Spammers are continually looking to circumvent counter-measures seeking to slow them down. An immense amount of time and money is currently devoted to hiding spam, but not enough is devoted to effectively preventing it. One approach for preventing spam is to force the spammer's machine to solve a computational problem of varying difficulty before granting access. The idea is that suspicious or problematic requests are given difficult problems to solve while legitimate requests are allowed through with minimal computation. Unfortunately, most systems that employ this model waste the computing resources being used, as they are directed towards solving cryptographic problems that provide no societal benefit. While systems such as reCAPTCHA and FoldIt have allowed users to contribute solutions to useful problems interactively, an analogous solution for non-interactive proof-of-work does not exist. Towards this end, this paper describes MetaCAPTCHA and reBOINC, an infrastructure for supporting useful proof-of-work that is integrated into a web spam throttling service. The infrastructure dynamically issues CAPTCHAs and proof-of-work puzzles while ensuring that malicious users solve challenging puzzles. Additionally, it provides a framework that enables the computational resources of spammers to be redirected towards meaningful research. To validate the efficacy of our approach, prototype implementations based on OpenCV and BOINC are described that demonstrate the ability to harvest spammer's resources for beneficial purposes.

Universiẗat, Diss.--Freiburg. i. Br., 2005. / Literaturverz. S. 274 - 285.

Thesis (doctoral)--Albert-Ludwigs-Universität Freiburg im Breisgau, 2007. / Includes bibliographical references (p. 271-284).

Submitted by Milena Rubi (milenarubi@ufscar.br) on 2017-10-03T19:06:58Z No. of bitstreams: 1 ALBERTO_Tulio_2017.pdf: 2422402 bytes, checksum: 127bff2089f3d274b1abaa58c3d32578 (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2017-10-03T19:07:11Z (GMT) No. of bitstreams: 1 ALBERTO_Tulio_2017.pdf: 2422402 bytes, checksum: 127bff2089f3d274b1abaa58c3d32578 (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2017-10-03T19:07:27Z (GMT) No. of bitstreams: 1 ALBERTO_Tulio_2017.pdf: 2422402 bytes, checksum: 127bff2089f3d274b1abaa58c3d32578 (MD5) / Made available in DSpace on 2017-10-03T19:07:37Z (GMT). No. of bitstreams: 1 ALBERTO_Tulio_2017.pdf: 2422402 bytes, checksum: 127bff2089f3d274b1abaa58c3d32578 (MD5) Previous issue date: 2017-02-03 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES) / YouTube has become an important video sharing platform. Several users regularly produce video content and make this task their main livelihood. However, such success is also drawing the attention of malicious users propagating undesired comments and videos, looking for self-promotion or disseminating malicious links which may have malwares and viruses. Since YouTube offers limited tools for blocking spam, the volume of such messages is shockingly increasing and harming users and channels owners. In addition to the problem being naturally online, comment spam filtering on YouTube is different than the traditional email spam filtering, since the messages are very short and often rife with spelling errors, slangs, symbols and abbreviations. This manuscript presents a performance evaluation of traditional online classification methods, aided by lexical normalization and semantic indexing techniques when applied to automatic filter YouTube comment spam. It was also evaluated the performance of MDLText, a promising text classification method based on the minimum description length principle. The statistical analysis of the results indicates that MDLText, Passive-Aggressive, Naïve Bayes, MDL and Online Gradient Descent obtained statistically equivalent performances. The results also indicate that the lexical normalization and semantic indexing techniques are effective to be applied to the problem. Based on the results, it is proposed and designed TubeSpam, an online tool to automatic filter undesired comments posted on YouTube. / O YouTube tem se tornado uma importante plataforma de compartilhamento de vídeos. Muitos usuários produzem regularmente conteúdo em vídeo e fazem desta tarefa seu principal meio de vida. Contudo, esse sucesso também vem despertando a atenção de usuários mal-intencionados, que propagam comentários e vídeos indesejados para se autopromoverem ou para disseminar links maliciosos que podem conter vírus e malwares. Visto que o YouTube atualmente oferece recursos limitados para bloquear spam, o volume dessas mensagens está impactando muitos usuários e proprietários de canais. Além da característica inerentemente online do problema, filtrar spam nos comentários do YouTube é uma tarefa que difere-se da tradicional filtragem de spam em emails, pois as mensagens costumam ser muito mais curtas e repletas de erros de digitação, gírias, símbolos e abreviações que podem dificultar a tarefa de classificação. Assim, nesta dissertação é apresentada a avaliação de desempenho obtido por métodos tradicionais de classificação online auxiliados por técnicas de normalização léxica e indexação semântica, quando aplicados na filtragem automática de comentários indesejados postados no YouTube. Foi avaliado também o desempenho do MDLText, um promissor método de classificação de texto baseado no princípio da descrição mais simples. A análise estatística dos resultados indica que os métodos MDLText, Passivo-Agressivo, Naïve Bayes, MDL e Gradiente Descendente Online obtiveram desempenhos equivalentes. Além disso, os resultados também indicam que o uso de técnicas de normalização léxica e indexação semântica são eficazes para atenuar os problemas de representação de texto e, consequentemente, aumentar o poder de predição dos métodos de classificação. Baseado nos resultados dos experimentos, foi proposto e desenvolvido o TubeSpam, uma ferramenta online para filtrar automaticamente comentários indesejados postados no YouTube.

Networks of maliciously compromised computers, known as botnets, consisting of thousands of hosts have emerged as a serious threat to Internet security in recent years. These compromised systems, under the control of an operator are used to steal data, distribute malware and spam, launch phishing attacks and in Distributed Denial-of-Service (DDoS) attacks. The operators of these botnets use Command and Control (C2) servers to communicate with the members of the botnet and send commands. The communications channels between the C2 nodes and endpoints have employed numerous detection avoidance mechanisms to prevent the shutdown of the C2 servers. Two prevalent detection avoidance techniques used by current botnets are algorithmically generated domain names and DNS Fast-Flux. The use of these mechanisms can however be observed and used to create distinct signatures that in turn can be used to detect DNS domains being used for C2 operation. This report details research conducted into the implementation of three classes of classification techniques that exploit these signatures in order to accurately detect botnet traffic. The techniques described make use of the traffic from DNS query responses created when members of a botnet try to contact the C2 servers. Traffic observation and categorisation is passive from the perspective of the communicating nodes. The first set of classifiers explored employ frequency analysis to detect the algorithmically generated domain names used by botnets. These were found to have a high degree of accuracy with a low false positive rate. The characteristics of Fast-Flux domains are used in the second set of classifiers. It is shown that using these characteristics Fast-Flux domains can be accurately identified and differentiated from legitimate domains (such as Content Distribution Networks exhibit similar behaviour). The final set of classifiers use spatial autocorrelation to detect Fast-Flux domains based on the geographic distribution of the botnet C2 servers to which the detected domains resolve. It is shown that botnet C2 servers can be detected solely based on their geographic location. This technique is shown to clearly distinguish between malicious and legitimate domains. The implemented classifiers are lightweight and use existing network traffic to detect botnets and thus do not require major architectural changes to the network. The performance impact of implementing classification of DNS traffic is examined and it is shown that the performance impact is at an acceptable level.

Submitted by Milena Rubi (milenarubi@ufscar.br) on 2017-10-09T17:30:32Z No. of bitstreams: 1 CARDOSO_Emerson_2017.pdf: 3299853 bytes, checksum: bda5605a1fb8e64f503215e839d2a9a6 (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2017-10-09T17:30:45Z (GMT) No. of bitstreams: 1 CARDOSO_Emerson_2017.pdf: 3299853 bytes, checksum: bda5605a1fb8e64f503215e839d2a9a6 (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2017-10-09T17:32:37Z (GMT) No. of bitstreams: 1 CARDOSO_Emerson_2017.pdf: 3299853 bytes, checksum: bda5605a1fb8e64f503215e839d2a9a6 (MD5) / Made available in DSpace on 2017-10-09T17:32:49Z (GMT). No. of bitstreams: 1 CARDOSO_Emerson_2017.pdf: 3299853 bytes, checksum: bda5605a1fb8e64f503215e839d2a9a6 (MD5) Previous issue date: 2017-08-04 / Não recebi financiamento / Before buying a product or choosing for a trip destination, people often seek other people’s opinions to obtain a vision of the quality of what they want to acquire. Given that, opinions always had great influence on the purchase decision. Following the enhancements of the Internet and a huge increase in the volume of data traffic, social networks were created to help users post and view all kinds of information, and this caused people to also search for opinions on the Web. Sites like TripAdvisor and Yelp make it easier to share online reviews, since they help users to post their opinions from anywhere via smartphones and enable product manufacturers to gain relevant feedback quickly in a centralized way. As a result, most people nowadays trust personal recommendations as much as online reviews. However, competition between service providers and product manufacturers have also increased in social media, leading to the first cases of spam reviews: deceptive opinions published by hired people that try to promote or defame products or businesses. These reviews are carefully written in order to look like authentic ones, making it difficult to be detected by humans or automatic methods. Thus, they are used, in a misleading way, in attempt to control the general opinion, causing financial harm to business owners and users. Several approaches have been proposed for spam review detection and most of them use techniques involving machine learning and natural language processing. However, despite all progress made, there are still relevant questions that remain open, which require a criterious analysis in order to be properly answered. For instance, there is no consensus whether the performance of traditional classification methods can be affected by incremental learning or changes in reviews’ features over time; also, there is no consensus whether there is statistical difference between performances of content-based classification methods. In this scenario, this work offers a comprehensive comparison between traditional machine learning methods applied in spam review detection. This comparison is made in multiple setups, employing different types of learning and data sets. The experiments performed along with statistical analysis of the results corroborate offering appropriate answers to the existing questions. In addition, all results obtained can be used as baseline for future comparisons. / Antes de comprar um produto ou escolher um destino de viagem, muitas pessoas costumam buscar por opiniões alheias para obter uma visão da qualidade daquilo que se deseja adquirir. Assim, as opiniões sempre exerceram grande influência na decisão de compra. Com o avanço da Internet e aumento no volume de informações trafegadas, surgiram redes sociais que possibilitam compartilhar e visualizar informações de todo o tipo, fazendo com que pessoas passassem a buscar também por opiniões na Web. Atualmente, sites especializados, como TripAdvisor e Yelp, oferecem um sistema de compartilhamento de opiniões online (reviews) de maneira fácil, pois possibilitam que usuários publiquem suas opiniões de qualquer lugar através de smartphones, assim como também permitem que fabricantes de produtos e prestadores de serviços obtenham feedbacks relevantes de maneira centralizada e rápida. Em virtude disso, estudos indicam que atualmente a maioria dos usuários confia tanto em recomendações pessoais quanto em reviews online. No entanto, a competição entre prestadores de serviços e fabricantes de produtos também aumentou nas redes sociais, o que levou aos primeiros casos de spam reviews: opiniões enganosas publicadas por pessoas contratadas que tentam promover ou difamar produtos ou serviços. Esses reviews são escritos cuidadosamente para parecerem autênticos, o que dificulta sua detecção por humanos ou por métodos automáticos. Assim, eles são usados para tentar, de maneira enganosa, controlar a opinião geral, podendo causar prejuízos para empresas e usuários. Diversas abordagens para a detecção de spam reviews vêm sendo propostas, sendo que a grande maioria emprega técnicas de aprendizado de máquina e processamento de linguagem natural. No entanto, apesar dos avanços já realizados, ainda há questionamentos relevantes que permanecem em aberto e demandam uma análise criteriosa para serem respondidos. Por exemplo, não há um consenso se o desempenho de métodos tradicionais de classificação pode ser afetado em cenários que demandam aprendizado incremental ou por mudanças nas características dos reviews devido ao fator cronológico, assim como também não há um consenso se existe diferença estatística entre os desempenhos dos métodos baseados no conteúdo das mensagens. Neste cenário, esta dissertação oferece uma análise e comparação compreensiva dos métodos tradicionais de aprendizado de máquina, aplicados na detecção de spam reviews. A comparação é realizada em múltiplos cenários, empregando-se diferentes tipos de aprendizado e bases de dados. Os experimentos realizados, juntamente com análise estatística dos resultados, corroboram a oferecer respostas adequadas para os questionamentos existentes. Além disso, os resultados obtidos podem ser usados como baseline para comparações futuras.

In the context of the Internet, spam generally refers to unsolicited and unwanted electronic messages, usually transmitted to a large number of recipients. The problem with spam is that almost all of the related costs are shifted onto the recipients, and many of the messages contain objectionable content. Spam has become a significant problem for network administrators, businesses and individual Internet users that threatens to undermine the usefulness of e-mail. Globally, spam spiralled to account for over 60% of all e-mail near the end of 2004. It is a problem that costs the global economy billions of dollars a year in lost productivity, anti-spam measures and computer resources. It has forced governments to enact legislation against the problem and it has prompted the development of numerous technical countermeasures. Spam can only be defeated by a combination of legal measures, informal measures (including self regulation and social norms), technical measures and consumer education. Because spam is a relatively recent and evolving problem, the application of various common law mechanisms are explored, including the law of privacy and the law of nuisance. Various constitutional concerns may also arise in the context of spam, and the right to freedom of expression must be balanced against other competing rights and values, including the right to privacy. Comparative legislation is examined, because it is important to recognise trends in spam legislation in other jurisdictions so as to ensure a measure of interoperability with those laws. The practical difficulties in identifying spammers, and the lack of jurisdiction over offshore offenders affect the practical implementation of the current protection offered by the ECT Act. In conclusion, this thesis identifies the need for direct anti-spam legislation in South Africa, and suggests various clauses that will need to be catered for in the legislation. It is submitted that "opt-in" legislation should be preferred over "opt-out" legislation. It is further submitted that a definition of spam should be based on the volume and indiscriminate nature of the e-mail, and not only on whether the communication was commercial. Therefore, a definition of bulk unsolicited e-mail is proposed. / Criminal & Procedural Law / LLD

In the context of the Internet, spam generally refers to unsolicited and unwanted electronic messages, usually transmitted to a large number of recipients. The problem with spam is that almost all of the related costs are shifted onto the recipients, and many of the messages contain objectionable content. Spam has become a significant problem for network administrators, businesses and individual Internet users that threatens to undermine the usefulness of e-mail. Globally, spam spiralled to account for over 60% of all e-mail near the end of 2004. It is a problem that costs the global economy billions of dollars a year in lost productivity, anti-spam measures and computer resources. It has forced governments to enact legislation against the problem and it has prompted the development of numerous technical countermeasures. Spam can only be defeated by a combination of legal measures, informal measures (including self regulation and social norms), technical measures and consumer education. Because spam is a relatively recent and evolving problem, the application of various common law mechanisms are explored, including the law of privacy and the law of nuisance. Various constitutional concerns may also arise in the context of spam, and the right to freedom of expression must be balanced against other competing rights and values, including the right to privacy. Comparative legislation is examined, because it is important to recognise trends in spam legislation in other jurisdictions so as to ensure a measure of interoperability with those laws. The practical difficulties in identifying spammers, and the lack of jurisdiction over offshore offenders affect the practical implementation of the current protection offered by the ECT Act. In conclusion, this thesis identifies the need for direct anti-spam legislation in South Africa, and suggests various clauses that will need to be catered for in the legislation. It is submitted that "opt-in" legislation should be preferred over "opt-out" legislation. It is further submitted that a definition of spam should be based on the volume and indiscriminate nature of the e-mail, and not only on whether the communication was commercial. Therefore, a definition of bulk unsolicited e-mail is proposed. / Criminal and Procedural Law / LLD

The practice of spamming (sending unsolicited electronic communications) has been dubbed “the scourge of the 21st century” affecting different stakeholders. This practice is also credited for not only disrupting electronic communications but also, it overloads electronic systems and creates unnecessary costs for those affected than the ones responsible for sending such communications. In trying to address this issue nations have implemented anti-spam laws to combat the scourge. South Africa not lagging behind, has put in place anti-spam provisions to deal with the scourge. The anti-spam provisions are scattered in pieces of legislation dealing with diverse issues including: consumer protection; direct marketing; credit laws; and electronic transactions and communications. In addition to these provisions, an Amendment Bill to one of these laws and two Bills covering cybercrimes and cyber-security issues have been published. In this thesis, a question is asked on whether the current fragmented anti-spam provisions are adequate in protecting consumers. Whether the overlaps between these pieces of legislation are competent to deal with the ever increasing threats on electronic communications at large. Finally, the question as to whether a multi-faceted approach, which includes a Model Law on spam would be a suitable starting point setting out requirements for the sending of unsolicited electronic communications can be sufficient in protecting consumers. And as spam is not only a national but also a global problem, South Africa needs to look at the option of entering into mutual agreements with other countries and organisations in order to combat spam at a global level. / Mercantile Law / LL. D.