ensemble Method

IEEE Transactions on Pattern Analysis and Machine Intelligence
Workload models of spam and legitimate e-mails

Performance Evaluation
Exploiting network structure for proactive spam mitigation

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Anti-Honeypot Technology

IEEE Security and Privacy
Studying spamming botnets using Botlab

NSDI'09 Proceedings of the 6th USENIX symposium on Networked systems design and implementation
Incremental SVM Model for Spam Detection on Dynamic Email Social Networks

CSE '09 Proceedings of the 2009 International Conference on Computational Science and Engineering - Volume 04
A study of cross-validation and bootstrap for accuracy estimation and model selection

IJCAI'95 Proceedings of the 14th international joint conference on Artificial intelligence - Volume 2
Data Mining with Decision Trees: Theroy and Applications

Data Mining with Decision Trees: Theroy and Applications
An Unsupervised Approach for Identifying Spammers in Social Networks

ICTAI '11 Proceedings of the 2011 IEEE 23rd International Conference on Tools with Artificial Intelligence
Towards modeling legitimate and unsolicited email traffic using social network properties

Proceedings of the Fifth Workshop on Social Network Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present ErDOS, an Early Detection scheme for Outgoing Spam. The detection approach implemented by ErDOS combines content-based detection and features based on inter-account communication patterns. We define new account features, based on the ratio between the numbers of sent and received emails and on the distribution of emails received from different accounts. Our empirical evaluation of ErDOS is based on a real-life data-set collected by an email service provider, much larger than data-sets previously used for outgoing-spam detection research. It establishes that ErDOS is able to provide early detection for a significant fraction of the spammers population, that is, it identifies these accounts as spammers before they are detected as such by a content-based detector. Moreover, ErDOS only requires a single day of training data for providing a high-quality list of suspect accounts.