NDLI: Behavior-based modeling and its application to Email analysis

Please wait, while we are loading the content...

Behavior-based modeling and its application to Email analysis

Content Provider	ACM Digital Library
Author	Li, Wei-Jen Hu, Chia-Wei Wang, Ke Stolfo, Salvatore J. Hershkop, Shlomo Nimeskern, Olivier
Copyright Year	2006
Abstract	The Email Mining Toolkit (EMT) is a data mining system that computes behavior profiles or models of user email accounts. These models may be used for a multitude of tasks including forensic analyses and detection tasks of value to law enforcement and intelligence agencies, as well for as other typical tasks such as virus and spam detection. To demonstrate the power of the methods, we focus on the application of these models to detect the early onset of a viral propagation without “content-base ” (or signature-based) analysis in common use in virus scanners. We present several experiments using real email from 15 users with injected simulated viral emails and describe how the combination of different behavior models improves overall detection rates. The performance results vary depending upon parameter settings, approaching 99 % true positive (TP) (percentage of viral emails caught) in general cases and with 0.38 % false positive (FP) (percentage of emails with attachments that are mislabeled as viral). The models used for this study are based upon volume and velocity statistics of a user's email rate and an analysis of the user's (social) $\textit{cliques}$ revealed in the person's email behavior. We show by way of simulation that virus propagations are detectable since viruses may emit emails at rates different than human behavior suggests is normal, and email is directed to groups of recipients in ways that violate the users' typical communications with their social groups.
Starting Page	187
Ending Page	221
Page Count	35
File Format	PDF
ISSN	15335399
e-ISSN	15576051
DOI	10.1145/1149121.1149125
Volume Number	6
Issue Number	2
Journal	ACM Transactions on Internet Technology (TOIT)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2006-05-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Email virus propagations Anomaly detection Behavior profiling
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Internet traffic behavior profiling for network security monitoring

Statistical anomaly detection with sensor networks

Challenging Entropy-based Anomaly Detection and Diagnosis in Cellular Networks

Behavior-based modeling and its application to email analysis (1998)

Group behavior time series anomaly detection in specific network space based on separation degree

Wireless Anomaly Detection Based on IEEE 802.11 Behavior Analysis

Spatiotemporal Models for Data-Anomaly Detection in Dynamic Environmental Monitoring Campaigns

Seeing the invisible:forensic uses of anomaly detection and machine learning

Traffic anomaly detection based on image descriptor in videos

Behavior-based modeling and its application to Email analysis

Similar Documents

Internet traffic behavior profiling for network security monitoring

Statistical anomaly detection with sensor networks

Challenging Entropy-based Anomaly Detection and Diagnosis in Cellular Networks

Behavior-based modeling and its application to email analysis (1998)

Group behavior time series anomaly detection in specific network space based on separation degree

Wireless Anomaly Detection Based on IEEE 802.11 Behavior Analysis

Spatiotemporal Models for Data-Anomaly Detection in Dynamic Environmental Monitoring Campaigns

Seeing the invisible:forensic uses of anomaly detection and machine learning

Traffic anomaly detection based on image descriptor in videos

Behavior-based modeling and its application to Email analysis