Sven Krasser

Support Vector Machines and Random Forests Modeling for Spam Senders Behavior Analysis

Unwanted and malicious messages dominate email traffic and pose a great threat to the utility of email communications. Reputation systems have been getting momentum as the solution. Such systems extract email senders behavior data based on global sending distribution, analyze them and assign a value of trust to each IP address sending email messages. We build two models for the classification purpose. One is based on support vector machines (SVM) and the other is random forests(RF). Experimental results show that either classifier is effective. RF is slightly more accurate, but more expensive in terms of both time and space. SVM produces similar accuracy in a much faster manner if given modeling parameters. These classifiers can contribute to a reputation system as one source of analysis and increase its accuracy.

Fast and Effective Spam Sender Detection with Granular SVM on Highly Imbalanced Mail Server Behavior Data

Unsolicited commercial or bulk emails or emails containing virus currently pose a great threat to the utility of email communications. A recent solution for filtering is reputation systems that can assign a value of trust to each IP address sending email messages. By analyzing the query patterns of each participating node, reputation systems can calculate a reputation score for each queried IP address and serve as a platform for global collaborative spam filtering for all participating nodes. In this research, we explore a behavioral classification approach based on spectral sender characteristics retrieved from such global messaging patterns. Due to the large amount of bad senders, this classification task has to cope with highly imbalanced data. In order to solve this challenging problem, a novel granular support vector machine - boundary alignment algorithm (GSVM-BA) is designed. GSVM-BA looks for the optima] decision boundary by repetitively removing positive support vectors from the training dataset and rebuilding another SVM. Compared to the original SVM algorithm with cost-sensitive learning, GSVM-BA demonstrates superior performance on spam IP detection, in terms of both effectiveness and efficiency