Θεωρητική και πειραματική μελέτη μεθόδων ταξινόμησης μηνυμάτων ηλεκτρονικού ταχυδρομείου σε Spam και Legitimate με σκοπό την βελτιστοποίηση της ακρίβειας ταξινόμησης και την επιλογή των κατάλληλων παραμέτρων για σχεδιασμό ενός φίλτρου με ικανοποιητική απόδοση στην φραγή κακόβουλων μηνυμάτων / Theoretical and experimental study of methods blocking Spam E-mails with the purpose of improving the parameters of a spam blocking filter.

Crowdsourcing systems - like Ushahidi (for crisis mapping), Foldit (for protein folding) and Duolingo (for foreign language learning and translation) - have shown the effectiveness of intelligently organizing large numbers of people to solve traditionally vexing problems. Unfortunately, new crowdsourcing platforms are emerging to support the coordinated dissemination of spam, misinformation, and propaganda. These “crowdturfing” systems are a sinister counterpart to the enormous positive opportunities of crowdsourcing; they combine the organizational capabilities of crowdsourcing with the ability to widely spread artificial grass root support (so called “astroturfing”). This thesis begins a study of crowdturfing that targets social media and proposes a framework for “pulling back the curtain” on crowdturfers to reveal their underlying ecosystem. Concretely, this thesis (i) analyzes the types of campaigns hosted on multiple crowdsourcing sites; (ii) links campaigns and their workers on crowdsourcing sites to social media; (iii) analyzes the relationship structure connecting these workers, their profile, activity, and linguistic characteristics, in comparison with a random sample of regular social media users; and (iv) proposes and develops statistical user models to automatically identify crowdturfers in social media. Since many crowdturfing campaigns are hidden, it is important to understand the potential of learning models from known campaigns to detect these unknown campaigns. Our experimental results show that the statistical user models built can predict crowdturfers with very high accuracy.

Web crawlers encounter both finite and infinite elements during crawl. Pages and hosts can be infinitely generated using automated scripts and DNS wildcard entries. It is a challenge to rank such resources as an entire web of pages and hosts could be created to manipulate the rank of a target resource. It is crucial to be able to differentiate genuine content from spam in real-time to allocate crawl budgets. In this study, ranking algorithms to rank hosts are designed which use the finite Pay Level Domains(PLD) and IPv4 addresses. Heterogenous graphs derived from the webgraph of IRLbot are used to achieve this. PLD Supporters (PSUPP) which is the number of level-2 PLD supporters for each host on the host-host-PLD graph is the first algorithm that is studied. This is further improved by True PLD Supporters(TSUPP) which uses true egalitarian level-2 PLD supporters on the host-IP-PLD graph and DNS blacklists. It was found that support from content farms and stolen links could be eliminated by finding TSUPP. When TSUPP was applied on the host graph of IRLbot, there was less than 1% spam in the top 100,000 hosts.

Spam, the distribution of unsolicited bulk email, is a big security threat on the Internet. Recent studies show approximately 70-90% of the worldwide email traffic—about 70 billion messages a day—is spam. Spam consumes resources on the network and at mail servers, and it is also used to launch other attacks on users, such as distributing malware or phishing. Spammers have increased their virulence and resilience by sending spam from large collections of compromised machines (“botnets”). Spammers also make heavy use of URLs and domains to direct victims to point-of-sale Web sites, and miscreants register large number of domains to evade blacklisting efforts. To mitigate the threat of spam, users and network administrators need proactive techniques to distinguish spammers from legitimate senders and to take down online spam-advertised sites. In this dissertation, we focus on characterizing spam-related activities and developing systems to detect them early. Our work builds on the observation that spammers need to acquire attack agility to be profitable, which presents differences in how spammers and legitimate users interact with Internet services and exposes detectable during early period of attack. We examine several important components across the spam life cycle, including spam dissemination that aims to reach users' inboxes, the hosting process during which spammers set DNS servers and Web servers, and the naming process to acquire domain names via registration services. We first develop a new spam-detection system based on network-level features of spamming bots. These lightweight features allow the system to scale better and to be more robust. Next, we analyze DNS resource records and lookups from top-level domain servers during the initial stage after domain registrations, which provides a global view across the Internet to characterize spam hosting infrastructure. We further examine the domain registration process and present the unique registration behavior of spammers. Finally, we build an early-warning system to identify spammer domains at time-of-registration rather than later at time-of-use. We have demonstrated that our detection systems are effective by using real-world datasets. Our work has also had practical impact. Some of the network-level features that we identified have since been incorporated into spam filtering products at Yahoo! and McAfee, and our work on detecting spammer domains at time-of-registration has directly influenced new projects at Verisign to investigate domain registrations.

Zugl.: Braunschweig, Techn. University, Diplomarbeit, 2003.

Zugl.: Sooden-Allendorf, Fachhochsch. Nordhessen, Diplomarbeit, 2006.

Made available in DSpace on 2014-06-12T16:00:10Z (GMT). No. of bitstreams: 2 arquivo6087_1.pdf: 1872863 bytes, checksum: 5421c048c3358bc43e4f5ae9a04428fc (MD5) license.txt: 1748 bytes, checksum: 8a4605be74aa9ea9d79846c1fba20a33 (MD5) Previous issue date: 2011 / Spam é o termo usado para referir-se aos e-mails não solicitados, que geralmente são enviados para um grande número de pessoas, e é hoje considerado um dos maiores problemas enfrentados na Internet. Com o aumento da disponibilização de banda larga, popularização de tecnologias de internet e o aumento da utilização e disponibilização de soluções baseadas em VoIP (Voice over IP), é esperado que um problema semelhante passe a afetar esta nova área. Esta ameaça é conhecida por SPIT (SPAM over Internet Telephony) e é definida como geração automatizada de chamadas não solicitadas utilizando como transporte o IP através do VoIP ao invés das tradicionais linhas telefônicas. O potencial do SPIT em reduzir a produtividade é muito maior do que a do SPAM, porque no SPIT a utilização de tempo de uma pessoa já é contabilizada a partir do momento em que o telefone começa a tocar. Podemos acrescentar que o SPIT não consiste apenas no incômodo a um usuário, quando aplicado contra uma rede, pois pode consumir seus recursos dificultando ou ainda inviabilizar a utilização dos recursos da rede. As características do SPIT são diferentes do SPAM, portanto não podemos aplicar as mesmas técnicas usadas no SPAM em ataques do tipo SPIT. Propomos neste trabalho uma ferramenta para identificar e proteger uma rede VoIP contra ataques de SPIT. Como visto em outros tipos de ameaças a redes de dados, a utilização de um único método não é suficiente para garantir a proteção e identificação dos ataques. Portanto, na nossa abordagem, a ferramenta desenvolvida faz uso de Testes Reversos de Turing formatados em um CAPTCHA no formato de uma mensagem de áudio, com o objetivo de identificar se a chamada é ou não um SPIT. Essa técnica é aplicada em conjunto com outras técnicas descritas ao longo do texto. Desta forma, é composta uma ferramenta de prevenção e identificação com a finalidade de garantir uma melhor proteção contra ataques de SPIT, em redes baseadas em VoIP

Diplomová práce se zabývá nevyžádanými e-mailovými dopisy neboli spamem. V práci jsou popsány základy komunikace využívané u elektronické pošty a de?nice spamu. V práci jsou shrnuty druhy spamů a možnosti, jak se nevyžádaným zpravám bránit, a to jak na straně odesílatele, tak na straně příjemce. Naznačeny jsou také postupy, jakými lze tyto obrany obejít. V praktické části je pak ukázáno, jak lze postupy pro obelstění antispamových ?ltrů využít.

Twitter generates the majority of its revenue from advertising. Third parties pay to have their products advertised on Twitter through: tweets, accounts and trends. However, spammers can use Sybil accounts (fake accounts) [21] to advertise and avoid paying for it. Sybil accounts are highly active on Twitter performing advertising campaigns to serve their clients [5]. They aggressively try to reach a large audience to maximize their influence. These accounts have similar behavior if controlled by the same master. Most of their spam tweets include a shortened URL to trick users into clicking on it. Also, since they share resources with each other, they tend to tweet similar trending topics to attract a larger audience. However, some Sybil accounts do not spam aggressively to avoid being detected [22], rendering it difficult for traditional spam detectors to be effective in detecting low spamming Sybil accounts. In this paper, I investigate additional criteria to measure the similarity between accounts on Twitter. I propose an algorithm to define the correlation among accounts by investigating their tweeting habits and content. Given known labeled accounts by spam detectors, this approach can detect hidden accounts that are closely related to labeled accounts but are not detected by traditional spam detection approaches.

Email spam has steadily grown and has become a major problem for users, email service providers, and many other organizations. Many adversarial methods have been proposed to combat spam and various studies have been made on the evolution of email spam, by finding evolution patterns and trends based on historical spam data and by incorporating spam filters. In this thesis, we try to understand the evolution of email spam and how we can build better classifiers that will remain effective against adaptive adversaries like spammers. We compare various methods for analyzing the evolution of spam emails by incorporating spam filters along with a spam dataset. We explore the trends based on the weights of the features learned by the classifiers and the accuracies of the classifiers trained and tested in different settings. We also evaluate the effectiveness of the classifier trained in adversarial settings on synthetic data.