High-speed detection of unsolicited bulk emails

We propose a Progressive Email Classifier (PEC) for highspeed classification of message patterns that are commonly associated with unsolicited bulk email (UNBE). PEC is designed to operate at the network access point, the ingress between the Internet Service Provider (ISP) and the enterprise network; so that a surge of UNBE containing fresh patterns can be detected before they spread into the enterprise network. A real-time scoreboard keeps track of detected feature instances (FI) based on a scoring and aging engine, until they are considered either from valid or UNBE sources. A FI of a valid email is discarded, but an anomalous one is passed to a blacklist to control (e.g., block or defer) subsequent emails containing the FI. The anomaly detector of PEC can be used at different protocol layers. To gain some insights on the performance of PEC, we implemented PEC and integrated it with the sendmail daemon to detect anomalous URL links from email streams. Arbitrarily chosen on-line text...

• Type: Conference
• Year: 2007
• Where: ANCS
• Authors: Sheng-Ya Lin, Cheng-Chung Tan, Jyh-Charn Liu, Michael Oehler
• Keywords: ANCS 2007, Computer Networks, Emails, Enterprise Network, Progressive Email Classifier