Blocking spam by separating end-user machines from legitimate mail server machines

Spamming botnets present a critical challenge in the control of spam messages due to the sheer volume and wide spread of the botnet members. In this paper we advocate the approach for recipient mail servers to filter messages directly delivered from remote end-user (EU) machines, given that the majority of spamming bots are EU machines. We develop a Support Vector Machine (SVM) based classifier to separate EU machines from legitimate mail server (LMS) machines, using a set of machine features that cannot be easily manipulated by spammers. We investigate the efficacy and performance of the SVM-based classifier using a number of real-world data sets. Our performance studies show that the SVM-based classifier is indeed a feasible and effective approach in distinguishing EU machines from LMS machines. For example, training and testing on an aggregated data set containing both EU machines and LMS machines, the SVM-based classifier can achieve a 99.27% detection accuracy, with very s...

• Type: Journal
• Year: 2011
• Where: CEAS
• Authors: Fernando Sanchez, Zhenhai Duan, Yingfei Dong
• Keywords: CEAS 2011, Internet Technology, Legitimate Mail, Mail Servers, Support Vector Machine