A case for unsupervised-learning-based spam filtering

Abstract

Spam filtering has traditionally relied on extracting spam signatures via supervised learning, i.e., using emails explicitly manually labeled as spam or ham. Such supervised learning is labor-intensive and costly, more importantly cannot adapt to new spamming behavior quickly enough. The fundamental reason for needing labeled training corpus is that the learning, e.g., the process of extracting signatures, is carried out by examining individual emails. In this paper, we study the feasibility of unsupervised learning-based spam filtering that can more effectively identify new spamming behavior. Our study is motivated by three key observations of today's Internet spam: (1) the vast majority of emails are spam, (2) a spam email should always belong to some campaign, (3) spam from the same campaign are generated from some template that obfuscates some parts of the spam, e.g., sensitive terms, leaving other parts unchanged.We present the design of an online, unsupervised spam learning and detection scheme. The key component of our scheme is a novel text-mining-based campaign identification framework that clusters spam into campaigns and extracts the invariant textual fragments from spam as campaign signatures. While the individual terms in the invariant fragments can also appear in ham, the key insight behind our unsupervised scheme is that our learning algorithm is effective in extracting co-occurrences of terms that are generated by campaign templates and rarely appear in ham. Using large traces containing about 2 million emails from three sources, we show our unsupervised scheme alone achieves a false negative ratio of 3.5% and a false positive ratio of at most 0.4%. These detection accuracies are comparable to those of the de-facto supervised-learning-based filtering systems such as SpamAssassin (SA), suggesting that unsupervised spam filtering holds high promise in battling today's Internet spam.

An Improved Transformer-based Model for Detecting Phishing, Spam, and Ham: A Large Language Model Approach

“…For SMS dataset, the highest performance (accuracy 98.7%) is achieved from the combined model of Word Embedding and neural network. Apart from the supervised learning approaches, there are numerous works on unsupervised modeling as well [17][18][19][20][21][22]. Utilizing Modified Density-Based Spatial Clustering of Applications with Noise (M-DBSCAN), 97.848% accuracy has been obtained by Manaa et al.…”

An Unsupervised Approach for Content-Based Clustering of Emails Into Spam and Ham Through Multiangular Feature Formulation

“…As the name indicates, unsupervised learning based models work only with unlabelled data so no training phase is involved; whereas supervised techniques have the requirement of training over a large dataset often requiring costly data labelling [17]. Unsupervised algorithms most commonly attempt to discover a common pattern associated with the features being processed within the dataset [18]. The algorithm rearranges the data items in separate clusters.…”

Novel Email Spam Classification using Integrated Particle Swarm Optimization and J48

“…However they also lead to spam due to fake positive or negative reviews. Authors [20] put forwards the development of online unsupervised spam learning and detection scheme. The learning algorithm is efficient in mining repeated occurrences of terms that are generated by templates and rarely seen in spam.…”