@conference {17, title = {Behavior analysis of spam botnets}, booktitle = {2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE {\textquoteright}08)}, year = {2008}, abstract = {

Compromised computers, known as bots, are the major source of spamming and their detection helps greatly improve control of unwanted traffic. In this work we investigate the behavior patterns of spammers based on their underlying similarities in spamming. To our knowledge, no work has been reported on identifying spam botnets based on spammerspsila temporal characteristics. Our study shows that the relationship among spammers demonstrates highly clustering structures based on features such as content length, time of arrival, frequency of email, active time, inter-arrival time, and content type. Although the dimensions of the collected feature set is low, we perform principal component analysis (PCA) on feature set to identify the features which account for the maximum variance in the spamming patterns. Further, we calculate the proximity between different spammers and classify them into various groups. Each group represents similar proximity. Spammers in the same group inherit similar patterns of spamming a domain. For classification into Botnet groups, we use clustering algorithms such as Hierarchical and K-means.We identify Botnet spammers into a particular group with a precision of 90\%.

}, keywords = {behavior pattern analysis, Botnets, Classification algorithms, clustering algorithm, Clustering algorithms, Correlation, Electronic mail, feature set, Filtering, information filtering, invasive software, maximum variance, pattern classification, pattern clustering, PCA, principal component analysis, spam filtering, Time frequency analysis, unsolicited e-mail, unwanted traffic control}, doi = {10.1109/COMSWA.2008.4554418}, author = {Husna, Husain and Phithakkitnukoon, Santi and Palla, Srikanth and Ram Dantu} } @conference {99, title = {Call Algebra}, booktitle = {2008 5th IEEE Consumer Communications and Networking Conference}, year = {2008}, month = {Jan}, abstract = {

In every day life, people communicate through a voice(e.g., VoIP) network with different social groups that range from known people such as family members, friends, and distant relatives to unknown people such as spammers, telemarketers, and phishers. We believe that there exists a human/social dynamics between individuals by the way calls are generated, handled and received. In this paper we present how this dynamics can be used for detecting and filtering unwanted calls. In this paper, we first enumerate the communication patterns between the called party (callee) and the calling parties (callers). Next, we discuss operations on caller-callee matrices constructed based on their communication patterns, and derive call-constructs that can be used for determining the legitimacy of the calls and the callers. Finally, we discuss how these communication patterns and operations can be grouped for solutions to few of the existing IP telephony problems. These solutions can complement the existing no-call-lists in voice networks.

}, keywords = {Algebra, call algebra, caller-callee matrices, communication pattern, Computer science, Context modeling, Filtering, Humans, Internet telephony, IP networks, IP telephony problem, matrix algebra, Mood, Peer to peer computing, social aspects of automation, social group, Social network services, voice-over-IP, VoIP network}, doi = {10.1109/ccnc08.2007.199}, author = {Kolan, Prakash and Ram Dantu} } @conference {58, title = {Automatic Calibration Using Receiver Operating Characteristics Curves}, booktitle = {2007 2nd International Conference on Communication Systems Software and Middleware}, year = {2007}, month = {Jan}, abstract = {

Application-level filters, such as e-mail and VoIP spam filters, that analyze dynamic behavior changes are replacing static signature-recognition filters. These application-level filters learn behavior and use that knowledge to filter unwanted requests. Because behavior of a service request{\textquoteright}s participating entities changes rapidly, filters must adapt quickly by using end user{\textquoteright}s preferences about receiving that service request message. Many adaptive filters learn from the participating entities{\textquoteright} behavior; however, none configure themselves automatically to an end user{\textquoteright}s changing tolerance levels. Also, filter administrators cannot manually change the threshold for each service request in real time. Traditional adaptive filters fail when administrators must optimize multiple filter thresholds manually and often. Thus, to improve a filter{\textquoteright}s learning, we must automate its threshold-update process. We propose an automatic threshold-calibration mechanism using Receiver Operating Characteristics (ROC) curves that updates the threshold based on an end user{\textquoteright}s feedback. To demonstrate the mechanism{\textquoteright}s real-time applicability, we integrated it in a Voice over IP (VoIP) spam filter that analyzes incoming Spam over IP Telephony (SPIT) calls. Using this mechanism, we observed good improvement in the VoIP spam filter{\textquoteright}s accuracy. Further, computing and updating the optimum threshold in realtime does not impede the filter{\textquoteright}s temporal performance because we update thresholds after each call{\textquoteright}s completion. Because we reach an optimum threshold for any initial setting, this mechanism works efficiently when we cannot predict end-user behavior. Furthermore, automatic calibration proves efficient when using multiple threshold values.

}, keywords = {adaptive filters, application-level filter learning, automatic threshold-calibration mechanism, behavior, calibration, Computer science, Computer worms, Electronic mail, end user feedback, Filtering, information filtering, information filters, Internet telephony, learning (artificial intelligence), Protocols, receiver operating characteristics curves, sensitivity analysis, service request message, telecommunication traffic, Threshold, tolerance, Viruses (medical)}, doi = {10.1109/COMSWA.2007.382484}, author = {Kolan, Prakash and Vaithilingam, Ram and Ram Dantu} }