Loading...
Please wait, while we are loading the content...
Spam or ham? characterizing and detecting fraudulent “not spam ” reports in web mail systems.
| Content Provider | CiteSeerX |
|---|---|
| Author | Ramach, Anirudh Dasgupta, Anirban Feamster, Nick Weinberger, Kilian |
| Abstract | Web mail providers rely on users to “vote ” to quickly and collaboratively identify spam messages. Unfortunately, spammers have begun to use bots to control large collections of compromised Web mail accounts not just to send spam, but also to vote “not spam ” on incoming spam emails in an attempt to thwart collaborative filtering. We call this practice a vote gaming attack. This attack confuses spam filters, since it causes spam messages to be mislabeled as legitimate; thus, spammer IP addresses can continue sending spam for longer. In this paper, we introduce the vote gaming attack and study the extent of these attacks in practice, using four months of email voting data from a large Web mail provider. We develop a model for vote gaming attacks, explain why existing detection mechanisms cannot detect them, and develop a new, scalable clustering-based detection method that identifies compromised accounts that engage in vote-gaming attacks. Our method detected 1.1 million potentially compromised accounts with only a 0.17 % false positive rate, which is nearly 10 times more effective than existing clustering methods used to detect bots that send spam from compromised Web mail accounts. 1. |
| File Format | |
| Access Restriction | Open |
| Subject Keyword | Detecting Fraudulent Web Mail System Spam Report Spam Message Compromised Web Mail Account Web Mail Account Large Collection Collaborative Filtering Web Mail Provider Spam Email False Positive Rate Spam Filter Email Voting Data Ip Address Scalable Clustering-based Detection Method Large Web Mail Provider Compromised Account Vote-gaming Attack Detection Mechanism |
| Content Type | Text |
