Spam or ham? Characterizing and detecting fraudulent "not spam" reports in Web mail systems

Anirudh Ramachandran, Anirban Dasgupta, Nick Feamster, Kilian Weinberger

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Scopus citations

Abstract

Web mail providers rely on users to "vote" to quickly and collaboratively identify spam messages. Unfortunately, spammers have begun to use bots to control large collections of compromisedWeb mail accounts not just to send spam, but also to vote "not spam" on incoming spam emails in an attempt to thwart collaborative filtering. We call this practice a vote gaming attack. This attack confuses spam filters, since it causes spam messages to be mislabeled as legitimate; thus, spammer IP addresses can continue sending spam for longer. In this paper, we introduce the vote gaming attack and study the extent of these attacks in practice, using four months of email voting data from a large Web mail provider. We develop a model for vote gaming attacks, explain why existing detection mechanisms cannot detect them, and develop a new, scalable clustering-based detection method that identifies compromised accounts that engage in vote-gaming attacks. Our method detected 1.1 million potentially compromised accounts with only a 0.17% false positive rate, which is nearly 10 times more effective than existing clustering methods used to detect bots that send spam from compromised Web mail accounts.

Original languageEnglish (US)
Title of host publicationProceedings of the 8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference, CEAS 2011
Pages210-219
Number of pages10
DOIs
StatePublished - Oct 13 2011
Event8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference, CEAS 2011 - Perth, WA, Australia
Duration: Sep 1 2011Sep 2 2011

Publication series

NameACM International Conference Proceeding Series

Other

Other8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference, CEAS 2011
CountryAustralia
CityPerth, WA
Period9/1/119/2/11

All Science Journal Classification (ASJC) codes

  • Software
  • Human-Computer Interaction
  • Computer Vision and Pattern Recognition
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Spam or ham? Characterizing and detecting fraudulent "not spam" reports in Web mail systems'. Together they form a unique fingerprint.

  • Cite this

    Ramachandran, A., Dasgupta, A., Feamster, N., & Weinberger, K. (2011). Spam or ham? Characterizing and detecting fraudulent "not spam" reports in Web mail systems. In Proceedings of the 8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference, CEAS 2011 (pp. 210-219). (ACM International Conference Proceeding Series). https://doi.org/10.1145/2030376.2030401