Title:
SNARE: Spatio-temporal Network-level Automatic Reputation Engine
SNARE: Spatio-temporal Network-level Automatic Reputation Engine
| dc.contributor.author | Feamster, Nick | |
| dc.contributor.author | Gray, Alexander | |
| dc.contributor.author | Krasser, Sven | |
| dc.contributor.author | Syed, Nadeem Ahmed | |
| dc.date.accessioned | 2008-10-13T18:04:06Z | |
| dc.date.available | 2008-10-13T18:04:06Z | |
| dc.date.issued | 2008 | |
| dc.description.abstract | Current spam filtering techniques classify email based on content and IP reputation blacklists or whitelists. Unfortunately, spammers can alter spam content to evade content based filters, and spammers continually change the IP addresses from which they send spam. Previous work has suggested that filters based on network-level behavior might be more efficient and robust, by making decisions based on how messages are sent, as opposed to what is being sent or who is sending them. This paper presents a technique to identify spammers based on features that exploit the network-level spatio temporal behavior of email senders to differentiate the spamming IPs from legitimate senders. Our behavioral classifier has two benefits: (1) it is early (i.e., it can automatically detect spam without seeing a large amount of email from a sending IP address-sometimes even upon seeing only a single packet); (2) it is evasion-resistant (i.e., it is based on spatial and temporal features that are difficult for a sender to change). We build classifiers based on these features using two different machine learning methods, support vector machine and decision trees, and we study the efficacy of these classifiers using labeled data from a deployed commercial spam-filtering system. Surprisingly, using only features from a single IP packet header (i.e., without looking at packet contents), our classifier can identify spammers with about 93% accuracy and a reasonably low false-positive rate (about 7%). After looking at a single message spammer identification accuracy improves to more than 94% with a false rate of just over 5%. These suggest an effective sender reputation mechanism. | en |
| dc.identifier.uri | http://hdl.handle.net/1853/25135 | |
| dc.language.iso | en_US | en |
| dc.publisher | Georgia Institute of Technology | en |
| dc.relation.ispartofseries | CSE Technical Reports ; GT-CSE-08-02 | en |
| dc.subject | Blacklists | en |
| dc.subject | Botnet | en |
| dc.subject | Spammers | en |
| dc.title | SNARE: Spatio-temporal Network-level Automatic Reputation Engine | en |
| dc.type | Text | |
| dc.type.genre | Technical Report | |
| dspace.entity.type | Publication | |
| local.contributor.corporatename | College of Computing | |
| local.contributor.corporatename | School of Computational Science and Engineering | |
| local.relation.ispartofseries | College of Computing Technical Report Series | |
| local.relation.ispartofseries | School of Computational Science and Engineering Technical Report Series | |
| relation.isOrgUnitOfPublication | c8892b3c-8db6-4b7b-a33a-1b67f7db2021 | |
| relation.isOrgUnitOfPublication | 01ab2ef1-c6da-49c9-be98-fbd1d840d2b1 | |
| relation.isSeriesOfPublication | 35c9e8fc-dd67-4201-b1d5-016381ef65b8 | |
| relation.isSeriesOfPublication | 5a01f926-96af-453d-a75b-abc3e0f0abb3 |