Improving Spam Detection Based on Structural Similarity By Luiz H. Gomes, Fernando D. O. Castro, Rodrigo B. Almeida, Luis M. A. Bettencourt, Virgílio A. F. Almeida, Jussara M. Almeida Presented at Steps to Reducing Unwanted Traffic on the Internet Workshop, 2005 Presented by Jared Bott

2 Outline Overview Concepts Detecting Spam Experimental Results Analysis of Paper

3 Overview New algorithm to detect spam messages Uses information that is harder to change Works in conjunction with another spam classifier  I.e. SpamAssassin Less false positives than compared methods

4 Spam Detection Problem Spam detection algorithms use some part of s to determine if a message is spam  Spammers change messages so that they do not meet detection criteria for spam  Very easy to change spam messages, usernames, domains, subjects, etc.

5 Key Idea The lists that spammers and legitimate users send messages to and from can be used as the identifiers of classes of traffic.  The lists of addresses spammers send to are unlikely to be similar to those of legitimate users.  Lists don’t change that often

6 Using Lists A user is not just an address. It can be a domain, etc. Represent user as a vector in multi- dimensional conceptual space created with all possible contacts  Each sender and each recipient has their own vector Model relationship between senders and recipients

7 Constructing Vectors If there is at least one sent from sender s i to recipient r n, then the value in s i ’s vector’s nth dimension is 1. Otherwise, that value is 0. If there is at least one received by recipient r i from sender s n, the value in r i ’s vector’s nth dimension is 1. Otherwise it is 0.

8 Example Vectors

9 Similarity Between Senders Similarity between senders s i and s k is the cosine of the angle between their vectors  cos(s i, s k )  0 means no shared contact  1 means identical contact lists In legitimate , a 1 means that the senders operate in the same social group. In spammers, a 1 means that the senders use the same list or are the same person.

10 Grouping Users Into Clusters Group users with similar vectors  Users with similar vectors are likely to have related roles, i.e. spammer or legitimate user Each cluster is represented by a vector  This vector is the sum of all its component users’ vectors

11 Similarity Between a User and a Cluster Similarity is derived from user to user similarity equation  If sender s i is a member of cluster sc k, then the similarity is cos(sc k – s i, s i ).  If sender s i is not a member of cluster sc k, then the similarity is cos(sc k, s i ). Similarity between a user and a cluster will change over time  Remove the user’s vector from the cluster’s vector when computing similarity and reclassifying a user

12 Detecting Spam Two probabilities to compute  P s (m) – Probability of an m being sent by a spammer  P r (m) – Probability of an m being addressed to users that receive spam

13 Detecting Spam When an arrives, classify it using some other method Find the cluster (sc) the ’s sender belongs in  If many users in the cluster send messages that are classified as spam by auxiliary method, the probability of all the users in that cluster sending spam is high Update the sc’s spam probability P s (m) ← sc’s spam probability

14 Detecting Spam For all recipients of the , find the cluster (rc) each one belongs to Update the spam probability for each cluster P r (m) ← P r (m) + spam probability of each rc P r (m) ← P r (m)/number of recipients

15 Detecting Spam Compute a spam rank for the based upon P r (m) and P s (m) If the spam rank is above some threshold (ω), label it as spam If the spam rank is below 1- ω, label it is legitimate Otherwise label the as the auxiliary method’s classification

16

17 Experimental Results Tested on a log of eight days of from a large Brazilian university Tested on a 2.8 GHz Pentium 4 with 512 MB RAM  Able to classify 20 messages per second  Faster than the average message arrival peak rate

18 Results MeasureNon-SpamSpamAggregate # of s 191,417173,584365,001 Size of s 11.3 GB1.2 GB12.5 GB # of distinct senders 12,33819,56727,734 # of distinct recipients 22,76227,92638,875

19 Results Manually checked false positives to see if they were spam or not  Auxiliary algorithm had more false positives Algorithm% of Misclassifications Original Classification 60.33% Their approach 39.67%

20 Strengths Less false positives than SpamAssassin Low-cost Works with message information that doesn’t change that much

21 Weaknesses Needs an additional message classifier, i.e. SpamAssassin Manual tuning of algorithm

22 Improvements Time correlation of similar addresses Collaborative filtering based upon user feedback