Flow-level spam modelling using separate data sources

Spam detection based on flow-level statistics is a new approach in anti-spam techniques. The approach reduces number of collected data but still can obtain relative good results in a spam detection task. The main problems in the approach are selection of flow-level features that describe spam and detection of discrimination rules. In this work, flow-level model of spam is presented. The model describes spam subclasses and brings information about major features of a spam detection task. The model is the base for decision trees that detect spam. The analysis of detectors, which was learned from data collected from different mail servers, results in the universal spam description consists of the most significant features. Flows described by selected features and collected on Broadband Remote Access Server were analysed by an ensemble of created classifiers. The ensemble detected major sources of spam among senders IP addresses.

I. Introduction

RAPID development of the Internet and associated services induced growth of the desired bandwidth for their execution. Customers expect their Internet Service Providers (IS) to provide a flexible, fully secured access to the Internet. Requirements related to privacy and confidentiality increasingly important. The political environment inside European Union is discussing adjustment of law regulations to market needs. ISPs have to consider Quality of Service (QoS), security, Service Level Agreement (SLA) among others committed to privacy guarantee. This is one of the reasons for development of methods used for monitoring and analysis of traffic in the ISP's core network.