Packet-level open-digest fingerprinting for spam detection on middleboxes
This paper proposes a stateless open-digest spam fingerprinting at the packet level (layer 3) based on an open-digest fingerprinting algorithm Nilsimsa. Spam emails show several characteristics when viewed at gateway level, which are suitable for spam fingerprinting: (a) content invariance and (b) r...
| Main Author: | |
|---|---|
| Format: | Article |
| Published: |
John Wiley & Sons, Ltd.
2011
|
| Subjects: |
| _version_ | 1796856577233256448 |
|---|---|
| author | Marsono, Muhammad Nadzir |
| author_facet | Marsono, Muhammad Nadzir |
| author_sort | Marsono, Muhammad Nadzir |
| collection | ePrints |
| description | This paper proposes a stateless open-digest spam fingerprinting at the packet level (layer 3) based on an open-digest fingerprinting algorithm Nilsimsa. Spam emails show several characteristics when viewed at gateway level, which are suitable for spam fingerprinting: (a) content invariance and (b) recipient address dispersion. In this paper, Nilsimsa is adapted to support both fingerprinting and fast email class estimation, on a per-packet basis. Email packets are incrementally fingerprinted on a per-packet basis, without the need for reassembly. Spam detection status is tagged to the last packet of each email. This in turn allows fast email class estimation (spam detection) at receiving email servers to support more effective spam handling on both inbound and outbound (relayed) emails. The work presented in this paper focuses on evaluating the accuracy of spam fingerprinting at the packet level with consideration on the constraints of processing byte streams over the network, including packet reordering, fragmentation, overlapped bytes, different packet sizes, and possibilities of random addition attacks. Results show that the proposed packet-level fingerprinting can detect spam with 100% random addition when the similarity threshold is set to between 36 and 59. This method gives 0% false positive and 100% true negative, which equals the performance attained for spam fingerprinting at full email abstraction (layer 7). This shows that classifying emails at the packet level can differentiate non-spam from spam with high confidence for a viable spam control implementation on middleboxes. |
| first_indexed | 2024-03-05T18:45:07Z |
| format | Article |
| id | utm.eprints-29559 |
| institution | Universiti Teknologi Malaysia - ePrints |
| last_indexed | 2024-03-05T18:45:07Z |
| publishDate | 2011 |
| publisher | John Wiley & Sons, Ltd. |
| record_format | dspace |
| spelling | utm.eprints-295592019-04-25T01:15:28Z http://eprints.utm.my/29559/ Packet-level open-digest fingerprinting for spam detection on middleboxes Marsono, Muhammad Nadzir TK Electrical engineering. Electronics Nuclear engineering This paper proposes a stateless open-digest spam fingerprinting at the packet level (layer 3) based on an open-digest fingerprinting algorithm Nilsimsa. Spam emails show several characteristics when viewed at gateway level, which are suitable for spam fingerprinting: (a) content invariance and (b) recipient address dispersion. In this paper, Nilsimsa is adapted to support both fingerprinting and fast email class estimation, on a per-packet basis. Email packets are incrementally fingerprinted on a per-packet basis, without the need for reassembly. Spam detection status is tagged to the last packet of each email. This in turn allows fast email class estimation (spam detection) at receiving email servers to support more effective spam handling on both inbound and outbound (relayed) emails. The work presented in this paper focuses on evaluating the accuracy of spam fingerprinting at the packet level with consideration on the constraints of processing byte streams over the network, including packet reordering, fragmentation, overlapped bytes, different packet sizes, and possibilities of random addition attacks. Results show that the proposed packet-level fingerprinting can detect spam with 100% random addition when the similarity threshold is set to between 36 and 59. This method gives 0% false positive and 100% true negative, which equals the performance attained for spam fingerprinting at full email abstraction (layer 7). This shows that classifying emails at the packet level can differentiate non-spam from spam with high confidence for a viable spam control implementation on middleboxes. John Wiley & Sons, Ltd. 2011-01 Article PeerReviewed Marsono, Muhammad Nadzir (2011) Packet-level open-digest fingerprinting for spam detection on middleboxes. International Journal of Network Management, 22 (1). pp. 12-26. ISSN 1055-7148 http://dx.doi.org/10.1002/nem.780 DOI:10.1002/nem.780 |
| spellingShingle | TK Electrical engineering. Electronics Nuclear engineering Marsono, Muhammad Nadzir Packet-level open-digest fingerprinting for spam detection on middleboxes |
| title | Packet-level open-digest fingerprinting for spam detection on middleboxes |
| title_full | Packet-level open-digest fingerprinting for spam detection on middleboxes |
| title_fullStr | Packet-level open-digest fingerprinting for spam detection on middleboxes |
| title_full_unstemmed | Packet-level open-digest fingerprinting for spam detection on middleboxes |
| title_short | Packet-level open-digest fingerprinting for spam detection on middleboxes |
| title_sort | packet level open digest fingerprinting for spam detection on middleboxes |
| topic | TK Electrical engineering. Electronics Nuclear engineering |
| work_keys_str_mv | AT marsonomuhammadnadzir packetlevelopendigestfingerprintingforspamdetectiononmiddleboxes |