Targeting spam control on middleboxes: Spam detection based on layer-3 e-mail content classification

Computer Networks

Volumn 53, Issue 6, 2009, Pages 835-848

  Marsono, Muhammad N ^a   El Kharashi, M Watheq ^b   Gebali, Fayez ^c  

^a UNIVERSITI TEKNOLOGI MALAYSIA   (Malaysia)

^b The British University in Egypt   (Egypt)

^c UNIVERSITY OF VICTORIA   (Canada)

Author keywords

E mail content classification; Middlebox implementation; Na ve Bayes classification; Packet pre classification; Packet processing; Spam detection

Indexed keywords

INTERNET; MAIL HANDLING; PACKET NETWORKS; SPAMMING;

E-MAIL CONTENT CLASSIFICATION; MIDDLEBOX IMPLEMENTATION; PACKET PRE-CLASSIFICATION; PACKET PROCESSING; SPAM DETECTION;

ELECTRONIC MAIL;

EID: 61749086696     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2008.11.012     Document Type: Article

References (58)

1. Goodman J., Heckerman D., and Rounthwaite R. Stopping spam. Scientific American 292 4 (2005) 42-49
2. Newman M.E.J., Forrest S., and Balthrop J. Email networks and the spread of computer viruses. Physical Review 66 035101 (2002) 1-4
3. Levy E. The making of a spam zombie army: dissecting the Sobig worms. IEEE Security and Privacy 1 4 (2003) 58-59
4. The spam economy: the convergent spam and virus threats. .
5. P. Resnick, RFC2822: internet message format (April 2001). .
6. J. Klensin, RFC2821: simple mail transfer protocol (April 2001). .
7. D.J. Bernstein, Internet mail 2000. .
8. G. Fecyk, Designated mailers protocol (DMP). .
9. Geer D. Will new standards help curb spam?. IEEE Computer 37 2 (2004) 14-16
10. A. Jesdanun, As spam filters improve, attention shifts to containment. .
11. R.D. Twining, M.M. Williamson, M. Mowbray, M. Rahmouni, Email prioritization: reducing delays on legitimate mail caused by junk mail, Technical Report HPL-2004-5(R.1), HP Digital Media Systems Laboratory, Bristol, UK, May 2004.
12. Marsono M.N., El-Kharashi M.W., and Gebali F. Prioritized e-mail servicing to reduce non-spam delay and loss: a performance analysis. Wiley International Journal of Network Management 18 4 (2008) 323-342
13. M. Tran, G. Armitage, Evaluating the use of spam-triggered TCP/IP rate control to protect SMTP servers, in: Proceedings of the Australian Telecommunications Networks and Applications Conference (ATNAC 2004), Sydney, Australia, 2004, pp. 329-335.
14. Marsono M.N., El-Kharashi M.W., and Gebali F. A spam rejection scheme during SMTP sessions based on layer 3 e-mail classification. Elsevier Journal of Network and Computer Applications 32 1 (2009) 236-257
15. R. Clayton, Stopping spam by extrusion detection, in: Proceedings of the First Conference on Email and Anti-Spam (CEAS), Mountain View, CA, USA, 2004.
16. E. Markatos, Speeding up TCP/IP: faster processors are not enough, in: Proceedings of the 21st IEEE International Performance, Computing, and Communications Conference (IPCCC 2002), Phoenix, AZ, USA, 2002, pp. 341-345.
17. Espion Interceptor. .
18. A. Bratko, B. Filipič, Spam filtering using compression models, Technical Report IJS-DP-9227, Department of Intelligent Systems, Jožef Stefan Institute, Ljubljana, Slovenia, 2005.
19. Drucker H., Wu D., and Vapnik V. Support vector machines for spam categorization. IEEE Transactions on Neural Networks 10 5 (1999) 1048-1054
20. I. Androutsopolous, J. Koutsias, K.V. Chandrinos, G. Paliouras, C.D. Spyropolous, An evaluation of naive Bayesian anti-spam filtering, in: Proceedings of the Workshop on Machine Learning in the New Information Age, the 11th European Conference on Machine Learning (ECML 2000), Barcelona, Spain, 2000, pp. 9-17.
21. A plan for spam, 2003. .
22. Siefkes C., Assis F., Chhabra S., and Yerazunis W.S. Combining winnow and orthogonal sparse bigrams for incremental spam filtering. Principles and Practice of Knowledge Discovery in Databases (PKDD'04), Lecture Notes in Computer Science, LNCS 3201 (2004), Springer, Berlin 410-421
23. W. Yerazunis, The spam filtering plateau at 99.9% accuracy and how to get past it, in: Proceedings of the MIT Spam Conference, Cambridge, MA, USA, 2004.
24. B. Agrawal, N. Kumar, M. Molle, Controlling spam emails at the routers, in: Proceedings of the 2005 IEEE International Conference on Communications (ICC 2005), Seoul, Korea, 2005, pp. 1588-1592.
25. Marsono M.N., El-Kharashi M.W., and Gebali F. Binary LNS-based naïve Bayes inference engine for spam control: noise analysis and FPGA implementation. IET Computers and Digital Techniques 2 1 (2008) 56-62
26. T.H. Ptacek, T.N. Newsham, Insertion, evasion, and denial of service: eluding network intrusion detection, Technical Report T2R-0Y6, Secure Networks, Calgary, AB, Canada, 1998.
27. G. Varghese, J.A. Fingerhut, F. Bonomi, Detecting evasion attacks at high speeds without reassembly, in: Proceedings of the 2006 ACM SIGCOMM Conference, Pisa, Italy, 2006, pp. 327-338.
28. Real-time spam black lists (RBL). .
29. L.H. Gomes, C. Cazita, J.M. Almeida, V. Almeida, W. Meira, Jr., Characterizing a spam traffic, in: Proceedings of the Fourth ACM SIGCOMM Conference on Internet Measurement (IMC 2004), Taormina, Italy, 2004, pp. 356-369.
30. G.V. Cormack, A. Bratko, Batch and on-line spam filter evaluation, in: Proceedings of the Third Conference on Email and Anti-Spam (CEAS 2006), Mountain View, CA, USA, 2006.
31. Tanenbaum A.S. Computer Networks. 4th ed. (2003), Prentice-Hall, Upper Saddle River, NJ, USA
32. S. Savage, D. Wetherall, A. Karlin, T. Anderson, Practical network support for IP traceback, in: Proceedings of the 2000 ACM SIGCOMM Conference, Stockholm, Sweden, 2000, pp. 295-306.
33. D.S. Kim, C.S. Hong, Y. Xiang, An intelligent approach of packet marking at edge router for IP traceback, in: Knowledge-Based Intelligent Information and Engineering Systems (KES 2005), Lecture Notes in Artificial Intelligence, LNAI 3683, Springer, Berlin, 2005, pp. 303-309.
34. J. Goodman, R. Rounthwaite, Stopping outgoing spam, in: Proceedings of the ACM Conference on Electronic Commerce (EC'04), New York, NY, USA, 2004, pp. 30-39.
35. Nilsimsa. .
36. G. Sakkis, I. Androutsopoulos, G. Paliouras, V. Karkaletsis, C.D. Spyropoulos, P. Stamatopoulos, Stacking classifiers for anti-spam filtering of e-mail, in: Proceedings of the 2001 Conference on Empirical Methods in Natural Language Processing (EMNLP'01), Pittsburg, PA, USA, 2001, pp. 44-50.
37. S. Hird, Technical solutions for controlling spam, in: Proceedings of the Australian UNIX and Open Systems User Group (AUUG), Melbourne, Australia, 2002.
38. Goodman J., Cormack G.V., and Heckerman D. Spam and the ongoing battle for the inbox. Communications of the ACM 50 2 (2007) 24-33
39. K. Yoshida, F. Adachi, T. Washio, H. Motoda, T. Homma, A. Nakashima, H. Fujikawa, K. Yamazaki, Density-based spam detector, in: Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD 2004), Seattle, WA, USA, 2004, pp. 486-493.
40. C. Kruegel, E. Kirda, D. Mutz, W. Robertson, G. Vigna, Polymorphic worm detection using structural information of executables, in: Recent Advances in Intrusion Detection (RAID 2005), Lecture Notes in Computer Science, LNCS 3858, Springer, Berlin, 2005, pp. 207-226.
41. J. Newsome, B. Karp, D. Song, Polygraph: Automatically generating signatures for polymorphic worms, in: Proceedings of the IEEE Symposium on Security and Privacy (S&P 2005), Berkeley, CA, USA, 2005, pp. 226-241.
42. C. O'Brien, C. Vogel, Spam filters: Bayes vs. Chi-squared; letters vs. words, in: Proceedings of the First International Symposium on Information and Communication Technologies (ISICT 2003), Dublin, Ireland, 2003, pp. 291-296.
43. Hershkop S., and Stolfo S.J. Identifying spam without peeking at the contents. Crossroads: The ACM Student Magazine 11 2 (2004) 3-13
44. Y. Yang, J.O. Pedersen, A comparative study on feature selection in text categorization, in: Proceedings of the 14th International Conference on Machine Learning (ICML-97), Nashville, TN, USA, 1997, pp. 412-420.
45. J. Walker, Annoyance filter: adaptive Bayesian junk mail filter. .
46. T. Fawcett, ROC graphs: notes and practical considerations for researchers, Technical Report HPL-2003-4, HP Labaratory, 2004.
47. Wolpert D., and Macready W. No free lunch theorems for optimization. IEEE Transactions on Evolutionary Computation 1 1 (1997) 67-82
48. Spam filtering II. http://sam.holden.id.au/writings/spam2/>.
49. SpamAssassin data set. .
50. TREC2005 data set. .
51. PU and LingSpam data sets. .
52. Saerens M., Latinne P., and Decaestecker C. Adjusting the outputs of a classifier to new a priori probabilities: a simple procedure. Neural Computing 14 1 (2002) 21-41
53. Schuehler D.V., Moscola J., and Lockwood J.W. Architecture for a hardware-based, TCP/IP content-processing system. IEEE Micro 24 1 (2004) 62-69
54. Shannon C., Moore D., and Claffy K. Beyond folklore: observations on fragmented traffic. IEEE/ACM Transactions on Networking 10 6 (2002) 709-720
55. A.O. Freier, P. Karlton, P.C. Kocher, The SSL protocol Version 3.0 (November 1996). .
56. T. Dierks, E. Rescorla, RFC4346: the transport layer security (TLS) protocol version 1.1 (April 2006). .
57. RFC3850: secure/multipurpose internet mail extensions (S/MIME) version 3.1, certificate handling, July 2004. .
58. RFC3850: secure/multipurpose internet mail extensions (S/MIME) version 3.1, message specification, July 2004. .