|
|
Spam detection methods
Rickwood, Michal ; Horváth, Tomáš (oponent) ; Oujezský, Václav (vedoucí práce)
The main goal of this thesis is to build a spam detection algorithm that uses solely traffic flow logs in the form of Netflow messages. Internet service providers must detect spam in order for their entire subnets not to be marked as spamming stations. The algorithm was drafted based on an analysis of various datasets containing Netflow records. These datasets consist of valid e-mails, spam and common non e-mail related traffic. The algorithm uses domain name system blacklist verification as the first step of identifying a spamming station. All flagged communications are dropped immediately. Only if a station is not marked are filtering criteria subsequently applied. These criteria have been divided into acceptance and ordering criteria. An acceptance criterion has been drafted to select potentially significant stations. Five ordering criteria have been formulated to sort these selected IP addresses by the probability of them being spamming stations. Behind each criterion is a mathematical equation that returns a value between 0 and 1. The total sums of such returned values are close to 5 with spamming stations, while legitimate stations have noticeably lower values. The output of the developed algorithm is a list of potential spamming stations sorted probability of them being spamming stations.
|
|
|
A proposal of a method to detect spam from information messages
Rickwood, M. ; Oujezský, V.
This paper presents a spam detection algorithm that uses solely traffic flow logs in the form of Netflow messages. Internet service providers must detect spam in order for their entire subnets not to be marked as spamming stations. The algorithm was drafted based on an analysis of various datasets containing Netflow records. These datasets consist of valid e-mails, spam and common non e-mail related traffic. The algorithm uses domain name system blacklist verification as the first step of identifying a spamming station. Furthermore, theoretical models of valid clients and spammers have been laid out. In continuation of this work, the dataset will be studied to find correlation with the models. Included in the tracked parameters one can find the number of incoming and outcoming messages, timestamps amongst others.
|
|
|
Spam detection methods
Rickwood, Michal ; Horváth, Tomáš (oponent) ; Oujezský, Václav (vedoucí práce)
The main goal of this thesis is to build a spam detection algorithm that uses solely traffic flow logs in the form of Netflow messages. Internet service providers must detect spam in order for their entire subnets not to be marked as spamming stations. The algorithm was drafted based on an analysis of various datasets containing Netflow records. These datasets consist of valid e-mails, spam and common non e-mail related traffic. The algorithm uses domain name system blacklist verification as the first step of identifying a spamming station. All flagged communications are dropped immediately. Only if a station is not marked are filtering criteria subsequently applied. These criteria have been divided into acceptance and ordering criteria. An acceptance criterion has been drafted to select potentially significant stations. Five ordering criteria have been formulated to sort these selected IP addresses by the probability of them being spamming stations. Behind each criterion is a mathematical equation that returns a value between 0 and 1. The total sums of such returned values are close to 5 with spamming stations, while legitimate stations have noticeably lower values. The output of the developed algorithm is a list of potential spamming stations sorted probability of them being spamming stations.
|
host ::
RSS.