Workload models of spam and legitimate e-mails

Gomes, Luíz Henrique; Cazita, Cristiano; Almeida, Jussara M.; Almeida, Virgı́lio; Meira, Wagner

doi:10.1016/j.peva.2006.11.001

Cited by 36 publications

(28 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Content pollution has been observed in various applications, including e-mail [15], Web search engines [13], blogs [29]. Thus, a number of detection and combating strategies have been proposed [9,16,25,32].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Detecting spammers and content promoters in online video social networks

Benevenuto

Rodrigues

Almeida

et al. 2009

Proceedings of the 32nd International ACM SIGIR Conference on Research and Development in Information Retrieval

Self Cite

129

View full text Add to dashboard Cite

A number of online video social networks, out of which YouTube is the most popular, provides features that allow users to post a video as a response to a discussion topic. These features open opportunities for users to introduce polluted content, or simply pollution, into the system. For instance, spammers may post an unrelated video as response to a popular one aiming at increasing the likelihood of the response being viewed by a larger number of users. Moreover, opportunistic users -promoters -may try to gain visibility to a specific video by posting a large number of (potentially unrelated) responses to boost the rank of the responded video, making it appear in the top lists maintained by the system. Content pollution may jeopardize the trust of users on the system, thus compromising its success in promoting social interactions. In spite of that, the available literature is very limited in providing a deep understanding of this problem.In this paper, we go a step further by addressing the issue of detecting video spammers and promoters. Towards that end, we manually build a test collection of real YouTube users, classifying them as spammers, promoters, and legitimates. Using our test collection, we provide a characterization of social and content attributes that may help distinguish each user class. We also investigate the feasibility of using a state-of-the-art supervised classification algorithm to detect spammers and promoters, and assess its effectiveness in our test collection. We found that our approach is able to correctly identify the majority of the promoters, misclassifying only a small percentage of legitimate users. In contrast, although we are able to detect a significant fraction of spammers, they showed to be much harder to distinguish from legitimate users.

show abstract

Section: Related Workmentioning

confidence: 99%

“…The crawler ran for one week (01/ [11][12][13][14][15][16][17][18]2008), gathering a total of 264,460 users, 381,616 responded videos and 701,950 video responses. This dataset produces a large weakly connected component of graph (X, Y ), and is used as source for building our test collection, as described next.…”

Section: Crawling Youtubementioning

confidence: 99%

Detecting spammers and content promoters in online video social networks

Benevenuto

Rodrigues

Almeida

et al. 2009

Proceedings of the 32nd International ACM SIGIR Conference on Research and Development in Information Retrieval

Self Cite

129

View full text Add to dashboard Cite

show abstract

“…sender and receiver. However, most recent studies of network traffic analysis have focused on Internet traffic (World Wide Web), only a few researches [5][6][7][8][9] analyzing the characteristics and behavior of mail traffic, which are based on scales and its protocol requests in the network traffic…”

Section: Introductionmentioning

confidence: 99%

The Usage Analysis of Web and Email Traffic on the University Internet Backbone Links

Dyllan¹,

Ganeshacumar²,

Xiao³

2015

ujcn

View full text Add to dashboard Cite

We present our latest study on monitoring and analyzing the behavior of the LSBU (London South Bank University) data network traffic as well as identifying and understanding the usage of http traffic, mail traffic and overall traffic. This analysis of the network activity allows us to calculate accurately the importance of the network traffic characteristics, on a continuous basis, which can identify the data traffic patterns on the overall gateway and highlight the end-to-end performance of the network path. In this paper, the PRTG network monitoring tool (Paessler AG, Germany) has been chosen as this provides the capabilities of SNMP, port utilisation as well as sFlow. The objectives of the study are to point out the impact of the LSBU network performance and its congestions current state; to predict the future data network traffic and congestions; to focus on the usage of mail against the mostly used protocol such as http and https; to identify the venerability of the network, due to high usage in particular time of the day; and to check the capacity usage of the current resources to maximize performance and network utilization.

show abstract

“…The reason for this huge difference is that, whereas previous studies of outgoing spam mostly use small sized datasets taken from academic institutes [16,11,13,18] or from Enron's public data set [14], our study uses a data set collected by the mail servers of a large ESP. Table 2 provides additional information regarding our data set.…”

Section: Data Set and Feature Extractionmentioning

confidence: 99%

Early Detection of Outgoing Spammers in Large-Scale Service Provider Networks

Cohen

Gordon

Hendler

2013

Detection of Intrusions and Malware, and Vulnerability Assessment

View full text Add to dashboard Cite

Abstract. We present ErDOS, an Early Detection scheme for Outgoing Spam. The detection approach implemented by ErDOS combines content-based detection and features based on inter-account communication patterns. We define new account features, based on the ratio between the numbers of sent and received emails and on the distribution of emails received from different accounts. Our empirical evaluation of ErDOS is based on a real-life data-set collected by an email service provider, much larger than data-sets previously used for outgoing-spam detection research. It establishes that ErDOS is able to provide early detection for a significant fraction of the spammers population, that is, it identifies these accounts as spammers before they are detected as such by a content-based detector. Moreover, ErDOS only requires a single day of training data for providing a high-quality list of suspect accounts.

show abstract

Workload models of spam and legitimate e-mails

Cited by 36 publications

References 6 publications

Detecting spammers and content promoters in online video social networks

Detecting spammers and content promoters in online video social networks

The Usage Analysis of Web and Email Traffic on the University Internet Backbone Links

Early Detection of Outgoing Spammers in Large-Scale Service Provider Networks

Contact Info

Product

Resources

About