@article {228, title = {Spam Classification Based on E-Mail Path Analysis}, journal = {Pervasive Information Security and Privacy Developments: Trends and Advancements: Trends and Advancements}, year = {2010}, pages = {332}, author = {Palla, Srikanth and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {17, title = {Behavior analysis of spam botnets}, booktitle = {2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE {\textquoteright}08)}, year = {2008}, abstract = {

Compromised computers, known as bots, are the major source of spamming and their detection helps greatly improve control of unwanted traffic. In this work we investigate the behavior patterns of spammers based on their underlying similarities in spamming. To our knowledge, no work has been reported on identifying spam botnets based on spammerspsila temporal characteristics. Our study shows that the relationship among spammers demonstrates highly clustering structures based on features such as content length, time of arrival, frequency of email, active time, inter-arrival time, and content type. Although the dimensions of the collected feature set is low, we perform principal component analysis (PCA) on feature set to identify the features which account for the maximum variance in the spamming patterns. Further, we calculate the proximity between different spammers and classify them into various groups. Each group represents similar proximity. Spammers in the same group inherit similar patterns of spamming a domain. For classification into Botnet groups, we use clustering algorithms such as Hierarchical and K-means.We identify Botnet spammers into a particular group with a precision of 90\%.

}, keywords = {behavior pattern analysis, Botnets, Classification algorithms, clustering algorithm, Clustering algorithms, Correlation, Electronic mail, feature set, Filtering, information filtering, invasive software, maximum variance, pattern classification, pattern clustering, PCA, principal component analysis, spam filtering, Time frequency analysis, unsolicited e-mail, unwanted traffic control}, doi = {10.1109/COMSWA.2008.4554418}, author = {Husna, Husain and Phithakkitnukoon, Santi and Palla, Srikanth and Ram Dantu} } @article {71, title = {Classification of phishers}, journal = {Journal of Homeland Security and Emergency Management}, volume = {5}, year = {2008}, abstract = {

Phishing attackers masquerade as genuine senders and try to steal consumers{\textquoteright} personal identity data and financial account credentials. In spite of aggressive efforts, technology companies have had limited success in restricting phishing attacks. Unfortunately the nature of phishing attacks changed over time from passive, such as password guessing and eavesdropping to active attacks, such as employing Trojans to intercept traffic and adopting social engineering techniques. No matter how many authentication techniques we develop, phishers always adapt. However, phishers cannot become part of the recipient{\textquoteright}s social network without consent. Though they can forge certain fields in an email header, phishers do not have access to the complete header. In this paper, we describe techniques for detecting phishers based on their traffic paths, traffic patterns, and on the receivers{\textquoteright} social network. Considering such issues, we based our solution on the trustworthiness of the relays participating in routing the emails. We examine the email{\textquoteright}s header rather than the content. We designed our classifier to perform the following analyses in four steps: i) DNS-header analysis, ii) Social network analysis, iii) Wantedness analysis, and iv) Proactive classification. We classify phishers into: i) Serial phishers, ii) Recent phishers, iii) Prospective phishers, and iv) Suspects. Finally, our classifier appends an alert level or label to the email{\textquoteright}s "subject" before adding the email to the inbox.

}, keywords = {application security, network security, phishing, spam}, author = {Ram Dantu and Palla, Srikanth and Cangussu, Jo{\~a}o} } @article {274, title = {Spam Classification Based on E-Mail Path Analysis}, journal = {International Journal of Information Security and Privacy (IJISP)}, volume = {2}, year = {2008}, month = {April}, pages = {46-69}, abstract = {

Email spam is the most effective form of online advertising. Unlike telephone marketing, email spamming does not require huge human or financial resources investment. Most existing spam filtering techniques concentrate on the emails{\^a}{\texteuro}{\texttrademark} content. However, most spammers obfuscate their emails{\^a}{\texteuro}{\texttrademark} content to circumvent content-based spam filters. An integrated solution for restricting spam emails is needed as content analyses alone might not provide a solution for filtering unsolicited emails. Here we present a new method for isolating unsolicited emails. Though spammers obfuscate their emails{\^a}{\texteuro}{\texttrademark} content, they do not have access to all the fields in the email header. Our classification method is based on the path an email traverses instead of content. Overall, our classifier produced fewer false positives when compared to current filters such as SpamAssassin. We achieved a precision of 98.65\% which compares well with the precisions achieved by SPF, DNSRBL blacklists.

}, doi = {doi:10.4018/jisp.2008040104}, url = {https://ideas.repec.org/a/igg/jisp00/v2y2008i2p46-69.html}, author = {Palla, Srikanth and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {86, title = {Unwanted SMTP Paths and Relays}, booktitle = {2007 2nd International Conference on Communication Systems Software and Middleware}, year = {2007}, month = {Jan}, abstract = {

Based on the social interactions of an email user, incoming email traffic can be divided into different categories such as, telemarketing, Opt-in family members and friends. Due to a lack of knowledge in the different categories, most of the existing spam filters are prone to high false positives and false negatives. Moreover, a majority of the spammers obfuscate their email content inorder to circumvent the content-based spam filters. However, they do not have access to all the fields in the email header. Our classification method is based on the path traversed by email (instead of content analysis) since we believe that spammers cannot forge all the fields in the email header. We based our classification on three kinds of analyses on the header: i) EndToEnd path analysis, which tries to establish the legitimacy of the path taken by an email and classifies them as either spam or non-spam; ii) Relay analysis, which verifies the trustworthiness of the relays participating in the relaying of emails; iii) Emails wantedness analysis, which measure the recipients wantedness of the senders emails. We use the IMAP message status flags such as, message has been read, deleted, answered, flagged, and draft as an implicit feed back from the user in Emails wantedness analysis. Finally we classify the incoming emails as i) socially close (such as, legitimate emails from family, and friends), ii) socially distinct emails from strangers, iii) spam emails (for example, emails from telemarketers, and spammers) and iv) opt-in emails. Based on the relation between spamminess of the path taken by spam emails and the unwantedness values of the spammers, we classify spammers as i) prospective spammers, ii) suspects, iii) recent spammers and iv) serial spammers. Overall, our method resulted in far less false positives compared to current filters like SpamAssassin. We achieved a precision of 98.65\% which is better than the precisions achieved by SPF and DNSBL blacklists.

}, keywords = {Computer science, content-based spam filters, Counterfeiting, Credit cards, email spam filters, emails wantedness analysis, end-to-end path analysis, Filters, IMAP message status flags, information filtering, information filters, Information security, Legislation, Multimedia communication, relay analysis, Relays, SMTP paths analysis, unsolicited e-mail, Unsolicited electronic mail, Web page design}, doi = {10.1109/COMSWA.2007.382440}, author = {Palla, Srikanth and Ram Dantu} } @conference {239, title = {Detecting phishing in emails}, booktitle = {Proceedings of MIT Spam Conference}, year = {2006}, author = {Palla, Srikanth and Ram Dantu} }